Crypto ATMs Are Everywhere. And Dream Tools for Fraudsters

[Editor’s note: This article first appeared on the website of the non-profit Investigative Journalism Foundation and is republished with permission.]

In 2013, the world’s first cryptocurrency ATM opened in a downtown Vancouver coffee shop across the street from the city’s largest courthouse.

Today, they’re everywhere. The website Coin ATM Radar estimates there are more than 3,100 such machines in Canada in corner stores, cafés or even bars and bubble tea shops.

For cryptocurrency enthusiasts, it’s a symbol of how virtual currencies have gone mainstream.

But to police, the proliferation of cryptocurrency ATMs reflects something else: how those devices have become essential tools for fraudsters and financial criminals.

David Coffey, a detective with the Toronto Police Service, said his department gets daily reports involving the machines. He thinks they should be banned outright.

“It’s too easy,” Coffey said. “It’s just simply too easy for fraudsters to use them and launder funds.”

In May, Canada’s anti-money laundering watchdog issued a bulletin about cryptocurrency ATMs, warning they were “becoming a key tool” for money laundering.

The Financial Transactions and Reports Analysis Centre of Canada, or Fintrac, said in that bulletin that it had evidence of “high volumes of low-dollar transactions” where the money went towards “purchase of drugs, child sexual abuse material, cyber exploit marketplaces for malicious cyber-tools or services and fraud shops for compromised payment information or identity documents.”

Fintrac also said it had evidence cryptocurrency sent through the machines was being “off-ramped at exchanges located in Iran, Russia, Belarus and neighbouring jurisdictions.”

Cryptocurrency sent through such ATMs can be traced but is rarely recovered. That’s also made the ATMs a favourite tool of scammers, who direct their victims to deposit cash into the machines.

Some countries agree with Coffey. The United Kingdom has effectively banned crypto ATMs and this year began prosecuting a man for running one illegally. In Australia, regulators announced a crackdown in December, noting some Australians were “losing their life savings” to frauds through the machines.

There’s no sign of a similar move in Canada, where cryptocurrency machines are already subject to anti-money laundering laws. Industry proponents say those regulations have helped stamp out illegal activity and that most of the transactions through their devices are legitimate.

But observers say there’s still too much crime happening through those machines and some operators aren’t doing enough to protect consumers from fraud.

“The vast majority of the ATM [operators] are good players,” said Joseph Iuso, the executive director of the Canadian Money Services Business Association. “But there are just some stragglers and hagglers who think we should live in an anonymous world and everyone should be free to do what they want, even if they get scammed.”

Early warnings

The company behind that first ATM in Vancouver knew it would be a big deal.

“I knew it was going to grow, and that crypto was going to grow,” said Chris, who purchased Bitcoiniacs in 2014.

The premise is fairly simple. Users insert cash in exchange for cryptocurrency, usually bitcoin, which is then sent to an online wallet of their choice. The companies that run the machines make money by charging a commission on those transactions.

The stores that host the ATMs rarely own them. Usually, they’re compensated by operators in exchange for providing electricity and space.

Bitcoiniacs operates about 50 ATMs, Chris said. That’s not many. Localcoin, the largest Canadian operator, has more than 950 ATMs in the country, according to its website. And some companies, like U.S.-based CoinFlip, say demand is still growing.

“What we hear from our customers is that they like the convenience, speed and ability to buy crypto with cash at our locations,” said Dana Callahan, a CoinFlip spokesperson.

Chris said customers are people who want to invest in cryptocurrency as an asset. Others might be trying to send remittances to family abroad, especially if the local currency is volatile or experiencing inflation.

But the machines can also be used to convert cash into an asset that can then be sent anywhere in the world, outside the traditional financial system, making them attractive for criminals.

The sector has always had a tinge of lawlessness. Chris, for example, asked that his last name not be published here: he worries his bank will stop servicing him if they learn he is involved in the cryptocurrency industry. Operators interviewed for this story say they long struggled to find banking because institutions viewed them as too risky, or simply as illegitimate.

Until 2020, there were no federal regulations on such devices. And it wasn’t long before some operators began suspecting their clients were up to no good.

“I wasn’t happy with the fact there was no regulation at first, because people would go in and put $100,000 in the machine without anyone asking any questions,” said Hodl Digital Services CEO Sam Mokbel.

Mokbel’s company operates roughly 300 cryptocurrency ATMs, making it the second-largest player in Canada. But he said the lack of rules around identification collection meant there was no proper mechanism to report strange transactions to police, something he said he tried to do.

“They would spend half an hour stuffing money into the machine and you have no documentation,” Mokbel said.

In 2018, Vancouver police went as far as calling cryptocurrency ATMs an “ideal money laundering vehicle.” The city considered a ban but decided against it, in part because of worries that financial technology companies “could wrongly interpret a ban on cryptocurrency ATM as hostility or lack of government support,” according to a staff report.

In 2020, the federal government began regulating those ATMs under anti-money laundering and anti-terrorist financing laws. Operators of such devices now have to report suspicious and large cash transactions to Fintrac, which can disclose that information to police.

Mokbel and Chris said the federal regulations, in general, have made the ATMs far less appealing for large-scale money laundering. Mokbel said some unscrupulous operators exited the market entirely.

But Iuso said the problem is far from solved. He believes some operators aren’t doing enough to check for “structuring” — sending small transfers of money to avoid reporting requirements. Some ATMs, Iuso noted, require only a phone number to send less than $1,000.

“If I’m a smart criminal, I’m sending my crypto to 10 different addresses. I’m using 10 different email addresses and 10 different phone numbers. And what’s stopping them?” Iuso said.

The Investigative Journalism Foundation visited 10 different cryptocurrency ATMs in downtown Vancouver. Most required only a phone number for transactions under $1,000. Clerks at stores — who asked not to report their names — told the IJF the machines were usually used by a small handful of the same patrons, some of whom came daily to convert cash into cryptocurrency.

Of all those machines, the most stringent requirements were at the first-ever cryptocurrency ATM opened by Bitcoiniacs.

Bitcoiniacs requires ID for any transaction over $420 — a not-so-subtle reference to cannabis subculture, and less than half the federally mandated limit.

Chris said his company did that because they want to limit the risk of fraud — something he thinks has ultimately cost him money.

“Even to this day, we turn away 70 per cent, 80 per cent of business,” Chris said.

Trick of a machine

Authorities say scammers have taken advantage of the proliferation of such ATMs.

Jeff Horncastle, a spokesperson for the Canadian Anti-Fraud Centre, said fraudsters sometimes convince victims they are using the ATMs to make legitimate payments to a bank or a government agency.

“They [scammers] would convince victims that they were using a government secure payment method. Because for the most part, Canadians didn’t know what a bitcoin ATM is,” Horncastle said.

Horncastle said the CAFC doesn’t have specific statistics on cryptocurrency ATMs. But Coffey, the Toronto police detective, said they feature regularly in reports, particularly romance and investment scams.

Fintrac’s advisory outlined a “typology” of such scams, noting some victims were on the phone while inserting money. And once the transaction is done, Horncastle said, there’s likely little chance of recovering the money.

“They’re very time-consuming — a lot of resources are required. It’s not tied to any specific country or currency,” Horncastle said. “As long as the bitcoin address is provided, you can send it anywhere.”

Operators interviewed for this article do take steps to prevent fraud. In downtown Vancouver, most cryptocurrency ATMs are dotted with stickers warning about the risk of scams. Operators also often use technology to track where cryptocurrency is being sent, and some may even block customers they believe are up to no good.

Mokbel said his employees may even phone a customer directly if they’re a first-time user inserting a large amount of money.

“Every once in a while the customer wakes up,” Mokbel said.

Many observers worry the growing popularity of cryptocurrency may feed into scams.

The price of one bitcoin recently exceeded US$100,000. American president-elect Donald Trump has said the U.S. government may create a “strategic reserve” of the virtual currency. And the City of Vancouver, which just a few years ago was considering banning cryptocurrency ATMs, recently directed staff to explore how to make the city “bitcoin-friendly.”

Amber Scott, who works for the compliance consulting company Outlier Solutions, believes one challenge is that current laws don’t allow private companies to directly share information about suspicious actors. Cryptocurrency operators can’t tell each other if a client is suddenly depositing money into multiple different machines.

“We’re moving in the right direction. But never as quickly as the bad guys, unfortunately,” Scott said. She also believes governments need to bolster funding for police investigating fraud.

“At the end of the day, if a police force isn’t able to move forward, if we’re not able to have arrests and prosecutions, we still look like very soft targets,” Scott said.