New Bitcoin ATMs that allow users to tap into cryptocurrencies easily and quickly are popping up all over, and cyber-criminals are taking note.
Cryptocurrency usage is skyrocketing, and it would only seem logical that the next wrinkle would include Bitcoin-based automated teller machines (BTMs), crypto kiosks, or crypto ATMs. In fact, chances are high you may have seen one — there are as many as 50,000 machines in the United State today and that number is growing.
But what exactly is a crypto ATM, and how do you use it? More importantly, how and why are criminal actors utilizing them for fraud, scams, and illicit schemes? Are the controls in place to know who is using the ATM — such as traditional banking’s Know Your Customer (KYC) rules — sufficient? And does a crypto ATM provide greater access to the underbanked, or is it an easy tool for nefarious actors?
Seth Sattler is Director of Compliance at DigitalMint, a Chicago-based bitcoin ATM operator with a presence in more than 40 states. Sattler’s team works to create a system of controls to better know who is using the machines by requiring basics identity verifications and more.
“More than half of the 36,000 BTMs in the United States do not require photo identification to conduct transactions ranging from $250 to over $1,000,” Sattler says.
Some in the industry say heightened identification verification is unnecessary, that simply requiring a phone number and matching it against a database is verification enough. Yet, as Sattler describes, this might be a very risky proposition and one that does not outweigh the reward.
What are crypto ATMs
In its most basic form, crypto ATMs are a simple and familiar way for individuals to convert fiat currency (general government currency like dollars, Euros, or pounds) into cryptocurrency. A person simply walks up to a stand-alone kiosk to purchase crypto by inserting cash or their debit card and completing a few basic steps. They aren’t nearly as intimidating as going online, accessing a crypto exchange, and dealing with next gen concepts like crypto wallets. Indeed, these crypto ATMs may be more approachable for certain individuals who may not be as comfortable with technology or are distrustful of digital banking.
“Most people are familiar with crypto ATMs. You can probably find one in your local convenience store or gas station,” Sattler says. “Cryptocurrency kiosks are the Red Box of crypto transactions,” referring to the popular stand-alone DVD rental kiosks found in many convenience and grocery stores.
And, the more ubiquitous cryptocurrencies become, the more average citizens become comfortable using it, at least to an extent. Which is why a crypto ATM kiosk provides a happy medium for those who aren’t tech-savvy yet demand privacy for these types of financial activities.
Why crypto ATMs are attractive to criminal actors
Unfortunately, these are the same advantages that lure criminals — especially those who are always looking to innovate — toward crypto ATMs in the hope of yet another opportunity to launder funds or defraud unsuspecting victims. Sattler reminds us that crypto ATMs can be a boon to bad actors for a few reasons. First, the sheer number and accessibility of these ATMs makes it easier to facilitate illicit transactions; and second, because identification verification regulations are lacking or inconsistent across states, it’s much easier to instantly and anonymously convert fiat currency to Bitcoin. Further complicating anti-fraud attempts is the sheer quantity of crypto ATM operators.
In one major US city, for example, you might have 15 different ATM operators in a given neighborhood. And unfortunately, they don’t talk to each other, Sattler notes. “If I am laundering $15,000, I could use three different crypto ATM operators with daily limits of $5,000 to transfer the dirty money to my desired destination. This process could be efficient and scalable because there are so many crypto ATM operators in each region.”
On the fraud side, the scams run the gamut, including romance scams, he says. “The process is incredibly simple — the criminal sends the victim a QR code with instructions to go to the local convenience store with cash. Scan the code, deposit the money. It’s literally that simple,” Sattler explains.
The case for better crypto ATMs identity controls
There are real-world advantages to using crypto ATMs, despite some of the identity control challenges. Simply put, you don’t have to be tech-savvy to use one. A person who has used a traditional ATM will likely feel comfortable interacting with a crypto ATM. They are fast, secure and the user doesn’t need to be a Blockchain expert or navigate complicated trading platforms to enter the world of cryptocurrencies. They also eliminate the ubiquitous problem of currency conversion. Individuals traveling in a foreign country, for example, wouldn’t need to go to a currency exchange to convert their digital assets. Instead, they could use a crypto ATM to access their account.
Sattler says he understands the argument that everyone should have access to crypto, but he pushes back on avoiding any controls. DigitalMint requires basic identification for every transaction, and it validates that identification through third-party databases that screen against from sanctions lists to politically exposed persons. It even scans the wallet against known Darknet market analysis activity.
“A crypto ATM operator that claims to take crime prevention seriously should require identification and third-party validation for every transaction, at a minimum,” Sattler says, adding that if the average Darknet market transaction is between $18 and $80 per month for a terrorist-financing donation scheme, it is easy to see how this type of crime happens.
Also, Sattler describes what he calls “the Netflix password-sharing problem.” If all that is required to conduct a transaction at a crypto ATM is a phone number, what is to prevent criminal actors from just sharing the same phone number between one another and across multiple schemes? Anyone can simply walk up to the ATM, type in the phone number, a four-digit pin, and use it. No identity verification, no biometric retinal scan, and certainly no personal identifying information.
Information-sharing is the better way forward
With a lack of uniform KYC rules applying to crypto ATMs, Sattler offers several suggestions to mitigate criminal activity at the outset. The best advice for crypto operators is to forge a combination of identity verification and industry-wide information-sharing, which is the linchpin of stopping bad actors.
For example, criminals will often utilize the same QR code; and if ATM operators can identify that one QR code from a victim, they can blacklist the user and wallet everywhere; preventing further victimization at multiple operators, Sattler says, adding that information should be shared with law enforcement, other ATM operators, and more. Further, these types of criminal patterns are not isolated, Sattler observes, noting he has seen instances where criminals target everyone with the name Deborah over the age of 60 in North Dakota, for example.
Although maybe just 2% of the Deborahs will actually report the fraud incident, if there were an easy way to share information, operators could detect a larger pattern and identify the typology. “The only way forward is for all of us to work together,” Sattler says.
To learn more about information-sharing, visit the Cryptocurrency Compliance Cooperative, a consortium of traditional financial services, blockchain forensics companies, banks, and Bitcoin ATM organizations that share information with the aim of improving the industry.
