If a caller tells you to withdraw cash, use a Bitcoin ATM, or hand money to a courier to protect your savings, pause before doing any of it. The next useful step is an independent conversation with your actual financial institution, using a contact method you already trust.
The FTC's warning about being sent to a Bitcoin ATM describes a protection story built around fear, urgency, and secrecy. The caller creates a supposed emergency, then presents moving money as the solution. An alleged government Bitcoin wallet or federal safety locker is part of that story.
This guide focuses on the moment when a frightening conversation becomes a payment instruction. You do not need to solve the caller's whole story, understand cryptocurrency, or identify a courier before declining the next step. You can stop the transaction and check independently.
Key Takeaways
- Treat an unexpected demand to move savings for protection as a reason to stop and verify independently.
- A working Bitcoin ATM, familiar store, pickup code, or official-sounding caller does not establish who should receive your money.
- A supplied Bitcoin ATM payment QR code can direct cryptocurrency to someone else's wallet.
- Respond according to what actually happened: cash still held, transaction in progress, crypto sent, or cash collected.
- Preserve existing records, report promptly, and be cautious about offers to recover money for another payment.
What to do now: make room for an independent check
The following is a practical way to interrupt the process before money leaves your control. Adapt it to what is happening, without attempting to investigate or confront anyone.
- Stop the payment action. Do not withdraw additional cash, feed more money into a Bitcoin ATM, scan another supplied payment code, or proceed with a pickup while you are checking the demand.
- End the directing conversation. You do not need to obtain the caller's permission to verify independently. If you feel overwhelmed, ask a trusted person to sit with you while you contact your institution.
- Use an established contact method. Start with your bank card, statement, or existing banking app. Do not use a number, link, or supposed bank representative supplied within the alarming conversation.
- Explain the actual request. State whether you were told to buy crypto, send it to a wallet, hand over cash, or conceal the reason for a withdrawal.
- Ask about your account and the next action. Describe what you have already done. Let the institution address any real account concern through its normal process.
A useful opening is: "I received a call claiming my money is at risk. The caller wants me to use a Bitcoin ATM or give cash to a courier. I have stopped. Can you help me check my account and decide what to do next?"
Keep the conversation specific. If you shared a password, received a real transaction notification, or allowed someone to access a device, say so. An independent check should address the actual exposure, rather than rely on a blanket reassurance that every account is fine.
You can also tell a trusted person, "Please help me make the independent call. I do not need you to decide whether the caller sounds convincing."
Bitcoin ATM or cash pickup: who gets your money?
A Bitcoin ATM is different from the bank ATM you might use to withdraw cash. A bank withdrawal gives you cash that you still control until you spend or hand it over. A cryptocurrency kiosk can turn the cash you insert into a cryptocurrency purchase and transfer. That difference matters when you describe what happened and ask what can still be stopped. The FBI's May 2026 cryptocurrency kiosk advisory describes these terminals as exchanging cash and cryptocurrency. It also warns that legitimate government and law-enforcement officials will not call demanding payment through a cryptocurrency kiosk.
You do not need to understand every cryptocurrency term to recognize the immediate risk. Cash going into the machine and cryptocurrency going to a recipient are consequential steps; an account-protection story does not make either step a safe deposit in your bank account. The important question is what the caller wants the Bitcoin ATM to do with your cash. Are you making a purchase you independently chose, or following someone else's instructions to fix an alleged emergency? Do you understand who controls the destination, or have you been told to scan whatever arrives in a message?
Cash couriers replace the Bitcoin ATM with a person. The FBI's alert about couriers collecting cash and precious metals describes impersonators claiming accounts are endangered and arranging collection. The pickup can involve a shared code or a dollar-bill serial number. Those details are part of the procedure, not independent proof that a bank or agency arranged it.
As a practical test, separate the payment method from the reason for paying. A Bitcoin ATM can function as intended while carrying out a harmful instruction. A courier can arrive at the right address and know the agreed code while representing the person who supplied it.
That distinction also helps avoid an unhelpful conclusion that every cryptocurrency purchase or cash delivery is fraudulent. This article addresses unexpected demands, supposed protection arrangements, and destinations controlled by someone you have not independently verified. It is not a certification of any particular Bitcoin ATM operator or transaction.
For a broader way to assess a proposed crypto payment or investment, use the Crypto Scam Warning Signs guide. Here, the immediate priority is simpler: do not let the caller's payment instructions become your verification process.
What scanning a Bitcoin ATM payment code can actually do
The FBI's cryptocurrency ATM and QR-code alert explains that a payment code can populate a recipient field. In the scheme it describes, the supplied code points to the criminal's wallet. The victim withdraws money, buys cryptocurrency, and follows instructions to send it while remaining in contact with the scammer.
At a Bitcoin ATM, a QR code can be an instruction about destination. Its neat appearance, successful scan, or association with a recognizable machine does not authenticate the person who supplied it. You are not checking the caller's identity by using the caller's code.
An illustrative destination check
Imagine someone tells you, "This code opens your protected account." You arrive at a Bitcoin ATM and the code fills in a long address. The Bitcoin ATM screen looks ordinary, and the caller says the name is hidden for security.
There are two unanswered questions: who controls that address, and what independent institution confirms the arrangement? A label in a message cannot answer them. Neither can the caller repeating that it belongs to you.
In that situation, do not scan the code to find out whether the story is true. Do not insert a small amount as a test of the alleged protection service. Stop using the caller's instructions and contact your actual bank through a separate channel.
What a Bitcoin ATM receipt does and does not prove
A receipt may be useful for documenting a transaction. As a matter of practical interpretation, it does not establish that the recipient was authorized to hold your savings or that the caller's claimed emergency existed.
If you already have a Bitcoin ATM receipt, keep it. Avoid trying to prove the story by making another payment or by sending the receipt back to the person directing you. Your task is to preserve what happened and seek independent assistance, not to complete the caller's demonstration.
Pressure, secrecy, and a believable pickup procedure
Look at the instruction you are being asked to follow, rather than trying to judge a voice. A calm caller can make an unreasonable payment demand. A frightening explanation can still be unverified.
The following are illustrative decision examples. They are not accounts of particular victims, and no single detail is a substitute for independent checking.
The handoff between supposed specialists
An apparent support representative transfers you to a supposed bank specialist, who then introduces an alleged investigator. Each person confirms the previous person's story. You are told the sequence proves the case is serious.
Treat that as one conversation arranged through the original contact. The number of people speaking does not turn it into an independent bank check. End the chain and reach your institution using information from a bank card, account statement, or established banking app.
You do not need to accuse anyone. A simple statement is enough: "I will contact my bank independently. I am not withdrawing or transferring money during this call."
The coached bank explanation
Suppose a caller tells you to describe a withdrawal as home repairs and says revealing the actual reason would compromise an investigation. The useful signal is the instruction to conceal the payment's purpose from your bank.
Do not rehearse the cover story. Tell the bank what you were actually asked to do. You can say, "Someone claiming to protect my account instructed me to withdraw cash and give it to another person. They told me not to explain this to you."
This approach gives the institution the information you need it to consider. It does not depend on a bank employee recognizing every detail or on you having the perfect fraud terminology.
The cash courier with the right password
A person arrives, gives the expected code, and says a supervisor is waiting for confirmation. You might feel that the matching code has settled the question.
It has settled only that the person knows the arranged code. The missing issue is whether the collection itself was legitimately authorized. Do not let a match replace the independent conversation that should happen before a handoff.
Another FBI warning about cash couriers in cryptocurrency investment scams describes pickups used when bank transfers are blocked. It also notes that an apparent investment balance can increase afterward. A change on a website therefore should not be treated as proof that cash reached a genuine investment account.
The recognizable caller ID
Treat the name or number displayed on your phone as a claim to check, not as sufficient authorization. Likewise, a person repeating details about you has not independently established a right to receive your savings.
The same rule applies when the caller tells you not to involve family. Ask yourself whether you are being allowed to choose your own source of verification. If the only permitted checks lead back to that caller, pause the payment.
If this already started, respond to the payment stage
First stop any next payment and address an immediate safety concern. Then describe what happened in plain language. "I scanned a code" is different from "I sent cryptocurrency." "I withdrew cash" is different from "I handed the cash over." If you are unsure whether a transfer completed, say what you observed and ask the operator to check its record. Do not make another payment to test the answer. These distinctions help the bank, operator or reporting agency understand which part of the process occurred.
The FTC's guide to what to do after a scam recommends prompt contact with the relevant payment provider. For cryptocurrency sent through a Bitcoin ATM or exchange, contact that operator or exchange and ask for help. For a fraudulent bank transfer, contact the bank. Asking about reversal or refund possibilities is appropriate; it is not a promise of recovery.
You have not withdrawn or handed over anything
Stop before the next payment instruction. Preserve any messages you already have, then make the independent bank call. There is no need to visit a Bitcoin ATM, meet the proposed courier, or scan a code to gather better evidence.
If a pickup is arranged, do not continue it as an informal test. You do not owe the collector a meeting or an explanation. If a person is at your door, you do not have to open it or show them the cash. If you feel unsafe or face an immediate threat, prioritize getting appropriate emergency assistance rather than recording the encounter or negotiating with the collector.
You withdrew cash but still have it
Keep the cash from the proposed handoff while you contact your bank. Explain why you withdrew it and ask about securely returning it to your account through the bank's normal process.
Do not improvise a return arrangement with the caller, send a photograph of the cash to prove compliance, or move it to a second location the caller chooses. Avoid broadcasting that you are carrying cash. The point is to regain an independent decision, not to finish the operation in a different way.
You are at a Bitcoin ATM or partway through its process
Stop adding money or following remote instructions. Contact the Bitcoin ATM operator using independently checked information and explain the transaction stage. Ask what can still be stopped or addressed. Do not assume a displayed prompt, a cancellation option, or an unfinished-looking screen means cash will automatically be returned.
If someone is pressuring you in person, do not try to argue about the machine or wallet. Seek a safer situation and help. You can preserve available transaction information without keeping the confrontation going.
You sent cryptocurrency through a Bitcoin ATM
Contact the Bitcoin ATM operator or exchange promptly. Keep the receipt and any available transaction identifier and destination wallet address. Describe the impersonation or protection demand, rather than merely saying you changed your mind about a purchase.
Do not make a second Bitcoin ATM payment to release, reverse, insure, or unlock the first one. Follow up through independently verified support channels. Be candid with yourself and anyone helping: a completed transfer may be difficult to recover, and nobody should promise that a particular form or phone call will undo it.
Cash has been collected
Stop further payments and preserve the pickup instructions and communications. Report the handoff and any threats promptly. Do not arrange another meeting, follow the courier, or attempt to retrieve the money yourself.
Describe the bank withdrawal separately from the physical handoff. You can ask your institution what assistance is available without assuming that a voluntary cash withdrawal followed by a collection carries the same remedies as another payment type.
Keep Bitcoin ATM and pickup evidence without continuing the encounter
The goal is an understandable record, not a perfect investigation. Save what already exists before deleting messages or blocking contacts, when doing so is safe. You do not need to keep talking in order to collect more.
For a Bitcoin ATM incident, useful records can include the receipt, machine location, approximate time, amount, transaction identifier, destination wallet address, supplied code, and messages containing instructions. If you do not know a Bitcoin ATM transaction detail, mark it unknown rather than guessing.
For a cash pickup, record the amount, time, location, instructions, and any courier details you already observed. Note a pickup code or serial-number instruction if it was used. Do not leave a safe place to obtain a photograph, license plate, or identity detail.
Organize the sequence in ordinary sentences: "The first call was on Tuesday. I was told to withdraw money on Wednesday. I handed it over that afternoon." Keep original messages as well as your summary. Record estimates as estimates, especially for times and amounts.
Send sensitive records only through the official support or reporting channel you have independently reached. Avoid public posts containing your address, account statements, identification documents, or access credentials. If the episode also involved exposed personal information, the Privacy & Identity Protection hub can help you separate those follow-up concerns from the payment report.
Keep the identifiers your actual operator provides, and ask which record each identifies if you are unsure. A short Bitcoin ATM reference may differ from the blockchain transaction hash. Reading those fields does not establish that the recipient is legitimate or that a transfer can be undone.
Report what happened without waiting for certainty
You do not need to identify a suspect, reconstruct a Bitcoin ATM transfer, or identify a courier before reporting. Describe the demand, the payment route, what you actually did, and what you still have.
The FBI advisories linked above direct victims to the Internet Crime Complaint Center, known as IC3, and identify useful transaction and contact details. Use the official complaint route provided on those pages. The FTC's response guide links to its official fraud-reporting service. Keep your report confirmation and any reference number you receive. For a Bitcoin ATM report, distinguish the cash you inserted from any transfer you know was completed.
For a physical collection, threats, or an immediate safety concern, contact local law enforcement through an appropriate official channel. A report to one destination should not be treated as a substitute for urgent safety assistance or notifying your financial institution.
A practical reporting summary might be: "A person claiming to be a government investigator told me to withdraw cash to protect my account. I was instructed to keep the reason secret. A courier collected the money at this time and location. These are the messages and withdrawal records I have."
Treat reporting as an information-sharing and assistance step. It does not guarantee an investigation, reimbursement, immediate personal contact, or a particular outcome. Preserve that distinction if someone later calls claiming your report entitles you to a refund.
Be careful with the next offer to recover your money
After a loss, a promise to undo it can feel like the first good news of the day. Pause that conversation too.
The FTC's warning about refund and recovery scams describes unsolicited approaches to people who have already lost money. Demands for an advance fee or financial information are warning signs. Independently check the claimed organization rather than relying on the new contact's explanation.
Separate a claim about tracing a transaction from a promise to return funds. Even a convincing-looking transaction diagram does not, by itself, establish authority to recover money or a right to collect another payment from you.
Illustrative warning demands include paying a release fee at a Bitcoin ATM, sending more cryptocurrency for an alleged clearance, or giving a new caller bank credentials so they can deposit a refund. Do not continue through those instructions as a way to find out whether they work.
Use your existing official report reference and independently verified contact methods to check any claimed follow-up. Ask what action is requested and which institution can confirm it through its normal channel. Do not let knowledge of your earlier loss replace that check.
You can use a short script: "I will not pay a recovery fee or provide account access during an unsolicited conversation. I will contact the organization independently." Keep the new messages alongside the original incident records.
Help someone pause without blaming or taking over
If someone tells you about a frightening call or a completed payment, start with the next useful action. The following suggestions are a practical support approach, not a test of the person's judgment.
Say, "Thank you for telling me. Let's stop any next payment and call the bank through your usual contact method." Ask what has happened so far: cash withdrawn, Bitcoin ATM used, crypto sent, or cash collected. Avoid starting with why the person believed the caller.
Offer specific help that preserves their participation. You might sit beside them during the bank call, help organize existing messages, or write down the transaction sequence together. Let them explain the situation in their own words. Do not ask them to prove the entire story before you help.
If a courier visit is pending, focus on stopping the handoff and obtaining appropriate assistance. Do not volunteer to confront or follow the collector. If the conversation includes threats or immediate danger, make safety the priority.
After the immediate response, agree on a simple rule for future contact: pause any unexpected request to use a Bitcoin ATM or hand over savings, end the directing conversation, and independently contact the institution. That is easier to apply than memorizing every impersonator title or payment variation.
Keep the follow-up manageable. A bank conversation, an incident summary, and the appropriate reports are concrete tasks. Repeatedly revisiting the mistake or demanding certainty about recovery does not replace them.
Conclusion
A Bitcoin ATM and a cash courier are different payment routes, but both can be wrapped in the same supposed protection story. The decision point is before scanning, feeding in cash, or handing it over. Stop the instruction chain, contact your actual institution independently, and respond according to what has already happened.
If money has left your control, preserve available records and seek help promptly without accepting a guarantee that it can be recovered. A second payment should not become the price of finding out whether the first story was true.
For related payment and investment decisions, the Crypto Scams & Emerging Tech Risks hub connects the broader warning signs. You can also subscribe to Quantum Cyber AI for practical explanations of scams, privacy, and account safety.
FAQ
Is every Bitcoin ATM a scam?
No. The distinction is between a payment device and the instruction you are following. This guide addresses unexpected demands to use a Bitcoin ATM for alleged protection or another unverified purpose. A familiar store or functioning machine does not settle who receives the payment or whether the demand is legitimate.
What if the caller says the QR code creates a wallet in my name?
Do not accept that statement as proof that you control the destination. A payment code can populate someone else's recipient address. Stop before using the supplied code and check the claimed arrangement through an independent institutional contact. Do not send a test payment to establish whether the protection story is true.
What if I withdrew cash but have not given it to anyone?
Stop the proposed handoff and contact your bank using an established channel. Explain the actual reason for the withdrawal and ask how to handle the cash securely through its normal process. Do not follow a caller's replacement instructions for where to take it or whom to meet.
Can a Bitcoin ATM operator recover cryptocurrency I already sent?
Contact the operator promptly and ask what assistance remains possible. Preserve the receipt and available transaction details. Do not assume that a refund request means a completed transfer can be reversed, or pay another person who guarantees recovery. The answer depends on what actually happened, not on the caller's assurance.
Does a cash courier's matching pickup code prove the collection is real?
It proves the person knows the arranged code. It does not independently authenticate the organization or authorize the handoff. Do not give over money because that detail matches. Stop the collection and contact the actual institution through a channel separate from the original conversation.