New bitcoin ATMs that give users quick and easy access to cryptocurrencies are popping up everywhere, and cybercriminals are taking notice.
Cryptocurrency usage is skyrocketing, and it would seem logical that the next wrinkle would include Bitcoin-based ATMs (BTMs), crypto kiosks, or crypto ATMs.. In fact, there’s a good chance you’ve seen one – there are up to 50,000 machines in the US today and that number keeps growing.
But what is a crypto ATM and how do you use it? More importantly, how and why do criminal actors use them for frauds, scams and illicit schemes? Are the controls in place for who is using the ATM, such as traditional Know Your Customer (KYC) banking rules, sufficient? And does a crypto ATM provide better access for the underbanked, or is it an easy tool for nefarious actors?
Seth Sattler is Chief Compliance Officer at DigitalMint, a Chicago-based Bitcoin ATM operator with operations in over 40 states. The Sattler team is working to create a control system to better know who is using the machines by requiring basic identity verifications and more.
“More than half of the 36,000 BTMs in the United States don’t need photo ID to complete transactions ranging from $250 to over $1,000,” Sattler says.
Some in the industry say strong identity verification is not necessary, that simply requiring a phone number and matching it to a database is sufficient verification. Still, as Sattler describes it, it could be a very risky proposition and one that doesn’t outweigh the reward.
What are Crypto ATMs
In its most basic form, crypto ATMs are an easy and familiar way for individuals to convert fiat currency (general government currency like dollars, euros, or pounds) into cryptocurrency. A person simply goes to a standalone kiosk to purchase crypto by inserting cash or their debit card and following a few basic steps. They aren’t as daunting as going online, accessing a crypto exchange, and dealing with next-gen concepts like crypto wallets. Indeed, these crypto ATMs may be more accessible for some people who may not be as tech savvy or wary of digital banking.
“Most people are familiar with crypto ATMs. You can probably find one at your local convenience store or gas station,” says Sattler. “Cryptocurrency kiosks are the red box crypto transactions,” referring to the popular stand-alone DVD rental kiosks found in many convenience stores and grocery stores.
And, the more ubiquitous cryptocurrencies become, the more average citizens feel comfortable using them, at least to some extent. This is why a crypto ATM kiosk provides a happy medium for those who are not tech-savvy but require privacy for these types of financial activities.
Why Crypto ATMs Attract Criminal Actors
Unfortunately, these are the same perks that draw criminals – especially those always looking to innovate – to crypto ATMs in hopes of a new opportunity to launder funds or defraud unsuspecting victims. Sattler reminds us that crypto ATMs can be a boon to bad actors for several reasons. First, the number and accessibility of these ATMs facilitates the facilitation of illicit transactions; and second, because identity verification regulations are lacking or inconsistent from state to state, it is much easier to instantly and anonymously convert fiat currency to Bitcoin. The amount of crypto ATM operators further complicates anti-fraud attempts.
In a large US city, for example, you might have 15 different ATM operators in a given neighborhood. And unfortunately, they don’t talk to each other, notes Sattler. “If I laundered $15,000, I could use three different crypto ATM operators with daily limits of $5,000 to transfer the dirty money to my desired destination. This process could be efficient and scalable because there are so many crypto ATM operators in each region.
On the fraud side, scams run the gamut, including romance scams, he says. “The process is incredibly simple – the criminal sends the victim a QR code with instructions on how to get to the local convenience store with cash. Scan the code, deposit the cash. It’s literally that easy,” explains Sattler.
The Case for Better Crypto ATM Identity Control
There are tangible benefits to using crypto ATMs, despite some of the identity verification challenges. Simply put, you don’t have to be tech savvy to use one. Someone who has used a traditional ATM will likely feel comfortable interacting with a crypto ATM. They are fast, secure, and the user does not need to be a Blockchain expert or navigate complicated trading platforms to enter the world of cryptocurrencies. They also eliminate the pervasive problem of currency conversion. People traveling to a foreign country, for example, would not need to visit a currency exchange to convert their digital assets. Instead, they could use a crypto ATM to access their account.
Sattler says he understands the argument that everyone should have access to cryptography, but he refuses to avoid scrutiny. DigitalMint requires basic identification for every transaction, and it validates that identification through third-party databases that filter politically exposed person sanctions lists. It even scans the portfolio against known Darknet market scan activity.
“A crypto ATM operator that claims to take crime prevention seriously should require at least third-party identification and validation for every transaction,” Sattler says, adding that if the average Darknet market transaction is between 18 and $80 a month for a terrorist-donation program funding, it’s easy to see how this type of crime happens.
Additionally, Sattler describes what he calls “the Netflix password sharing problem.” If all that is needed to complete a transaction at a crypto ATM is a phone number, what will stop criminal actors from simply sharing the same phone number among themselves and across multiple systems? Anyone can just walk up to the ATM, type in the phone number, a four-digit PIN, and use it. No identity verification, no biometric retina scans and certainly no personally identifying information.
Sharing information is the best way forward
In the absence of uniform KYC rules applying to crypto ATMs, Sattler offers several suggestions to mitigate criminal activity from the start. The best advice for crypto traders is to forge a combination of industry-wide identity verification and information sharing, which is the keystone to stopping bad actors.
For example, criminals will often use the same QR code; and if ATM operators can identify this QR code of a victim, they can blacklist the user and the wallet everywhere; prevent further victimizations at multiple operators, Sattler says, adding that the information should be shared with law enforcement, other ATM operators, etc. Moreover, these types of criminal patterns are not isolated, observes Sattler, noting that he has seen cases where criminals target everyone with the name. Deborah over 60 in North Dakota, for example.
Although perhaps only 2% of Deborahs will effectively report the fraud incident, if there was an easy way to share information, operators could detect a larger pattern and identify the typology. “The only way forward is for us all to work together,” Sattler says.
To learn more about information sharing, visit the Cryptocurrency Compliance Cooperativea consortium of mainstream financial services, blockchain forensics firms, banks, and bitcoin ATM organizations that share information with the goal of improving the industry.