COLORADO SPRINGS — Betty Kerwin remembers the “heightened feverishness” — and the fear.

In February, the 91-year-old spent hours on the phone with anonymous men impersonating the Geek Squad at Best Buy, demanding she send them cash. By the time she hung up, she’d fed $8,000 into a cryptocurrency ATM: all the money in her checking account.

“I let all those things pass my better judgement,” said Kerwin, a retired social worker who lives in Colorado Springs. 

“Every time I put something in, I said to myself, ‘I can shut this phone off … I can go find the police. Maybe if I told the store owner, they would help me.’ But I didn’t.”

By the time Kerwin realized she had been scammed, it was too late. The cash was lost to a global, anonymized network far beyond the reach of Colorado law enforcement. A detective took on her case, but recovered less than a quarter of her money.

Once a feature of marijuana dispensaries, cryptocurrency ATMs have sprung up across Colorado, says Sgt. Stephen Kimberly at the Denver Police Department’s Fraud Unit. Now, well over 500 operate statewide, many belonging to national operators like Bitcoin Depot, Athena Bitcoin, CoinFlip and Coinsource.

Those companies say that their business is bringing cryptocurrency to those who otherwise might not use it, billing themselves as privacy-forward and inclusion oriented. But regulators and officials across Colorado say there are questions hanging over this business model, and that these machines have become a key player in a burgeoning global industry: scams.

An analysis by The Colorado Sun adds depth to this picture. National cryptocurrency ATM operators view older and low-income individuals as their target markets, according to their public statements and SEC filings. Multiple studies show these are the communities most vulnerable to scams. Data compiled by The Colorado Sun indicates that, statewide, cryptocurrency ATMs appear to be concentrated in lower-income ZIP codes. Many are in places like gas stations or liquor stores, where there’s little chance someone will intervene to stop a scam in action.

In recent years, Colorado has emerged as a crypto-friendly jurisdiction, with Gov. Jared Polis describing the underlying technology as a “critical part” of the state’s “innovation ecosystem.”

But this legislative session, Colorado State Sen. Janice Rich introduced Senate Bill 79, which aims to protect Colorado consumers from scams facilitated by cryptocurrency ATMs by establishing transaction limits for first-time users and requiring operators to refund certain fraudulent transactions. That bill is on Polis’s desk after passing both chambers of the legislature with an overwhelming majority in late April. (The bill was sent to Polis on May 2 and he had 30 days to sign or veto the measure. If he does not take action, the bill becomes law.)

Rich, a Republican from Grand Junction, said she chose to introduce the bill after hearing stories like Kerwin’s from her constituents, some of whom have lost tens or even hundreds of thousands of dollars from scams. One woman, she said, lost $400,000 to a scam facilitated by a cryptocurrency ATM.

“She was so distraught, she prayed all night long that God would just take her before she had to tell her family what had happened,” Rich said.

Kerwin, who testified before the Colorado legislature this spring on her experience, said the bill is a good first step — but more is needed.

“Many people, especially the aged and the young, don’t realize how widespread criminal activity is and there really needs to be more education. That law is only the beginning.”

A growing industry

In 2023, U.S. consumers reported losing over $10 billion to fraud. Of this, over $110 million was lost to scams facilitated through cryptocurrency ATMs, according to the Federal Trade Commission— a tenfold increase since 2020. That number is rising, with consumers reporting $65 million lost to scams via cryptocurrency ATMs in the first half of 2024.

Colorado does not keep statewide numbers on the amount residents lose each year to scams. But experts and law enforcement across the state say the number is growing — a lot.

“In my networks, my professional associations that are related to scams and financial crimes, we all talk about that on a regular basis,” said Kristi Knowles, a Grand Junction Police Department investigator.  “We talk about how many more calls we’re getting for these types of scams.”

Kimberly estimates that the Denver Police Department fields multiple reports of scams facilitated by cryptocurrency ATMs every week. He and others point at several factors driving the spiking numbers.

One of these is the evolution — and expansion — of the global scam industry. Colorado Securities Commissioner Tung Chan noted the worldwide proliferation of scam compounds, or “corporation-like shops where individuals are captured, and are working these scams.” (One global scam compound operator was recently found to be registered in Colorado.)

Another is evolving communication patterns and a quickly changing technological ecosystem, Kimberly said, with mobile devices, instant payment systems and an always-on culture allowing scammers to access targets instantly, and hook them before they have time to think.

Cryptocurrency ATMs are one element of this new technological ecosystem. They offer instant, global, peer-to-peer transactions, often requiring little in the way of identification from their users. They have been found to facilitate twice as much illicit activity as normal cryptocurrency exchanges — something that Chan and other regulators have started to notice.

“There are legitimate uses for (cryptocurrency) ATMs as well,” Chan said. “But I’m just saying that we see a lot, in the lifecycle of a securities scam, the (cryptocurrency ATM) is a player.”

“Bringing Bitcoin to the Masses”

Bitcoin Depot’s Brandon Mintz launched the company in 2016, the year he graduated from the University of Georgia — not unlike Daniel Polotsky and Ben Weiss, who cofounded CoinFlip, Bitcoin Depot’s closest competitor, in 2015 while undergraduates at Vanderbilt University and Northwestern University.

Now Bitcoin Depot operates over 8,000 cryptocurrency ATMs worldwide, including nearly 400 in Colorado. It charges up to 25% per transaction, and hit over half a billion in revenue last year. Its mission, displayed prominently on its website, is “Bringing Bitcoin to the Masses.”

In a 2023 investor presentation archived by the SEC, the company explained who those masses were — people with an income of under $80,000 a year, which, it said, represented 82% of its user base in 2022. 

Polotsky, the CEO of CoinFlip, which operates over 5,000 cryptocurrency ATMs, strikes a similar note. In a 2020 blog post, he described a “significant portion” of his company’s market as being “underbanked and low-income communities” who struggle to access financial services.

Athena Bitcoin, another top operator, uses almost identical language, touting its services as “fostering financial inclusion” and “banking for the unbanked.” (Athena Bitcoin rose to prominence in 2021 when it announced it would invest $1 million to install cryptocurrency ATMs in El Salvador under President Nayib Bukele’s pro-cryptocurrency policies.)

Meanwhile Coinsource, a close competitor, targets a slightly different demographic. The mainstay of their market is “the baby boomer that’s 55 or older” CEO Sheffield Clark said in an interview with Forbes.

Several experts raised questions about this business model in interviews with The Colorado Sun. Multiple studies have shown that elderly and unbanked Americans are more vulnerable to fraud. Yet cryptocurrency ATMs generally offer far less protection than other money transfer businesses, like Western Union. 

“You’re dealing with, on the one hand, a less financially sophisticated group of people,” said Ross Delston, an attorney and anti-money laundering expert.  “And on the other hand, a group that has been disadvantaged economically, and wants to catch up, and therefore may use the purchase of cryptocurrency as a way of investing.”

Chan said that the marketing practices of cryptocurrency ATM operators, and their efforts to focus on offering their anonymous, little-regulated services to vulnerable communities, made her “uncomfortable.”

“It sounds to me like what they are saying is, if you’re poor, you should get less protection. I don’t understand it.”

In a written comment to The Colorado Sun, a spokesperson for Bitcoin Depot said the company’s kiosks were “placed based on foot traffic and consumer demand. Many are located in convenience stores and gas stations, which serve a broad range of customers.”

“In areas with fewer traditional banking options, our ATMs can offer a practical way to access digital currency,” they said. “Bitcoin Depot does not profit from scams and routinely partners with law enforcement to provide refunds to scam victims. Like many financial services, our platform can be misused by bad actors.”

CoinFlip, Coinsource and Athena Bitcoin did not respond to a request for comment.

Anatomy of a scam

In Colorado, cryptocurrency ATMs are concentrated in lower-income neighborhoods, according to data compiled by The Colorado Sun comparing the location of cryptocurrency ATMs to the state’s median income by ZIP code. Many of the machines are in gas stations, vape shops and liquor stores.

The highest concentration of cryptocurrency ATMs in Colorado is in the Havana Street corridor of Aurora, Colorado’s third-largest city. The population of this ZIP code, 80012, is 28% foreign-born and had a median household income of $69,835 in 2023, compared with the statewide median of $92,460. Map data indicates there are at least 10 cryptocurrency ATMs in the ZIP code. 

A reporter visited several of these ATMs in April, two in gas stations and two in liquor stores, interspersed through strip malls with minimarkets, travel agencies and mobile phone stores offering rapid remittances abroad. None of the staff of these stores agreed to be interviewed about the cryptocurrency ATMs in their stores. Several said they knew almost nothing about them.

This anonymity is by design — and part of the problem. Cryptocurrency ATMs enter the cycle of a scam towards the end, after a victim has already been persuaded to withdraw their money from their bank. Oftentimes, a scammer will then guide a victim, like Kerwin, to a cryptocurrency ATM to deposit it to the scammer’s wallet.

As it stands in the U.S., this can be done almost entirely anonymously, and with no one on hand to stop the scam in progress. Cryptocurrency ATMs are regulated as money service businesses, or MSBs, the same category as Western Union and remittance apps — a category with far less stringent oversight than banks. 

Nationwide, MSBs are required to identify their users, Delston said, but “the owners of some (cryptocurrency ATMs), some exchanges don’t take these rules very seriously.” 

MSBs are also required to set up and maintain anti-money laundering programs — in fact, a failure to do so cost Western Union over half a billion dollars in 2017, Delston said.

But cryptocurrency ATM operators “fly close to the terrain,” Delston said. “They tend to be small-time. No one’s that interested in investigating and prosecuting them.”

These lax identity requirements make it far harder to investigate a crypto scam — or find the scammer. So too does the fact that the machines do not give receipts, said Commissioner Chan, forcing the Division of Securities to rely on circumstantial evidence for a transaction when building a case.

They also mean fewer people around to stop a scam. “The cryptocurrency (ATMs) are in convenience stores. They’re in supermarkets, in the corner where nobody’s paying attention,” said Knowles, the Grand Junction investigator.

“When you go to a cryptocurrency machine, there’s not a teller there. There’s nobody there to go, ‘Wait a minute. Wait a minute, Martha, where are you sending that money and what’s it for? Why are you sending it to somebody, especially $80,000?’”

An “explosion of fraud”

Sen. Rich sponsored Senate Bill 79 this session, she said, after law enforcement in Mesa County contacted her and Rep. Rick Taggart, also a Republican, about the growing problem of scams. She did some digging and realized that there are few federal regulations on cryptocurrency ATMs, and no transaction limits.

“We needed to add some protections and a way for law enforcement to assist these people in maybe getting their money back,” she said.  

“It’s a terrible thing when a law enforcement officer has to tell someone that may have just lost their life savings, or even $10,000, ‘There’s nothing we can do for you.’ So this bill came into play.” 

As amended after passing the Colorado House and Senate, Senate Bill 79 would introduce a $2,000 transaction limit for first-time users of cryptocurrency, which would curtail the losses of victims like Kerwin. It also requires cryptocurrency ATMs to provide receipts, and to fully refund first-time transactions if they are found to be fraudulent and the money has been transferred outside of the U.S.

“The status of the bill looks pretty good right now,” said Mark Fetterhoff, a senior advisor at AARP in Denver, which has been a strong supporter of the law. The AARP is working on similar legislation with a number of other states, he said, supporting laws that would fill the gap in federal regulation on cryptocurrency ATMs.

Fetterhoff said he is hopeful that the bill will see “common sense protections put in place to help people who have been victimized by these ruthless criminals.”

Without state-level regulation, help appears unlikely to come from elsewhere. Rich said the cryptocurrency ATM operators did not appear to view scams facilitated by their machines as a significant problem.

“They kind of acted like they cared, but when law enforcement pushed back on them, they were not, according to law enforcement, really cooperating,” she said. One investigator in Mesa County subpoenaed an operator for information — and didn’t get a response for eight months.

“Nothing should take that long when you have a subpoena,” Rich said.

Delston said that the current political climate — with the Trump administration’s recent pullback on consumer protection, as well as its dismantling of the Justice Department’s National Cryptocurrency Enforcement Team — signals to him that the federal government is also unlikely to step in, even as scam numbers keep rising. 

“I’m predicting an explosion of fraud by the end of this administration,” he said. “Not just cryptocurrency. … Every type of fraud is going to be on the rise. If the regulators and law enforcement are announcing that they’re not interested in protecting the public, then that’s going to be seen as an invitation by criminals, not just in the U.S., but everywhere in the world.”