Crypto ATM scams and refunds in Illinois

The refund right Illinois gives you

Most states offer crypto kiosk victims nothing beyond a police report and an operator's discretion. Illinois wrote a remedy into statute.

Under the Digital Asset Kiosk Act (SB 2319), signed 18 August 2025 with consumer protection duties taking immediate effect, a kiosk operator must issue refunds for fraudulent transactions at the request of a customer who was new to that operator, within the new-customer period.

How to claim, step by step

Do these in order. The sequence matters, because the operator's obligation is triggered by your notification and completed by the police report.

1. Stop all contact with the scammer

End the call. Block the number and any messaging accounts. Do not tell them you have realised, do not argue, and do not attempt to negotiate a return. Anyone still in contact will attempt a second extraction — commonly by offering to "help recover" the money.

2. Contact the kiosk operator within 30 days

Identify the operator from the machine housing or your receipt. Contact them in writing as well as by phone, so you have a dated record. Ask specifically for the consumer protection officer — Illinois requires every registrant to designate one.

Include:

• The date, time and exact location of each transaction.
• The amount of each transaction.
• The destination wallet address if you have it.
• A short factual account of how you were defrauded.
• A statement that you are making a claim under the Illinois Digital Asset Kiosk Act.

3. File a police report

Report to your local police department — the municipality where the machine is located, or where you live. Ask for a copy of the report itself, not just a case number, because the statute requires the operator to receive the report.

Illinois police departments handle these routinely now. You will not be the first person that week.

4. Give the police report to the operator within 60 days

Send it in writing, referencing your original notification. Keep proof of delivery. This is the step that completes the statutory requirement.

5. File with the FBI's IC3

Report at ic3.gov, the Internet Crime Complaint Center. This does not directly recover funds, but it feeds the tracing work that occasionally does, and it is how patterns across operators and states get identified. The Illinois figures quoted throughout this site come from this reporting.

6. Notify your bank and the Illinois Attorney General

If cash was withdrawn from a bank account, tell the bank — they may have their own fraud process and will want the report. Consumer complaints can also be filed with the Office of the Illinois Attorney General, which has been publicly active on crypto fraud.

Kiosk operator non-compliance — refusing to engage, or charging above the statutory cap — can be reported to the Illinois Department of Financial and Professional Regulation, which maintains the operator register and holds enforcement authority.

The scripts being used in Illinois

Kiosk fraud is not technical. It is social, and it follows a small number of scripts that vary only in the opening line.

The bank fraud department. A caller says your account has been compromised and funds must be moved to a "secure federal wallet" while the investigation runs. They are procedural, calm and patient. No bank has ever done this.

The government agency. The Social Security Administration, Medicare, the IRS, a sheriff's office, a court clerk, an immigration authority. Sometimes with startling procedural detail, sometimes with a threat of arrest. No agency in the United States accepts payment via crypto kiosk.

The family emergency. A grandchild, child or sibling has been arrested, hospitalised or detained. Money is needed immediately. You are asked not to tell anyone. Hang up and call that person on a number you already had.

The utility. ComEd, Nicor or a water provider threatening immediate disconnection unless payment is made now. No Illinois utility accepts crypto.

The romance or investment approach. Longer, warmer, and usually larger. Weeks or months of rapport, then a trading platform showing extraordinary returns. Withdrawal hits a fee, then a tax, then a compliance hold. There is no money behind the interface.

The Illinois numbers

The FBI's Internet Crime Complaint Center publishes state-level data on cryptocurrency kiosk complaints. The 2025 figures put Illinois sixth in the country on both measures.

More than half of national complaints came from people aged fifty and over, accounting for over $302 million of the total. That age skew is the single most consistent feature of the data, and it is why our city guides for older suburbs — Arlington Heights, Oak Lawn, Skokie — carry this warning prominently.

Bear in mind that these are reported figures for kiosks only. Investment fraud, romance scams and fake exchange platforms routed through crypto run considerably larger, and under-reporting is severe because victims are frequently embarrassed.

Beware the second scam

This deserves its own section because it catches people who have already been through the worst of it.

After a loss, you may be contacted by a "crypto recovery service" offering to trace and retrieve your funds. They will have plausible-sounding technical language, sometimes a professional website, sometimes a claim of law enforcement affiliation. They will require an advance fee, or a series of them.

The Office of the Illinois Attorney General has issued specific warnings about these services. They are a second fraud, deliberately targeting people made vulnerable by the first one. In many cases the operators are the same people.

The honest position: blockchain transactions are final. Once crypto has left a wallet it cannot be reversed by anyone. Recovery, where it happens at all, comes through law enforcement seizure of exchange accounts at the other end — a slow, low-probability process, and never one you pay a stranger for.

Preventing it happening again

Five habits, and they cover almost everything.

1. Never transact at a kiosk while anyone is on the phone with you. Not a bank, not the police, not a relative, not anyone. This one rule prevents most of the losses in the data above.
2. Never scan a wallet QR code you did not generate yourself. Whether it arrived by text, email, or printed on paper.
3. Verify by calling back on a number you looked up independently. Not the number in the message, not the number the caller gives you.
4. Treat urgency as the warning sign. Every one of these scripts depends on preventing you from pausing. Nothing legitimate requires a decision in the next ten minutes.
5. Use a licensed exchange instead. It costs a fraction as much, produces a complete transaction history, and cannot be operated by someone reading instructions to you over the phone.

Talk to older relatives about this specifically. The single most effective intervention in the data is someone else in the household knowing the scripts. Our Illinois scam guide covers the wider catalogue including investment and romance fraud.

This page describes a statute and a claims process. It is not legal advice. If a significant sum is involved, speak to an Illinois attorney — and do so within the 30-day window, not after it.