Scammers convert crypto ATMs into personal wallets, stealing tens of thousands in Raleigh

It took a 36-year-old woman 30 minutes to feed $15,000 in $20, $50 and $100 bills spilling from her purse into a bitcoin ATM tucked in the corner of a Shell convenience store on Tryon Road.

After withdrawing more money from a Raleigh branch of the Navy Federal Credit Union, she returned, stuffing $9,100 more into the same machine.

She did it after people claiming to work for the credit union and the U.S. government told her someone had hacked her Facebook account, gained access to her financial information and was trying to buy child pornography with her money. That put her and her husband at high risk of arrest, they warned.

When she finished feeding cash into the ATM, at first she felt relieved that she had saved her husband and herself from the shame of federal agents wrongly handcuffing them in front of their kid and neighbors. But while driving home to Guilford County, her suspicions grew.

She texted the person who over hours walked her through how to deposit her money – which was supposed to cancel out the pornography payment and prove they weren’t involved. She begged for evidence that he wasn’t a fraud.

“Wow I believe you took everything I have. Our whole life.” she wrote when no response came. “Please just give me some of it back.”

As cryptocurrency ATMs become more common in Raleigh and everywhere else, scammers use them more often to steal money.

“It’s a growing problem, and the loss is staggering,” said FBI Special Agent James Kaylor, who supervises white collar crimes investigations in the Raleigh area.

In Raleigh, police have seized money 31 times from local crypto ATMs since September 2023 alone while investigating such thefts. The department holds $285,389 in cash seized from the ATMs in evidence, according to court documents.

And there’s more drama. Very recently, a Raleigh prosecutor was in court trying to resist demands from ATM operators that they return money to them, not scam victims. At least one operator is expected to get its money back.

Protection is the best prevention. Read News & Observer reporting on how to avoid cryptocurrency scams here .

Police warrants detail local scams

Nine search warrants from Raleigh police investigations reviewed by The News & Observer show that crypto-ATM spoofer scams target people of all ages. Victims in the investigations ranged in age from 26 to 85.

Scammers connect with their prey in many different ways, the records show.

Some victims were willing to detail what happened on the condition that their names not be published due to their embarrassment of getting tricked. The N&O agreed to do so after confirming their stories in court documents.

The Guilford County woman who lost $25,000 called in May a phone number she found on the internet while looking for help after getting locked out of her Facebook account. The scammers were smooth, she said, as they gained access to her phone and obtained private bank account details they used to convince her they were authentic.

They even recreated the welcoming message of Navy Federal Credit Union, which she heard over when scammers connected her to the bank.

“It’s a very sophisticated network where these folks have playbooks,” said Kaylor, the FBI agent.

In two cases described in Raleigh police warrants, people posing as Wake Sheriff’s Office employees alerted strangers that they faced arrest for missing jury duty. One scammer, claiming he was a Wake deputy, told a 72-year-old he could either pay $2,900 or spend 48 hours in jail, according to court documents.

In another case, a woman thought she was calling Netflix after an alert popped up on her television. Fraudsters claiming to be from the Federal Trade Commission convinced her that she needed to move her money from her bank to keep it safe after her account had been hacked, according to court documents.

People are also taken in by romance scams and ruses where people say that a relative is in jail, even sometimes using AI to imitate family members’ voices crying for help, law enforcement officials said.

Not your typical ATM

For decades, scammers, sometimes working in call centers in other countries, have used ploys to steal people’s money, convincing them to part with their cash through the mail, bank transfers or gift-card purchases

Crypto ATMs — operated by companies such as Coinhub and Bitcoin Depot — are some of their latest tools. They are spots where people can legitimately convert U.S. dollars into bitcoin and other virtual assets , which get stored in legal electronic “wallets.”

But unlike regulated financial institutions, such as banks and credit card companies, the accounts are not insured by the FDIC.

Scammers often falsely promise that those wallets are safe havens for people’s money during the fake crises they spin up.

But people soon discover they have no access to the wallets. And the fake helper who had coached them on how to make the deposits swiftly disappear, often without leaving a trail police can follow.

Once converted and deposited during the scams, the currency is moved from wallet to wallet through exchanges, or digital brokers. Sometimes it gets lost amid exchange platforms based in countries that don’t cooperate with U.S. criminal investigations, Kaylor said.

“At that point, it’s a black hole,” Kaylor said.

‘It’s so out of character for me’

A 26-year-old Wake County resident’s journey into that darkness occurred in April after she answered her phone on a day she was expecting legitimate calls.

A person on the other end convinced her that U.S. custom agents found a package with drugs addressed to her home. Using a pirated Raleigh Police Department phone number, a series of individuals convinced her they were legit.

They claimed her identity was stolen and there was a warrant for her arrest. But she could safeguard her money and prove she wasn’t responsible by depositing money in a government bitcoin account, they promised.

Don’t hang up or tell anyone about the warrant, they warned her. If she did, they would be obliged to turn her in immediately.

The woman, a young mother who isn’t familiar with the criminal justice system, immediately worried about what would happen to her family if she faced drug charges.

She wrote her husband a brief note before she dashed off to make three trips to her bank and deposit more than $30,000 into a bitcoin machine at Tobacco and Gifts shop off Avent Ferry Road in Raleigh.

A scammer stayed on the phone as she traveled from spot to spot, advising her how to navigate withdrawing money by not looking suspicious, even telling her to hide her phone but to stay connected.

When she returned home, the spell broke. When she searched the internet and found descriptions of scams imitating U.S. marshals, she was devastated.

The woman knew not to give money to random people, she said, but the callers had convinced her that they were from the government, acknowledging now how ridiculous that might sound.

“If you told anybody that I know that this has happened, like, they would just be blown away. It’s so out of character for me to fall for something like this,” she said.

Tough-to-crack crimes

Raleigh police haven’t had any success finding or arresting these scammers, said Senior Raleigh Detective Christopher Gay. But they have landed search warrants and seized cash deposited by people who alert them after being ripped off. The money is evidence from the police’s point of view.

But ATM operators see it differently.

Wake County Judge Graham Shirley recently heard arguments involving four 2023 complaints where police obtained warrants and confiscated $38,000 from at least four crypto ATMs, but the judge’s decision will give direction on how the additional cases will be handled.

Prosecutors say the money is evidence that should be returned to the victims.

In a decision Friday, Shirley ordered Raleigh police to return $12,700 to Bitcoin Depot. The company — not the woman scammed into exchanging dollars for crypto — was its lawful owner when police seized it, the judge wrote.

“The Currency was not stolen by Bitcoin Depot but was exchanged in an arm’s length transaction between the Victim and Bitcoin Depot for the purchase of the Cryptocurrency,” Shirley wrote, adding that the law doesn’t authorize using Bitcoin Depot’s cash for restitution.

In their court filings, Bitcoin Depot, Bitstop and Express BTM stressed that they were not involved in the scams. And that the deposited money, used to purchase cryptocurrency, is rightfully theirs. They noted that they aggressively warn people about scams.

Officials from LSGT, also known as Coinhub ATM, pointed out that before an 85-year old deposited $10,000 into a bitcoin machine in a Cary Cool Mart convenience store, she ignored warnings spelled out in capital letters across the unit’s screen.

“BE CAREFUL OF SCAMS” and “”ONLY SEND BITCOIN TO YOUR OWN WALLET THAT ONLY YOU CONTROL, ALL SALES ARE FINAL, BITCOIN TRANSACTIONS ARE IRREVERSIBLE,” it warns.

The woman acknowledged the scam disclaimer by pressing a green OK button on the screen to continue, the court filings note. She then fed the orange and black machine five deposits of about $2,000 using five different phone numbers as instructed, which allowed her to avoid providing social security and government identification.

Her ordeal started after an alert appeared on her iPad screen that read: “access to this PC has been blocked” and she needed to call Apple support, the documents say. When she called a fake number from the fake alert, she was told that a hacker was watching child pornography on her iPad and stole $30,000 from her account.

”But he could help her reclaim her money if she listened to him,” the scammer told her, according to court documents.

“Coinhub has no way to know that the customer was a potential target of a scam,” their attorneys argued in court documents.

But such warnings have not stopped multiple people from being taken advantage of at the ATMs, Wake County district attorney Freeman stressed.

Prosecutors liken the situation to pawn shops, whose owners assume certain risks in their business model and are out the money if it turns out items were stolen, she said.

Other states are more aggressive than North Carolina are when it comes to forcing these ATM operators to take more responsibility, Freeman notes. She pointed to New York and California, which have set up licensing regimes and require companies operating the ATMs to be insured for money lost when customers were fraud victims.

It would be very helpful if state legislators would clarify the laws to clearly say companies need to be licensed by the North Carolina banking commission. And to require them to pay for insurance to protect their losses when innocent people get tricked, she said.

News & Observer reporter William Tong contributed to this reporting.

Virginia Bridges covers criminal justice in the Triangle and across North Carolina for The News & Observer. Her work is produced with financial support from the nonprofit The Just Trust. The N&O maintains full editorial control of its journalism

EDITOR’S NOTE: This story was updated to include a new court ruling in favor of crypto ATM operator Bitcoin Depot.