North Carolina is preparing to impose transaction limits, mandatory cooling-off periods and conditional refunds on cryptocurrency kiosks after a Johnston County woman said scammers impersonating law enforcement persuaded her to put her savings into a machine at a gas station. The state’s attorney general has also confirmed an investigation into companies operating the devices.
The rules, signed into law in July and due to take effect on January 1, 2027, arrive against a sharp rise in reported U.S. fraud involving crypto ATMs. The FBI recorded 13,460 complaints associated with the machines in 2025, with nearly $389 million in adjusted reported losses. North Carolina accounted for 491 complaints and about $12.62 million of that total.
The law’s precise design matters. New kiosk customers will be limited to $2,000 in daily transactions, existing customers to $5,000, and people in their first seven days of use will face a separate 48-hour hold on each transaction. Full refunds will be available only in specified fraud cases involving new customers who report promptly and receive a determination from the state banking commissioner. The measures are prospective, not a retroactive guarantee for people already defrauded.
How Did a Fake Police Call Drain a North Carolina Woman’s Savings?
A woman in Johnston County told WRAL in its October 19 investigation that callers pretending to be local law enforcement created a false legal emergency and instructed her to deposit cash through a cryptocurrency kiosk. The station described the operation as a jury-duty-related impersonation scam in which she believed the payment would prevent detention or obtain her safe release.
She deposited what she described as her savings before the callers demanded another $4,000. When she said no money remained, the conversation ended. She later told the broadcaster the experience had affected both her finances and mental wellbeing. WRAL withheld her name at her request and did not independently publish a verified dollar total for all the money she deposited.
The mechanism is a familiar form of authority impersonation, not a conventional investment decision. Fraudsters invent a threat, discourage the victim from checking with the real agency, identify a nearby machine and direct the victim through a cash-to-crypto transfer. A QR code can load an attacker-controlled wallet destination without the customer needing to understand blockchain addresses.
A kiosk itself does not establish that the person receiving the cryptocurrency is a police officer, court or other lawful payee. Once the transaction settles on the blockchain, it cannot simply be reversed by reversing a card payment. Recovering the money generally requires tracing and legal cooperation rather than a routine chargeback.
North Carolina Attorney General Jeff Jackson told WRAL that his department is investigating cryptocurrency kiosk companies. A follow-up report on October 24 clarified that this is an investigation by the North Carolina Department of Justice, not a separately announced federal Justice Department prosecution. Jackson has expressed the view that kiosks facilitate extensive fraud; no enforcement finding or company-specific violation was identified in that public statement.
What Does the FBI’s $389 Million Crypto Kiosk Figure Measure?
The FBI’s 2025 cryptocurrency kiosk data release counted precisely 13,460 complaints and $388,981,267 in adjusted reported losses. Complaints rose 23% from 2024 and losses increased 58%, indicating that reported financial harm grew faster than the number of complaints.
The bureau reported that more than half of complaints involved people over 50, associated with more than $302 million in losses. These figures should not be described as proof that elderly users account for every incident or that all kiosk transactions are fraudulent.
| FBI 2025 measure | Reported figure |
|---|---|
| U.S. kiosk-related complaints | 13,460 |
| U.S. reported losses | $388.98 million |
| North Carolina complaints | 491 |
| North Carolina reported losses | $12.62 million |
| National complaint growth | 23% year over year |
| National loss growth | 58% year over year |
There is an important methodological limit: the FBI includes fraud complaints in which a kiosk was used, even when the broader scam involved other transaction methods. The entire $388.98 million cannot necessarily be attributed solely to cash physically deposited into machines. The figures also reflect reported complaints, not every fraud in the country.
The trend predates 2025. The FBI’s 2023 cryptocurrency fraud report recorded more than 5,500 kiosk-related complaints and over $189 million in losses that year. The Federal Trade Commission separately estimated that Bitcoin ATM-related fraud losses increased nearly tenfold between 2020 and 2023.
In its September 2024 analysis, the FTC placed the median reported loss for the first half of 2024 at $10,000 and found that people aged 60 or older were more than three times as likely as younger adults to report a loss involving a Bitcoin ATM. Those are older FTC observations, not new 2025 FBI median-loss statistics.
What Will North Carolina’s Crypto ATM Law Change in 2027?
Governor Josh Stein signed House Bill 920, enacted as Session Law 2026-45, on July 7. The final statutory text establishes a separate oversight framework for virtual-currency kiosks under North Carolina’s money-transmitter rules. Most requirements become effective January 1, 2027; the authority to prepare implementation procedures took effect when the law was signed.
The law defines a new customer as someone making a first transaction or whose first transaction with the operator occurred within the preceding 30 days. That group is subject to a $2,000 daily transaction ceiling. Customers beyond that initial 30-day period are treated as existing customers and face a $5,000 daily ceiling.
Some secondary accounts have given the existing-customer figure as $7,500, but that is not the limit in the enacted law. The relevant statutory amount is $5,000. A person who deposits $2,000 on a given day also cannot simply use multiple kiosks operated by the same provider to evade the per-operator daily limit.
Another major safeguard is a mandatory 48-hour delay for each transaction initiated while the customer is within seven days of their first transaction. The kiosk may accept the request and record information but cannot transmit or release the cryptocurrency before the hold ends, even when a customer asks to proceed sooner.
That creates a real pause in the sort of urgent phone-call scenario described by WRAL. The seven-day threshold is separate from the 30-day definition of a new customer: during days eight through 30, the customer remains subject to the lower daily limit but not automatically to the special 48-hour introductory hold.
Other provisions require fraud warnings, identification and records, customer service availability, receipts, cancellation before completion and a documented anti-fraud program. The statute also caps total customer fees, including the operator’s spread, at 12% of the transaction’s dollar-equivalent amount.
Who Can Get a Full Refund Under the New Law?
The refund section makes an essential distinction between new and existing customers. To receive the full amount deposited in a fraudulent kiosk transaction, a person must have been a new customer when the transaction occurred, report the alleged fraud to the North Carolina Commissioner of Banks within 30 days and receive the commissioner’s determination that the transaction was fraudulent.
Existing customers who meet the same reporting and fraud-determination conditions are entitled to reimbursement of operator-imposed fees, rather than automatic repayment of the entire principal. That difference may surprise people who read that North Carolina now requires crypto ATM refunds without examining the conditions.
The 30-day period for reporting suspected fraud begins from the transaction date. It should not be confused with the separate first-30-days period determining customer status, or the first-seven-days period triggering the transaction hold. All three clocks serve different functions.
Customers can also cancel an in-progress transaction for a full and immediate refund, provided the transaction has not yet been completed. Once a cryptocurrency transfer is complete, this cancellation provision does not grant an unlimited right to reverse it.
The broader effect is to shift part of the cost of qualifying fraud onto kiosk operators, creating a financial incentive for better screening and intervention. Whether that changes scam rates depends on operators’ ability to detect coercion, keep usable records and respond before assets are transmitted.
The law does not promise that the Johnston County victim’s earlier loss will be covered. The main operative protections apply prospectively beginning in January 2027, and the publicly reported facts do not establish that her transaction would meet the future refund criteria.
Will Transaction Holds Reduce Fraud or Burden Legitimate Customers?
The 48-hour delay is an attempt to break the connection between an urgent fraudulent instruction and an irreversible cryptocurrency payment. A victim who cannot transfer coins immediately has time to speak with family, contact the supposed law-enforcement agency independently or reconsider a story that depends on secrecy and pressure.
The measure is not foolproof. Criminals may keep contacting victims during the hold, recruit existing kiosk customers or persuade people to make multiple transactions over successive days. A $2,000 daily cap limits the potential size of a single day’s losses but does not remove the need for fraud detection.
Operators also face costs from reviewing alerts, holding funds and processing eligible refunds. In responses to WRAL, Byte Federal and CoinFlip said they already use several consumer protections. Byte Federal described additional work on fraud screens and the mandatory 48-hour delay before the new rules take effect. Their statements explain industry preparation but do not establish that every machine currently meets the future law.
There is also a legitimate-use trade-off. Some customers use kiosks to buy or transfer digital assets with physical cash, and a two-day delay may reduce the appeal for a lawful transaction. North Carolina’s own banking regulator recognizes legitimate kiosk transactions while warning people not to use them at a stranger’s direction.
Federal efforts to fight overseas crypto scams offer a broader comparison. DaveFinances recently examined U.S. enforcement against online cryptocurrency fraud, including why blocking scam infrastructure and recovering funds are not the same outcome. Kiosk transaction controls seek to act earlier, before victims have sent cash into a criminal-controlled wallet.
How Can Consumers Protect Themselves Before January 1?
The clearest warning sign is a demand from someone claiming government or law-enforcement authority to pay through a cryptocurrency machine. The FBI has long warned about officials being impersonated by phone and advises consumers to independently verify unexpected demands rather than follow the caller’s instructions.
Anyone receiving such a call should end the conversation and use a publicly listed number to contact the agency directly. They should not scan a QR code sent by a stranger, follow instructions to keep a transfer secret or accept a claimed emergency as a reason to skip verification.
The risk also extends to fake investment recommendations and websites. DaveFinances’ guide to identifying crypto scams addresses warning signs associated with wallet interactions and false investment platforms. The kiosk version uses a different payment interface but relies on similar pressures to act before checking the recipient.
If funds have already been sent, the FBI recommends retaining receipts, transaction identifiers, destination wallet addresses, telephone numbers and kiosk-location details, and filing a report at IC3.gov as well as with local police. The FTC accepts consumer fraud reports at ReportFraud.ftc.gov, while North Carolina’s attorney general offers its own consumer complaint channel.
Victims should also be cautious of anyone who subsequently promises to recover lost cryptocurrency for an upfront payment. Independent on-chain investigations can sometimes identify movements of stolen funds, but the complexity of international recovery has been illustrated by separate research into cryptocurrency laundering networks. The existence of a transaction trail does not establish that a private recovery company can reverse it.
The financial test for North Carolina’s new framework will arrive after January 1: whether the first-week holds stop the most coercive scams, whether the refund process produces practical relief and whether operators detect repeated or suspicious deposits while preserving lawful customer access. For now, the Johnston County woman’s story and the FBI’s nearly $389 million in reported national losses show why the interval between taking cash and sending cryptocurrency has become a focus of state consumer-protection policy.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574