How Do Scammers Use Fake QR Codes Placed Over Legitimate Crypto ATM Machines?
A crypto ATM looks straightforward: insert cash, scan a code, watch the balance update in a wallet. That simplicity is exactly what makes a tampered code so effective, since nothing about the machine itself needs to be altered.
The short answer
A scammer can print a QR code linked to their own wallet address and stick it directly over the machine’s legitimate scanning panel or receipt display. Someone using the machine scans what looks like the correct code, deposits cash, and the funds go straight to the scammer instead of their own wallet — with no way to reverse the transaction once it confirms. Physically inspecting the scan area for anything raised, peeling, or misaligned before using the machine is the main defense.
Why this tactic is so simple and so effective
Unlike more elaborate scams, this one requires no hacking, no software, and no interaction with the machine’s operator at all. A scammer only needs a printed sticker sized to match the scanning area and a few minutes of unsupervised access to the machine, often in a location with light foot traffic or minimal camera coverage. Because the machine itself is functioning normally, there’s nothing wrong with the transaction from a technical standpoint — the deposit genuinely lands somewhere, just not where the user intended.
What makes crypto transactions particularly vulnerable to this
Once a transaction is broadcast and confirmed on the network, it cannot be reversed by the network itself the way a bank can sometimes claw back a fraudulent transfer. There’s no customer service line that can intercept funds mid-transit once confirmation happens, which is part of why irreversibility is one of the risks worth taking seriously with any crypto transaction, not just ATM deposits.
How to inspect a machine before using it
- Look for anything raised or overlapping. A sticker placed over a printed or digital code often has a slightly different texture, edge, or alignment compared to the surrounding surface.
- Compare against a known photo if one exists. Some operators publish images of their machines online, which makes an added element easier to spot.
- Try gently checking the edges of any printed code. A genuine label is usually flush and part of the machine’s original design; an added sticker often isn’t.
- Watch for codes that appear on unusual surfaces. A code taped near, but not on, the scanner panel is a common variation of this tactic.
- Report anything suspicious to the machine’s operator. Most machines display an operator name and support contact that can confirm what the legitimate scan process should look like.
Why cash deposits make this worse than card-based scams
A card transaction routed to the wrong place at least leaves an account number and a paper trail a bank can investigate. A cash deposit converted directly into crypto at a machine leaves no such intermediary — once the funds are deposited and the transaction confirms on the blockchain, there is no institution positioned to intervene, and no FDIC or SIPC coverage applies to crypto assets in the first place.
The takeaway
A crypto ATM’s scanning surface is the entire security boundary of the transaction, which is exactly why it’s the part scammers target. A few seconds spent looking closely at that surface before scanning anything is a small habit that directly addresses the specific way this scam operates.