WARNINGConsumer alert, published October 21, 2026
California Attorney General Rob Bonta told Californians on October 19, 2026, to never use a cryptocurrency ATM. In a press release from his office, datelined San Francisco, he said Americans lost $11.4 billion to crypto scams in 2025. He warned that the targets include older adults and young people online.
What is happening
The Attorney General’s October 19, 2026 release says Americans lost $20.9 billion to internet-based scams in 2025. Of that, $11.4 billion came from cryptocurrency scams.
Bonta’s advice is short. Stay informed. Never use a cryptocurrency ATM. Report it if you have been scammed. The release puts “Never use Crypto ATMs” at the top of its section on protecting yourself and loved ones. He also announced new resources to help victims try to recover money.
The release says these scams use the same psychological playbook as gift card or cash fraud. The difference is that crypto moves faster and gets around physical safeguards.
Cities are acting too. On September 16, 2026, San Diego’s Rules Committee unanimously endorsed a proposed ordinance requiring scam warning signs on crypto ATMs. That is according to Hoodline, citing the San Diego Union-Tribune and the city, and the Times of San Diego on September 17, 2026. The draft would make businesses that host the machines share responsibility with operators. It would also require QR codes pointing to scam reporting resources. We did not find an official city page with the ordinance text or vote record.
CBS 8 reports that other states, including Indiana and Tennessee, have banned crypto ATMs.
What the warning covers
Bonta’s release says fraudsters are not only targeting elders. He cites a sharp rise in reports of Gen Z being targeted on Twitch, TikTok and Instagram. He says criminal syndicates are using generative AI, deepfakes and malicious smart contracts. The scams reach people while they browse, game, stream, scroll or chat online. The release also lists sextortion, which means threats to share private images.
An earlier 2026 alert from the Attorney General’s office, whose exact date we did not capture, describes investment scams that start with ads and deepfakes on Meta platforms. Victims are then moved to WhatsApp or Telegram. That alert lists any request to use a crypto ATM or send crypto to a private wallet as a red flag.
The state Department of Financial Protection and Innovation (DFPI) explains the kiosk scam on its Crypto ATM Scams page. Its posting date was not listed. DFPI says scammers often stay on the phone with the victim during the deposit. They may send a QR code that routes the purchased crypto straight to the scammer’s wallet.
DFPI also says California’s Digital Financial Assets Law bars kiosk operators from accepting more than $1,000 per person per day. A kiosk that accepts more is breaking the law.
How to spot it
- An unsolicited message about an urgent account problem or a family emergency (DFPI)
- A request to withdraw a large amount of cash and deposit it into a crypto ATM (DFPI)
- Someone who stays on the phone while you make the deposit, or sends you a QR code to scan (DFPI)
- A request to send crypto to a private wallet (Attorney General)
- Threats to share private images unless you pay (Attorney General)
- A link inside an alert asking you to act now. Bonta says to go directly to the source instead.
Bonta’s release also suggests searching a company or salesperson’s name with the word “scam” or “complaint.” It recommends pausing for nine seconds before you click, engage or send money.
Crypto ATM payments are hard to undo
DFPI says crypto ATM transactions cannot be reversed and are often untraceable. Once the cash goes in, assume it cannot be pulled back. If anyone tells you a crypto ATM is the only way to fix a problem, stop.
If you were targeted
- Stop all contact. Hang up, stop replying and do not send more money.
- Call your bank or card issuer using the number on the back of your card if cash came from your accounts or you shared account details.
- Keep every record: kiosk receipts, messages, screenshots, usernames and any wallet details the scammer gave you.
- If you shared your Social Security number or other personal details, consider freezing your credit with the three national credit bureaus and visit IdentityTheft.gov.
- Report the scam using the channels below.
- If you are facing debts or legal questions after a loss, talk to a lawyer or a nonprofit credit counselor.
How to report it
Bonta’s release urges anyone who has been scammed to report it. We did not confirm the reporting channel named in the October 19, 2026 release, so check the Attorney General’s page directly. It also describes the new recovery resources.
In a March 10, 2025 release, Bonta named DFPI’s Crypto Scam Tracker as part of the state’s anti-scam effort. He urged Californians not to send money to anyone they have not met in person.
You can also report to:
- The FTC at ReportFraud.ftc.gov
- The FBI at ic3.gov
- Your state attorney general’s consumer protection office
- Your bank or card issuer, using the number on the back of your card
- IdentityTheft.gov, if your personal information was stolen
For the background, see our crypto scams and regulation guides.
Check, verify or complain
Sources
- California Department of Justice, Office of the Attorney General (oag.ca.gov), press release dated Oct 19, 2026 oag.ca.gov · primary source
- California AG press release (oag.ca.gov) oag.ca.gov · primary source
- California DFPI (dfpi.ca.gov), Crypto ATM Scams page dfpi.ca.gov · primary source
- California AG press release, Mar 10, 2025 oag.ca.gov · primary source
Leah writes US Financer's Consumer Alerts: scam warnings and money rule changes issued by federal agencies, state attorneys general, regulators and courts. Each alert starts from the official notice, says what is confirmed and what is not known yet, and lists the agency's own page…
Ruth is US Financer's standards editor. Every article goes through her checks before and after it is published: each rate, fee, cap, deadline and rule is matched against its primary source, every law named is linked to its official text, and anything that cannot be…
Comments are closed