Site update Florida’s HB 505 kiosk rules land 1 Jan 2027 — what changes for buyers

contact@crypto-miami.com

Fraud watch · Florida ranked #2 nationally

Crypto scams in Miami

Floridians lost roughly $32.7 million at crypto kiosks alone in a single year, and nearly two-thirds of the national total went from people over sixty. These are the actual scripts being used in Miami-Dade, the tell in each one, and exactly where to report if it has already happened.

  • $32.7M lost in Florida
  • 8 playbooks
  • Reporting checklist

Report a loss now

Updated 2 September 2026 9 min read By the Crypto Miami research desk Loss figures taken from the FBI IC3 annual report and Florida legislative findings

The short answer

If another person supplied the wallet address or QR code you are being asked to use, you are being robbed. That single element appears in almost every crypto fraud in this city. The second tell is manufactured urgency. No government agency, bank, utility, police department or technical support desk will ever ask you to deposit cash into a machine or send crypto to resolve anything. If it has already happened, report it today — speed is the only lever you have.

$32.7M

lost by Floridians to crypto kiosk fraud in 2025, across 1,213 complaints

$389M

national crypto kiosk losses in 2025 — up 58% year on year

$257.4M

of those losses suffered by victims aged 60 and over

$11.4B

total US crypto-related fraud losses reported to the FBI in 2025

The numbers, plainly

It is worth setting out the scale before the tactics, because people consistently underestimate this and the underestimate is what makes them vulnerable.

In 2025 the FBI's Internet Crime Complaint Center recorded $11.4 billion in crypto-related fraud losses across the United States. Of that, crypto ATMs and kiosks specifically accounted for 13,460 complaints and $389 million — a 58% increase in losses and a 23% increase in complaints in a single year. Florida came second nationally for kiosk fraud with roughly $32.7 million across 1,213 complaints, behind Texas at around $57 million. Across all crypto fraud types, Florida losses reached approximately $914.5 million.

The age distribution is the part that should change how you behave. Victims aged 60 and over accounted for $257.4 million of national kiosk losses across 6,188 complaints. Look wider and over-60s lost $4.4 billion to crypto fraud in total — close to 40% of all losses — and led every age group in kiosk fraud specifically. Seniors lost $7.75 billion to cybercrime overall in 2025, a 59% jump.

~$41,600

That is the average kiosk loss for an older victim. It is not a small sum being taken from many people — it is life savings being taken from a few thousand of them, one afternoon at a time, in convenience stores across states like this one.

Derived: $257.4M across 6,188 complaints from victims aged 60+

Eight playbooks used in Miami

These are the patterns, with the specific tell for each. Almost every real loss in Miami-Dade is a variant of one of them.

Fraud patterns What the approach looks like, and the tell that identifies it

PlaybookHow it runsThe tell
Government impersonationMost costly at kiosksA caller claims to be from the IRS, a sheriff’s office, immigration, Social Security or a court. There is a warrant, a fine, a frozen benefit. You can resolve it today by depositing cash into a machine.No agency in the United States accepts cryptocurrency, and none will ever ask you to deposit cash into a kiosk. Hang up and call the agency on a number you looked up yourself.
Tech supportAccount compromiseA pop-up or call warns your device or bank account is compromised. A “fraud department” or “Microsoft technician” instructs you to protect your funds by converting them to crypto and sending them to a “secure wallet”.There is no such thing as a secure wallet that a stranger controls. Real institutions never move your money to protect it, and never ask you to buy crypto.
Romance long conHighest average lossWeeks or months of genuine-feeling contact via dating apps or social platforms, then a trading opportunity, a platform showing profits, and encouragement to add more. Withdrawals work at first, in small amounts.The platform is a website, not an exchange. Look it up in FinCEN’s MSB registrant search and NMLS. If it is not there and it holds your money, it is not real.
Fake platformGuaranteed returnsA slick app or site advertising fixed daily or weekly returns, sometimes with a Miami address and testimonials. Deposits are accepted; withdrawals require an additional “tax” or “fee” payment.Guaranteed returns do not exist in any asset class. A withdrawal that requires a new payment is the definition of a scam, not a fee schedule.
Gift card demandOld but persistentYou are asked to buy retail gift cards and share the codes, in exchange for crypto or to settle a debt, a fine, or a purchase.No legitimate business or agency accepts payment in gift card codes. Ever. This one has no ambiguity at all.
In-person cash meetPhysical dangerA “buyer” or “seller” from a marketplace or social group proposes meeting to swap cash and crypto in a public place, often offering a better rate than any machine.You have told a stranger when and where you will be carrying money. The transfer is irreversible and there is no escrow that survives a robbery. Never do this.
Seed phrase phishingTotal lossA fake wallet support page, a browser pop-up, a “migration tool”, or a helpful person in a chat asks you to enter your recovery phrase to fix, verify or restore something.Legitimate support never asks for a recovery phrase, and there is no valid reason to type it into any website. See wallet security.
Recovery serviceTargets prior victimsAfter a loss, someone contacts you claiming they can trace and recover the funds, often citing real details of your case, for an upfront fee or a percentage.Unsolicited contact about a loss you reported is itself the tell. Real help comes from law enforcement and licensed attorneys, and they do not cold-call.

Patterns drawn from FBI IC3 reporting, FTC consumer alerts and Florida legislative findings supporting HB 505. Scripts vary; structures do not.

Why kiosks concentrate the harm

Crypto ATMs are wildly over-represented in fraud statistics relative to their share of transaction volume, and the reasons are structural rather than coincidental.

A kiosk converts physical cash into an irreversible transfer, in minutes, at a location with no one who understands the transaction. That is a near-perfect instrument for a scammer working a victim by phone: the money moves before anyone can intervene, and the only person present who might ask a question is a shop assistant with no visibility into what is happening.

The industry's own conduct has not helped. When the District of Columbia's attorney general sued Athena Bitcoin in late 2025, the allegations included that 93% of deposits into its machines were linked to scams, that the company knew its fraud warnings were ineffective, that it allowed wallets tied to scams to continue being used, and that it profited from fees on scam transactions — alongside undisclosed charges reaching 26%. Athena has said it strongly disagrees and will defend itself in court.

Florida's response was HB 505, signed 26 June 2026 and effective 1 January 2027, with operator registration from 1 March 2027. It caps daily kiosk activity at $2,000 for customers with fewer than seven days of history and $10,000 for everyone else, requires on-screen fraud warnings and printed receipts, and — unusually for US consumer-finance law — requires operators to refund fraud victims in full within 72 hours on their first kiosk transaction when reported with proof inside 60 days.

Those caps are calibrated precisely at the scam pattern. Legitimate users very rarely need more than $10,000 a day from a machine. Victims are always told they do. Full detail in Florida crypto regulation and our Miami ATM audit.

Illustration of crypto security elements including locks and digital assets
The technology is not the vulnerability. An irreversible transfer initiated by a frightened person on the phone is.

Protecting older relatives in Miami-Dade

Given where the losses fall, this is the most useful section on the page for many readers. Miami-Dade has a large retired population, considerable wealth held by people over seventy, and a very high volume of unsolicited calls. That combination is why Florida sits second in the national table.

Have the conversation before anything happens One sentence does most of the work: “No government agency, bank, police department or tech company will ever ask you to put cash into a machine or buy cryptocurrency.” Say it plainly, without jargon, and repeat it occasionally.
Establish a “call me first” rule Agree that any request involving money, urgency or secrecy gets a call to a named family member before anything is done. Scammers explicitly instruct victims not to tell anyone — an agreed rule gives your relative permission to break that instruction.
Explain that the instruction to stay silent is the proof “Do not tell the store staff what this is for” is a line scammers now use because Miami cashiers have started intervening. If someone asks for secrecy, that is not discretion, it is the tell.
Know that the caller ID means nothing Numbers are trivially spoofed, including those of real agencies and local police departments. Always hang up and dial a number you looked up independently.
Watch for the pattern, not the story Unusual bank withdrawals, sudden secrecy about money, new “advisers” or online friends, and questions about Bitcoin ATMs are the signals. The specific story will always sound plausible.
Report elder exploitation, not just fraud In Florida, suspected financial exploitation of a vulnerable adult can be reported to the Florida Abuse Hotline on 1-800-96-ABUSE alongside the fraud reports below. This is a separate, faster channel.

The universal red flags

Scam scripts change constantly. These structural features do not, and any single one of them is sufficient reason to stop.

Someone else supplies the address. The dominant mechanic in Florida crypto fraud. A wallet address or QR code you did not generate yourself is a destination that benefits somebody else. There is no legitimate transaction in which a stranger needs to provide the address you scan.

Urgency you did not create. Deadlines, closing windows, expiring offers, frozen accounts, imminent arrest. Time pressure exists to prevent you from consulting anyone. A real opportunity survives a night's sleep.

Secrecy. Any instruction not to tell your family, your bank or the shop assistant is an instruction to remove your only safeguards.

Guaranteed returns. No asset guarantees returns. A fixed daily or weekly percentage is not an investment product, it is the oldest fraud structure there is.

An unverifiable counterparty. Look it up in FinCEN's MSB registrant search and NMLS Consumer Access. Ninety seconds. If a company holds customer money and appears in neither, that is your answer.

Payment in gift cards, or a fee to withdraw. Both are unambiguous. No legitimate business takes gift card codes, and no legitimate platform requires a new payment before releasing your own funds.

How to report a loss — do all of these today

Speed genuinely matters. Funds are occasionally frozen at a receiving exchange if reported quickly enough, and HB 505's refund window for a first kiosk transaction requires reporting with proof inside 60 days. Each of these channels does something different, so file all of them.

Reporting Where to file, and what each does

WhereWhat it isWhy it matters
FBI IC3ic3.govFederal cybercrime reportingThe primary federal channel, and the dataset behind every statistic on this page. Include wallet addresses, transaction hashes, amounts and times.
FTCreportfraud.ftc.govConsumer protectionFeeds enforcement action and the Consumer Sentinel database used by state and federal investigators.
Florida Attorney Generalmyfloridalegal.comState consumer complaintThe state-level channel. Relevant to Florida-specific enforcement, including against kiosk operators under the new registration regime.
The operator or exchangeDirectlyPrivate notificationThe only party who can act in minutes. Ask them to flag the receiving address. For a kiosk, this is also the HB 505 refund claim route — keep the receipt.
Local policeNon-emergency linePolice reportCreates the local paper trail insurers, banks and courts ask for. Get the report number.
Florida Abuse Hotline1-800-96-ABUSEElder exploitationWhere the victim is an older or vulnerable adult. A separate and faster channel than fraud reporting alone.

Preserve everything before you file: screenshots, phone numbers, wallet addresses, transaction IDs, receipts and the machine or account identifiers. Do not delete the conversation, however uncomfortable it is to keep.

Recovery scams: the second hit

There is a distinct industry that exists solely to defraud people who have already been defrauded, and it is worth naming clearly because it catches people at their most vulnerable.

The approach is unsolicited contact — email, call, social media, sometimes citing genuine details of your case gleaned from public complaint records or from the original fraud operation itself. The offer is tracing and recovery of your funds, for an upfront fee or a percentage. Sometimes it comes dressed as a law firm, a "blockchain forensics" company, or even a government agency.

Two things are true and worth holding onto. Blockchain analysis is a real discipline and law enforcement does sometimes recover funds. And nobody legitimate will contact you out of the blue promising to do it for a fee. If you want professional help, engage a licensed Florida attorney you found and verified yourself through the Florida Bar, and understand before you pay anything that the realistic prospects are modest.

The bottom line

Two habits remove most of the risk

Never use an address somebody else gave you, and never act inside a deadline another person created. Those two rules would have prevented the overwhelming majority of the $32.7 million Floridians lost at kiosks last year, and neither requires any technical understanding at all.

Then add the ninety-second habit: look the counterparty up in a public registry before you send anything. Transact only with licensed platforms, keep your recovery phrase away from anything digital, and have the conversation with your parents before someone else does.

Scam and fraud questions

How common are crypto scams in Miami?
Florida ranked second in the United States for crypto kiosk fraud in 2025, with roughly $32.7 million lost across 1,213 complaints, behind only Texas. Nationally the FBI’s Internet Crime Complaint Center logged 13,460 crypto ATM and kiosk complaints with $389 million in losses — a 58% rise in losses year on year — and total US crypto-related fraud losses reached $11.4 billion.
Who is most targeted by crypto scams?
Older adults, overwhelmingly. Victims aged 60 and over accounted for $257.4 million of the national crypto kiosk losses in 2025 across 6,188 complaints, and over-60s lost $4.4 billion across all crypto fraud types — close to 40% of the national total. If you have older relatives in Miami-Dade, telling them that no agency will ever ask them to deposit cash into a machine is the highest-value thing you can do.
What is the biggest red flag in a crypto scam?
Someone else supplying the wallet address or QR code you are asked to scan. That single element is present in nearly every kiosk-based fraud. The second biggest is manufactured urgency — a frozen account, an arrest warrant, a closing window. Legitimate transactions do not require you to act within the next twenty minutes.
Can I get my money back after a crypto scam in Miami?
Blockchain transfers are irreversible, so recovery is difficult but not always impossible — funds are sometimes frozen at an exchange if reported quickly. From 1 January 2027, Florida’s HB 505 requires kiosk operators to refund fraud victims in full on their first kiosk transaction, within 72 hours, where it is reported with proof inside 60 days. Report immediately: speed is the only real lever you have.
Where do I report a crypto scam in Florida?
Report to the FBI’s Internet Crime Complaint Center at ic3.gov, to the Federal Trade Commission at reportfraud.ftc.gov, to the Florida Attorney General’s consumer protection division, and to the exchange or kiosk operator involved. File a police report with your local department for the paper trail. Do all of these — they serve different purposes.
Are recovery services that promise to get my crypto back legitimate?
Almost never. Recovery fraud is a distinct secondary scam that specifically targets people who have already lost money, often using details from public complaint records. Anyone who contacts you unsolicited promising to recover crypto for an upfront fee is running the second half of the same operation. Legitimate help comes from law enforcement and licensed attorneys who do not cold-call victims.