Can a Bitcoin ATM Itself Be Fake or Tampered With?

Most warnings about these machines are about the person on the phone. This one is about the machine itself, and the square metre around it.

What these have in common is that they happen in the physical world. No amount of online security sense protects you — only looking properly when you get there.

The short answer

An entirely counterfeit machine is uncommon, because it costs money and the venue tends to notice. Local interference with a genuine machine is far more common: covering a QR code, faking the support details, or simply having someone talk you through it.

One: the covered QR code

Cheapest and oldest. The machine, or the material beside it, carries a QR code — the operator's site, a wallet download, a support page. Someone puts their own sticker over it.

You scan, land on an imitation page, or are handed an address directly, which you then enter as though it were official.

Spotting it

• Edges. Factory printing is part of the panel or a single laminated film. Added stickers lift at the corners, bubble, or don't match the surrounding print.
• Print quality. Plain paper, inkjet colour, rough edges.
• Position. Covering existing text, stuck on the bezel, or slightly crooked.
• Fingernail test. If a corner lifts, treat it as suspect.

Two: a screen asking for your recovery phrase

A normal purchase never requires your recovery phrase, private key or wallet password. It needs one thing: a receiving address, which is public information you can hand to anybody.

So if any of these appear, however they're dressed up, something is stealing your wallet:

• "Enter your 12 recovery words to verify wallet ownership"
• "Import wallet to continue" / "Restore wallet"
• "Enter private key to link account"
• "Scan this to connect and authorise your wallet"

This can show up on a modified machine, or on a web page you've been steered to. A recovery phrase is everything in the wallet, and once handed over the coins move within moments.

Three: the helpful stranger

The least scam-shaped of them, which is exactly why it works.

You're at the machine and someone drifts over. "Oh I've used this one, you want that option." Or "this machine plays up, you have to scan this first."

They may well be very fluent with it — because they're here every day.

Why it matters

The process needs no assistance. There are on-screen instructions, you can pause and look things up, you can ring the operator. A stranger inserting themselves into your cash transaction is an anomaly that needs explaining, whatever their manner.

Usual openings

• "Let me scan it, your screen's too dim." Scans their address.
• "Rate's bad on this one, there's a better machine round the corner." Relocates you.
• "I've got cash and want coins, let's just swap directly and skip the fee." You hand over cash, coins never arrive.
• "Did you get a phone call? Same thing happened to me, I'll help." The most dangerous, because they know your situation.

The response is the same in all cases: stop, pocket the cash, leave. No argument, no explanation, no worrying about being rude. Come back another time or use a different machine.

Four: the whole machine

More expensive, so rarer, but it has happened — imitation housings, a tablet inside a convincing cabinet, or a decommissioned unit re-rigged to keep taking money.

Signs

• No operator identification. Legitimate machines carry a brand, a machine ID and support contact somewhere obvious. Nothing, or a handwritten note, is a serious problem.
• The venue can't say who runs it. Ask who services it. Staff should at least know the brand or who comes to restock.
• Odd placement. Not inside a staffed, operating business — an empty corridor, a temporary stall, a vehicle.
• Takes money, prints nothing. Legitimate machines issue a receipt. Here's why that matters.
• Not listed on map tools or on the operator's own site.

Five: a fake support number on the casing

Far cheaper than faking a machine: stick a bogus support number on a real one. Something goes wrong, you ring the number on the sticker, and someone very helpful walks you into transferring more money or reading out a recovery phrase.

The cunning part is the targeting. It catches people who already have a problem and are upset — the moment when caution is at its lowest.

What to do instead: get support details from the operator's own website, not from a sticker and not from a paid search result. Identify the brand first, then go to the site.

The online half of it

Physical tampering usually comes with an online counterpart: imitation operator websites, bogus machine-finder apps, and fake support numbers bought into search results.

Their purpose is to corrupt the act of checking — you think you verified something, but you verified a page they prepared.

• Imitation operator sites. Close domain, copied layout, contact details swapped. Check the domain carefully; genuine operators usually have short, stable ones, and imitations lean on extra hyphens, numbers or odd suffixes.
• Fake finder apps. Show machines that don't exist to steer you somewhere, or demand permissions they have no use for. Stick to well-established map services — which fields to trust is here.
• Bought search results. Pages titled like "[operator] bitcoin ATM support number", aimed squarely at people mid-problem.

A sixty-second look before you start

1. Brand and machine ID present, and matching what you looked up?
2. Any added paper labels, especially with QR codes? Test a corner.
3. Is the support contact printed or stuck on? Stuck on means check the website.
4. Does the screen mention recovery phrases, private keys or importing a wallet? If so, stop.
5. Is anyone paying you unusual attention? If so, come back later.
6. Did the receiving address come out of your own phone's wallet app?

Number six catches nearly everything. The other five exist so you notice when something is off.

Why the physical layer gets overlooked

People arrive with online instincts — check the padlock, check the domain, don't click strange links. None of that transfers to a sticker on a metal box.

Three things make this layer easy to miss.

Machines look institutional. A large steel cabinet in a shop reads as bank infrastructure, and bank infrastructure is something we are trained not to question. But this cabinet belongs to a private company, sits in premises staffed by people with no involvement in it, and is unattended almost all of the time.

Nobody is checking between visits. An operator services a machine on a schedule. Between one visit and the next, whatever appears on that housing stays there. The venue's staff have no reason to notice a new label, and would not necessarily know what belongs.

The interference is cheap and low-risk. Printing a sticker costs almost nothing, and applying one takes seconds in a place where standing at the machine is entirely normal. Compare that to the effort of an online attack reaching the same number of people.

It is the same reasoning behind checking a card reader before tapping, or glancing at a fuel pump before inserting a card. Nobody expects to find anything. The check is worth doing because the downside of the rare case is so much larger than the cost of looking.

If you spot something

• Don't peel anything off to collect evidence. Photograph it and leave.
• Tell the venue. They usually don't know, and they have every reason to care.
• Contact the operator using details from their website, with the location and what you saw.
• If you scanned a suspicious code but haven't sent anything, stop there and enter nothing on that page.
• If you entered a recovery phrase anywhere, create a new wallet on a different, clean device immediately and move whatever remains. Treat this as urgent.

That last one needs stating clearly: once a recovery phrase is exposed, that wallet is permanently unsafe. Changing a password does nothing. Changing phones does nothing. A new wallet and a transfer is the only remedy.