Is a Bitcoin ATM QR Code Safe to Scan? It Depends on Where It Came From
There are two completely different situations at a Bitcoin ATM — and they have opposite answers. The QR code the machine generates on its own screen is generally safe. A QR code that someone sent you and told you to scan at the ATM is almost certainly a scam. Here's how to tell the difference and protect yourself before you send a cent.
Situation 1: The ATM's own QR code (generally safe)
When you initiate a transaction at a Bitcoin ATM from a legitimate operator — Coinme, Bitcoin Depot, CoinFlip, LibertyX, and others — the machine generates a QR code on its own screen encoding your destination wallet address. This is a standard part of the transaction flow. In the absence of physical tampering, it is safe.
The one real risk here is physical tampering. Because Bitcoin ATMs are sometimes located in convenience stores, gas stations, or other semi-unattended locations, bad actors occasionally place a sticker with their own QR code over the machine's legitimate display area. Before scanning, take two seconds to check that there is no sticker or physical overlay on the screen. Then scan the QR code with QRsafer to preview the wallet address the code encodes before you confirm the send.
If the destination address in the QRsafer preview matches what the ATM's own interface shows, proceed. If it doesn't match — or if the URL behind the QR code redirects somewhere unexpected — do not continue the transaction and report the machine to the operator.
Situation 2: A QR code someone sent you (almost always a scam)
This is the scenario behind the large majority of Bitcoin ATM fraud losses. The scam works like this: someone contacts you — by phone, text, email, or social media — and tells you that you owe a debt, face arrest, have a tax bill, or won a prize. They instruct you to go to a Bitcoin ATM, deposit cash, and scan a QR code they provide to "send payment" or "claim your funds."
The QR code they sent encodes the scammer's own wallet address. The moment you confirm the transaction at the ATM, your cash is converted to Bitcoin and sent directly to them. Because Bitcoin transactions are irreversible, there is virtually no way to get the money back.
This scheme is used by fake tech support callers, romance scammers, government impersonators, lottery fraud, and utility shutoff threats. It is not a new or unusual tactic — it is the single most common Bitcoin ATM scam variant in the United States, and the FBI and FTC both track it extensively.
The one rule that protects you every time
No legitimate company, government agency, or person you have never met in real life will ever ask you to send money through a Bitcoin ATM using a QR code they provided.
The IRS does not collect tax debts via Bitcoin ATM. The Social Security Administration does not freeze benefits and demand crypto payment. Utility companies do not threaten immediate shutoff and ask for Bitcoin. Tech support teams at Microsoft, Apple, or your bank do not resolve account issues by asking you to deposit cash into a Bitcoin ATM. If anyone tells you otherwise, it is a scam — regardless of how official the caller sounds or how real the documents look.
If you are at a Bitcoin ATM because you chose to buy Bitcoin for your own reasons and the machine generated a QR code as part of its normal flow, you are likely fine — just verify the code with QRsafer before confirming. If you are at a Bitcoin ATM because someone directed you there, stop and walk away. For more on how crypto QR code scams work broadly, see our full guide.
How to safely use a Bitcoin ATM
- Go to the ATM on your own terms. Initiate the transaction yourself — don't go because someone contacted you and directed you there.
- Check for physical tampering. Before you touch anything, inspect the QR code area for stickers or overlays that look out of place.
- Scan the code with QRsafer first. QRsafer decodes the QR code and shows you what wallet address or URL it contains before you commit. If anything looks off, do not proceed.
- Verify the wallet address independently. If you are sending to a specific person or service, confirm their wallet address through a separate, trusted channel — not the QR code alone.
- Know that Bitcoin sends are final. Once you confirm the transaction, there is no dispute process, no chargeback, and no authority that can reverse it. Double-check before you tap confirm.
Frequently asked questions
Is it safe to scan the QR code on a Bitcoin ATM screen?
Generally yes, as long as the machine is from a legitimate operator (Coinme, Bitcoin Depot, CoinFlip, etc.) and hasn't been physically tampered with. Before scanning, inspect the QR code area for sticker overlays or signs of tampering. Then use QRsafer to preview the encoded wallet address before you commit any funds — a small extra step that catches address-substitution attacks.
What if someone sent me a QR code to scan at a Bitcoin ATM?
Do not scan it. A QR code sent to you by someone else — via text, email, phone call, or social media — to use at a Bitcoin ATM is almost certainly a scam. The IRS, Social Security Administration, Medicare, utility companies, tech support firms, and legitimate businesses never collect payment through a Bitcoin ATM. If you received this kind of instruction, end contact with the person immediately.
Can a Bitcoin ATM QR code steal my money without me confirming a send?
No. A QR code at a Bitcoin ATM encodes a wallet address — scanning it does not automatically send funds. You still have to feed cash into the machine and confirm the transaction on screen. The danger is that a tampered or scammer-provided QR code encodes the wrong wallet address, so you send funds to a scammer while believing you sent them to the right recipient.
What should I do if I already sent Bitcoin to a scammer at a Bitcoin ATM?
Act immediately, even though recovery is unlikely. Document everything: the receiving wallet address, the transaction ID (TXID), any messages from the scammer, and the ATM's location and operator name. Report to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Contact the ATM operator — some operators partner with blockchain analytics firms and may be able to flag the receiving address. Do not hire a "crypto recovery service"; they are almost always secondary scams.
Verify any QR code before you send crypto
QRsafer decodes any QR code and shows you the destination before you open it or confirm a transaction. Free on iOS and Android — takes two seconds at the ATM.