[Pages S1347-S1350]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

      By Mr. DURBIN (for himself, Mr. Blumenthal, Mr. Reed, and Mr. 
        Welch):
  S. 710. A bill to amend title 31, United States Code, to prevent 
fraudulent transactions at virtual currency kiosks, and for other 
purposes; to the Committee on Banking, Housing, and Urban Affairs.
  Mr. DURBIN. Mr. President, now on a totally different subject, I 
would like to tell you about one of my constituents. He is a man from 
New Lenox, IL, in the suburbs of Chicago.

[[Page S1348]]

  Late last year, he received an urgent phone call from someone 
claiming to be a deputy in the Will County Sheriff's Office. This self-
proclaimed deputy informed my constituent that he had missed jury duty. 
As a result, the deputy said, there is a warrant out for your arrest.
  The man was stunned. Don't worry, the deputy further explained. The 
man could avoid arrest, put the whole matter behind him. All he had to 
do was pay the fine. But he couldn't pay it by check or credit card. 
The deputy directed the man to a local cryptocurrency ATM machine and 
told him to deposit $15,000 into the machine, pay the fine, and all 
would be forgiven.
  If you have been following the news, you might have guessed by now 
that the man on the phone wasn't a sheriff's deputy at all; he was a 
scammer. Once my constituent deposited his money into the crypto-ATM, 
it was gone--gone. There was no way to trace the transaction to the 
scammer and no way to get the money back.
  This is just one example of a growing and alarming trend of crypto-
ATM fraud. There are now more than 30,000 crypto-ATMs in this country, 
and they are being used by criminals to cheat Americans out of their 
hard-earned savings, to the tune of $114 million in 2023 alone. Most of 
the victims are senior citizens.
  While these scams aren't all identical, they generally play out just 
like the one I described. A stranger calls and pretends to be from the 
government or the victim's bank. They make claims of unpaid fines, a 
frozen bank account, a credit card in default, or even threaten arrest.
  The scammer then tells their victim that they must immediately go to 
a crypto-ATM at a nearby grocery store, gas station, or convenience 
store. Often, the scammer will try to stay on the phone with the victim 
throughout the scam, warning of dire consequences if they don't make 
the payments immediately. It is a way of preventing their victim from 
getting a moment to take a breath and just maybe realize what is going 
on.
  Once the victim arrives at the crypto-ATM, the scammer will walk them 
through the process of depositing real money--cash--into the machine, 
buying Bitcoin or other cryptocurrency, and sending it to the scammer's 
digital wallet.
  Last summer, a small business owner in my hometown of Springfield, 
IL, removed a crypto-ATM from the store after witnessing senior after 
senior walk in, talking on their phones, looking stressed, and 
depositing huge sums of cash into the machine. He said:

       One hundred percent of the time that we saw somebody at the 
     machine they were being scammed.

  This is in a small store in Springfield, IL.
  It wasn't just happening there. There are tragic stories of seniors 
losing their savings through these machines in every State in America.
  A South Carolina retired couple lost $390,000 over the course of 
several months through a scam involving crypto-ATMs. Just this month, a 
sheriff's office in Walton County, FL, reported a resident that was 
cheated out of $129,000 through a crypto-ATM.
  It is past time that we put some commonsense guardrails in place to 
stop fraud in this largely unregulated industry. That is why, today, I 
am joining with Senators Blumenthal, Reed, and Welch to introduce the 
Crypto ATM Fraud Prevention Act. This bill will require crypto-ATM 
operators to warn consumers about scams and take reasonable steps to 
prevent fraud at their machines.
  It will also put in place measures to limit the amount that consumers 
lose when they do fall victim to scams and would give law enforcement 
new tools to track down and fight back against criminals.
  I want to share a few key measures in this bill with you. First, the 
bill will provide special protection for consumers during the 2 weeks 
after they make their first transaction at a crypto-ATM, the period 
when a consumer is most likely to be a victim of fraud. During this 
time, customers will be limited to deposits of $2,000 per day and 
$10,000 total. While this is still a lot of money, it ensures people's 
entire life savings are not put at risk.
  The bill will also require crypto-ATM operators to obtain verbal 
confirmation via a live phone call for any transaction with a new 
customer over $500. Do you remember when I told you scammers often stay 
on the phone with victims until the money has been deposited in their 
digital wallet? Well, this requirement will break that communication, 
give victims a chance to think, perhaps reach out to another member of 
the family, and make sure crypto-ATM operators can assess whether the 
customer is being scammed.
  Next, the bill requires crypto-ATM operators to give prominent, clear 
warnings about the risk of fraud and tell consumers about common types 
of scams. While warnings alone are not enough, they are part of the key 
to preventing fraud.
  Operators also will be required to issue paper receipts to customers 
after each transaction. The receipt will include, among other things, 
the date, time, and amount of the transaction and the transaction hash, 
which will allow law enforcement to more easily trace the transaction, 
collect evidence of the crime, and maybe even recover the stolen funds.
  Next, operators will be required to use the analytics to screen for 
suspicious, illicit transactions. Some companies are effectively using 
this technology already. It should be used across the board.
  Finally, crypto-ATM operators will be required to issue refunds to 
consumers who are victims of fraud. As long as victims make a sworn 
report to law enforcement and notify the operator within 30 days of the 
transaction, they will be entitled to a full refund. New customers will 
get full refunds. All other customers will be entitled to a refund of, 
at minimum, any fees associated with the transaction.
  These measures are commonsense guardrails that will prevent countless 
Americans, particularly senior citizens, from losing thousands of 
dollars of their hard-earned savings to criminal scams. I urge all my 
colleagues on both sides of the aisle to join me to pass this bill into 
law. We don't have any time to waste.
  Mr. President, I ask unanimous consent that the text of the bill be 
printed in the Record.
  There being no objection, the text of the bill was ordered to be 
printed in the Record, as follows:

                                 S. 710

       Be it enacted by the Senate and House of Representatives of 
     the United States of America in Congress assembled,

     SECTION 1. SHORT TITLE.

       This Act may be cited as the ``Crypto ATM Fraud Prevention 
     Act of 2025''.

     SEC. 2. REGISTRATION WITH THE SECRETARY OF THE TREASURY.

       Section 5330 of title 31, United States Code, is amended--
       (1) in subsection (d)--
       (A) in paragraph (1)(A), by inserting ``, any person who 
     owns, operates, or manages a virtual currency kiosk in the 
     United States or its territories,'' after ``similar 
     instruments''; and
       (B) by adding at the end the following:
       ``(3) Virtual currency; virtual currency address; virtual 
     currency kiosk; virtual currency kiosk operator.--The terms 
     `virtual currency', `virtual currency address', `virtual 
     currency kiosk', and `virtual currency kiosk operator' have 
     the meanings given those terms, respectively, in section 
     5337.''; and
       (2) by adding at the end the following:
       ``(f) Registration of Virtual Currency Kiosk Locations.--
       ``(1) In general.--Not later than 90 days after the 
     effective date of this subsection, and not less than once 
     every 90 days thereafter, the Secretary of the Treasury shall 
     require virtual currency kiosk operators to submit an updated 
     list containing the physical address of each virtual currency 
     kiosk owned or operated by the virtual currency kiosk 
     operator.
       ``(2) Form and manner of registration.--Each submission by 
     a virtual currency kiosk operator pursuant to paragraph (1) 
     shall include--
       ``(A) the legal name of the virtual currency kiosk 
     operator;
       ``(B) any fictitious or trade name of the virtual currency 
     kiosk operator;
       ``(C) the physical address of each virtual currency kiosk 
     owned, operated, or managed by the virtual currency kiosk 
     operator that is located in the United States or the 
     territories of the United States;
       ``(D) the start date of operation of each virtual currency 
     kiosk;
       ``(E) the end date of operation of each virtual currency 
     kiosk, if applicable; and
       ``(F) each virtual currency address used by the virtual 
     currency kiosk operator.
       ``(3) False and incomplete information.--The filing of 
     false or materially incomplete information in a submission 
     required under

[[Page S1349]]

     paragraph (1) shall be deemed a failure to comply with the 
     requirements of this subsection.''.

     SEC. 3. PREVENTING FRAUDULENT TRANSACTIONS AT VIRTUAL 
                   CURRENCY KIOSKS.

       (a) In General.--Subchapter II of Chapter 53 of Title 31, 
     United States Code, is amended by adding at the end the 
     following:

     ``Sec. 5337. Virtual currency kiosk fraud prevention

       ``(a) Definitions.--In this section:
       ``(1) Blockchain analytics.--The term `blockchain 
     analytics' means the analysis of data from blockchains or 
     public distributed ledgers, and associated transaction 
     information, to provide risk-specific information about 
     virtual currency transactions and virtual currency addresses.
       ``(2) Customer.--The term `customer' means any person that 
     purchases or sells virtual currency through a virtual 
     currency kiosk.
       ``(3) Existing customer.--The term `existing customer' 
     means a customer other than a new customer.
       ``(4) FinCEN.--The term `FinCEN' means the Financial Crimes 
     Enforcement Network of the Department of the Treasury.
       ``(5) New customer.--The term `new customer', with respect 
     to a virtual currency kiosk operator, means a customer during 
     the 14-day period beginning on the date of the first virtual 
     currency kiosk transaction of the customer with the virtual 
     currency kiosk operator.
       ``(6) Transaction hash.--The term `transaction hash' means 
     a unique identifier made up of a string of characters that 
     act as a record of and provide proof that a transaction was 
     verified and added to the blockchain.
       ``(7) Virtual currency.--The term `virtual currency' means 
     any digital representation of value that is recorded on a 
     cryptographically secured distributed ledger or any similar 
     technology or another implementation, which was designed and 
     built as part of a system to leverage or replace blockchain, 
     distributed ledger technology, or their derivatives.
       ``(8) Virtual currency address.--The term `virtual currency 
     address' means an alphanumeric identifier associated with a 
     virtual currency wallet identifying the location to which 
     virtual currency purchased through a virtual currency kiosk 
     can be sent or from which virtual currency sold through a 
     virtual currency kiosk can be accessed.
       ``(9) Virtual currency kiosk.--The term `virtual currency 
     kiosk' means a stand-alone machine that is capable of 
     accepting or dispensing legal tender in exchange for virtual 
     currency.
       ``(10) Virtual currency kiosk operator.--The term `virtual 
     currency kiosk operator' means a person who owns, operates, 
     or manages a virtual currency kiosk located in the United 
     States or its territories.
       ``(11) Virtual currency kiosk transaction.--The term 
     `virtual currency kiosk transaction' means the purchase or 
     sale of virtual currency via a virtual currency kiosk.
       ``(12) Virtual currency wallet.--The term `virtual currency 
     wallet' means a software application or other mechanism 
     providing a means for holding, storing, and transferring 
     virtual currency.
       ``(b) Disclosures.--Before entering into a virtual currency 
     transaction with a customer, a virtual currency kiosk 
     operator shall disclose in a clear, conspicuous, and easily 
     readable manner--
       ``(1) all relevant terms and conditions of the virtual 
     currency kiosk transaction, including--
       ``(A) the amount of the virtual currency kiosk transaction;
       ``(B) the type and nature of the virtual currency kiosk 
     transaction;
       ``(C) a warning that the virtual currency kiosk transaction 
     is final, is not refundable, and may not be reversed; and
       ``(D) the type and amount of any fees or other expenses 
     paid by the customer;
       ``(2) a warning relating to consumer fraud including--
       ``(A) a warning that consumer fraud often starts with 
     contact from a stranger, and that the customer should never 
     send money to someone they do not know;
       ``(B) a warning about the most common types of fraudulent 
     schemes involving virtual currency kiosks, such as--
       ``(i) impersonation of a government official or a bank 
     representative;
       ``(ii) threats of jail time or financial penalties;
       ``(iii) offers of a job or reward in exchange for payment, 
     or offers of deals that seem too good to be true;
       ``(iv) claims of a frozen bank account or credit card; or
       ``(v) requests for donations to charity or disaster relief; 
     and
       ``(C) a statement that the customer should contact the 
     virtual currency kiosk operator's customer service helpline 
     or State or local law enforcement if they suspect fraudulent 
     activity.
       ``(c) Acknowledgment of Disclosures.--Each time a customer 
     uses a virtual currency kiosk, the virtual currency kiosk 
     operator shall ensure acknowledgment of all disclosures 
     required under subsection (b) via confirmation of consent of 
     the customer at the virtual currency kiosk.
       ``(d) Receipts.--Upon completion of each virtual currency 
     kiosk transaction, the virtual currency kiosk operator shall 
     provide the customer with a receipt, which shall include the 
     following information:
       ``(1) The name and contact information of the virtual 
     currency kiosk operator, including a telephone number for a 
     customer service helpline.
       ``(2) The name of the customer.
       ``(3) The type, value, date, and precise time of the 
     virtual currency kiosk transaction, transaction hash, and 
     each applicable virtual currency address.
       ``(4) The amount of the virtual currency kiosk transaction 
     expressed in United States dollars.
       ``(5) All fees charged.
       ``(6) A statement that the customer may be entitled by law 
     to a refund if the customer reports fraudulent activity in 
     conjunction with the virtual currency kiosk transaction not 
     later than 30 days after the date of the virtual currency 
     kiosk transaction.
       ``(7) The refund policy of the virtual currency kiosk 
     operator or a Uniform Resource Locator where the refund 
     policy of the virtual currency kiosk operator can be found.
       ``(8) A statement that the customer should contact law 
     enforcement if they suspect fraudulent activity, such as 
     scams, including contact information for a relevant law 
     enforcement or government agency.
       ``(9) Any additional information the virtual currency kiosk 
     operator determines appropriate.
       ``(e) Physical Receipts Required.--Not later than 1 year 
     after the effective date of this section, each receipt 
     required under subsection (d) shall be issued to the customer 
     as a physical receipt at the virtual currency kiosk at the 
     time of the virtual currency kiosk transaction, but such 
     receipt may also be provided in additional forms or 
     communications.
       ``(f) Anti-fraud Policy.--
       ``(1) In general.--Each virtual currency kiosk operator 
     shall take reasonable steps to detect and prevent fraud, 
     including establishing and maintaining a written anti-fraud 
     policy that includes--
       ``(A) the identification and assessment of fraud-related 
     risk areas;
       ``(B) procedures and controls to protect against risks 
     identified under subparagraph (A);
       ``(C) allocation of responsibility for monitoring the risks 
     identified under subparagraph (A); and
       ``(D) procedures for the periodic evaluation and revision 
     of the anti-fraud procedures, controls, and monitoring 
     mechanisms under subparagraphs (B) and (C).
       ``(2) Submission of anti-fraud policy to fincen.--Each 
     virtual currency kiosk operator shall submit to FinCEN the 
     anti-fraud policy required under paragraph (1) not later than 
     90 days after the later of--
       ``(A) the effective date of this section; or
       ``(B) the date on which the virtual currency kiosk operator 
     begins operating.
       ``(g) Appointment of Compliance Officer.--Each virtual 
     currency kiosk operator shall designate and employ a 
     compliance officer who--
       ``(1) is qualified to coordinate and monitor compliance 
     with this section and all other applicable Federal and State 
     laws, rules, and regulations;
       ``(2) is employed full-time by the virtual currency kiosk 
     operator;
       ``(3) is not the chief executive officer of the virtual 
     currency kiosk operator; and
       ``(4) does not own or control more than 20 percent of any 
     interest in the virtual currency kiosk operator.
       ``(h) Use of Blockchain Analytics.--
       ``(1) In general.--Each virtual currency kiosk operator 
     shall use blockchain analytics to prevent sending virtual 
     currency to a virtual currency wallet known to be affiliated 
     with fraudulent activity at the time of a virtual currency 
     kiosk transaction and to detect transaction patterns 
     indicative of fraud or other illicit activities.
       ``(2) Compliance.--The Director of FinCEN may request 
     evidence from any virtual currency kiosk operator to confirm 
     compliance with this subsection.
       ``(i) Verbal Confirmation Required Before New Customer 
     Transactions.--
       ``(1) In general.--Before entering into a virtual currency 
     kiosk transaction valued at 500 dollars or more with a new 
     customer, a virtual currency kiosk operator shall obtain 
     verbal confirmation from the new customer that--
       ``(A) the new customer wishes to proceed with the virtual 
     currency kiosk transaction;
       ``(B) the new customer understands the nature of the 
     virtual currency kiosk transaction; and
       ``(C) the new customer is not being fraudulently induced to 
     engage in the transaction.
       ``(2) Reasonable effort.--A virtual currency kiosk operator 
     shall make a reasonable effort to determine whether the 
     customer is being fraudulently induced to engage in the 
     virtual currency kiosk transaction.
       ``(3) Method of confirmation.--Each verbal confirmation 
     required under paragraph (1) shall be given by way of a live 
     telephone or video call to a person employed by, or on behalf 
     of, the virtual currency kiosk operator.
       ``(j) Refunds.--
       ``(1) In general.--
       ``(A) New customers.--Not later than 30 days after 
     receiving an application under paragraph (2), a virtual 
     currency kiosk operator shall issue a refund to a customer 
     for the full amount of each virtual currency kiosk 
     transaction, including the dollar value

[[Page S1350]]

     of virtual currency exchanged and all transaction fees, made 
     during the period in which the customer was a new customer 
     and for which the customer was fraudulently induced to engage 
     in the virtual currency kiosk transaction.
       ``(B) Existing customers.--Not later than 30 days after 
     receiving an application under paragraph (2), a virtual 
     currency kiosk operator shall issue a refund to a customer 
     for the full amount of all transaction fees associated with 
     each virtual currency kiosk transaction made during the 
     period in which the customer was an existing customer and for 
     which the customer was fraudulently induced to engage in the 
     virtual currency kiosk transaction.
       ``(2) Application.--A customer seeking a refund under 
     paragraph (1) shall, not later than 30 days after the date of 
     the virtual currency kiosk transaction, submit an application 
     to the virtual currency kiosk operator that includes the 
     following:
       ``(A) The name, address, and phone number of the customer.
       ``(B) The transaction hash of the virtual currency kiosk 
     transaction or information sufficient to determine the type, 
     value, date, and time of the virtual currency kiosk 
     transaction.
       ``(C) A copy of a report to a State or local law 
     enforcement or government agency, made not later than 30 days 
     after the virtual currency kiosk transaction, that includes a 
     sworn affidavit attesting that the customer was fraudulently 
     induced to engage in the virtual currency kiosk transaction.
       ``(3) Enhanced damages.--Any person who willfully denies a 
     refund to a customer in violation of paragraph (1) shall be 
     liable to the customer for 3 times the amount of the refund 
     owed under that paragraph or $10,000, whichever is greater. A 
     penalty under this paragraph shall be in addition to any 
     penalty under subsection (n).
       ``(k) Transaction Limits With Respect to New Customers.--
       ``(1) In a 24-hour period.--A virtual currency kiosk 
     operator shall not accept more than $2,000, or the equivalent 
     amount in virtual currency, from any new customer during any 
     24-hour period.
       ``(2) Total.--A virtual currency kiosk operator shall not 
     accept a total of more than $10,000, or the equivalent amount 
     in virtual currency, from any new customer.
       ``(l) Customer Service Helpline.--Each virtual currency 
     kiosk operator shall provide live customer service during all 
     hours that the virtual currency kiosk operator accepts 
     virtual currency kiosk transactions, the phone number for 
     which is regularly monitored and displayed in a clear, 
     conspicuous, and easily readable manner upon each virtual 
     currency kiosk.
       ``(m) Communications With Law Enforcement.--
       ``(1) In general.--Each virtual currency kiosk operator 
     shall provide a dedicated and frequently monitored phone 
     number and email address for relevant law enforcement and 
     government agencies to facilitate communication with the 
     virtual currency kiosk operator in the event of reported or 
     suspected fraudulent activity.
       ``(2) Submission.--Not later than 90 days after the 
     effective date of this section, each virtual currency kiosk 
     operator shall submit the phone number and email address 
     described in paragraph (1) to FinCEN and all other relevant 
     law enforcement and government agencies.
       ``(n) Civil Penalties.--
       ``(1) In general.--Any person who fails to comply with any 
     requirement of this section, or any regulation prescribed 
     under this section, shall be liable to the United States for 
     a civil monetary penalty of $10,000 for each such violation.
       ``(2) Continuing violation.--Each day that a violation 
     described in paragraph (1) continues shall constitute a 
     separate violation for purposes of such paragraph.
       ``(3) Assessments.--Any penalty imposed under this section 
     shall be assessed and collected by the Secretary of the 
     Treasury as provided in section 5321 and any such assessment 
     shall be subject to the provisions of that section.
       ``(o) Relationship to State Laws.--The provisions of this 
     section shall preempt any State law, rule, or regulation only 
     to the extent that such State law, rule, or regulation 
     conflicts with a provision of this section. Nothing in this 
     section shall be construed to prohibit a State from enacting 
     a law, rule, or regulation that provides greater protection 
     to customers than the protection provided by the provisions 
     of this section.''.
       (b) Clerical Amendment.--The table of sections for chapter 
     53 of title 31, United States Code, is amended by inserting 
     after the item relating to section 5336 the following:

``5337. Virtual currency kiosk fraud prevention.''.

     SEC. 4. EFFECTIVE DATE.

       The amendments made by this Act shall take effect 90 days 
     after the date of enactment of this Act.
                                 ______