Bitcoin Depot Now Requires ID for Every Transaction

At a Glance

9,019 kiosks affected — Bitcoin Depot now requires government-issued photo ID for every transaction, including returning customers
3 state AG actions since Oct 2025 — lawsuits or settlements in Massachusetts, Iowa, and Maine within four months
$1.9M Maine settlement — Bitcoin Depot agreed to reimburse scam victims in January 2026
Massachusetts AG securities fraud claim — first state AG to allege a Bitcoin ATM operator misled NASDAQ investors about scam rates
7,000+ transactions exceeded posted 23% fee cap — Massachusetts alleges drip-pricing consumer fraud beyond scam facilitation
17 states now have Bitcoin ATM-specific laws — requiring transaction limits, fraud warnings, and licensing

Bitcoin Depot is now requiring photo identification for every single transaction across its 9,019 U.S. kiosks — a dramatic escalation of its verification procedures that comes after the company was sued by three state attorneys general and settled a $1.9 million scam reimbursement case in Maine, all within the past four months. The timing tells you everything. Bitcoin Depot is framing this as a proactive security upgrade. The regulatory record says otherwise: it's a company scrambling to demonstrate compliance while fighting lawsuits alleging it knowingly profited from scam transactions where the median victim was 67 years old.

9,019

Bitcoin Depot Kiosks Affected

State AG Actions Since Oct 2025

$1.9M

Maine Settlement for Scam Victims

78%

US Share of Global Bitcoin ATMs

What Bitcoin Depot Actually Changed

Until now, Bitcoin Depot only required ID verification for new users — a policy it implemented in October 2025. Returning customers could walk up to any kiosk and transact without re-verifying their identity. That gap is exactly what regulators have argued enables scam facilitation: bad actors could create one verified account and then use it repeatedly, or take over existing accounts to funnel scam proceeds. The new policy requires identification at every transaction, regardless of whether the user has transacted before. Bitcoin Depot CEO Scott Buchanan framed the change as a fraud-detection tool.

"Continuous verification allows us to detect suspicious activity based on customers, locations, or transaction amount before a transaction is approved."

— Scott Buchanan, CEO, Bitcoin Depot

Buchanan specifically cited account sharing, identity theft, and account takeover as the threats the policy targets. These are precisely the mechanisms that state attorneys general have alleged Bitcoin Depot failed to address in their lawsuits.

What Changed:

Before October 2025: ID requirements varied by transaction amount and user history
October 2025: All new users required to provide ID at first transaction
February 2026: All users — new and returning — required to provide ID at every transaction

On its face, this is a meaningful step. Account sharing and identity theft are real vectors that scammers exploit — they coach victims into creating accounts, or use stolen identities to layer transactions. Requiring verification at every transaction closes some of those gaps. But ID verification alone doesn't solve the core problem regulators have identified: that Bitcoin Depot allegedly knew the overwhelming majority of high-value transactions were scam-related and continued processing them anyway.

The Enforcement Actions That Forced the Move

Bitcoin Depot's framing of this policy as a proactive security measure doesn't hold up against the timeline. The company has faced an unprecedented series of legal actions that make the real motivation clear:

Timeline of Enforcement Actions:

September 2024: Iowa AG Brenna Bird sues Bitcoin Depot and CoinFlip, alleging failure to prevent scam transactions
October 2025: Bitcoin Depot implements ID requirement for new users only
January 2026: Maine AG Aaron Frey reaches $1.9 million settlement with Bitcoin Depot to reimburse scam victims
January 2026: Missouri AG issues Civil Investigative Demand to Bitcoin Depot alongside four other operators
February 2026: Massachusetts AG Andrea Campbell sues Bitcoin Depot, alleging insufficient scam safeguards and seeking to bar large transactions without additional protections
February 2026: Bitcoin Depot begins rolling out mandatory ID for all transactions

The Massachusetts case is the most damaging. AG Campbell's complaint alleges that Bitcoin Depot charged fees exceeding its own posted 23% cap in over 7,000 transactions — a drip-pricing allegation that goes beyond scam facilitation into fundamental consumer fraud territory. The lawsuit also includes securities fraud claims, making it the first time a state attorney general has alleged that a Bitcoin ATM operator misled investors about scam rates. Bitcoin Depot trades on NASDAQ under ticker BTM. The Maine settlement is also significant. The $1.9 million payout represents a concrete admission — via settlement, at least — that consumers were harmed through Bitcoin Depot's machines. It establishes a precedent: Bitcoin ATM operators can be held financially responsible for scam losses that flow through their kiosks. If Massachusetts or Iowa reach similar outcomes — or worse, get jury verdicts — the financial exposure could be orders of magnitude larger.

Why ID Verification Alone Isn't Enough

Here's the disconnect between what Bitcoin Depot announced and what regulators are actually demanding. The lawsuits from Massachusetts, Iowa, and the investigative demands from Missouri aren't primarily about identity verification failures. They're about two things: 1. Scam facilitation. Regulators allege Bitcoin Depot processed transactions it knew or should have known were fraudulent. The victims in these cases typically weren't anonymous — they were identifiable people, often elderly, who were coached by scammers into sending Bitcoin through the machines. Knowing who they are doesn't help if the operator doesn't intervene when the transaction pattern screams "scam." The majority of scam cases described in AG complaints involve the victims themselves making the transactions. An elderly person who's been convinced by a phone scammer to buy Bitcoin and send it to a wallet address will still have their own valid ID. They'll verify successfully, complete the transaction, and lose their money. 2. Fee transparency. The drip pricing allegations — where the displayed Bitcoin price on screen is artificially low and a separate undisclosed fee of 15–25% is added at confirmation — have nothing to do with ID verification. Massachusetts specifically alleges Bitcoin Depot's fee practices are deceptive. For universal ID to meaningfully reduce scam rates, it needs to be combined with what Bitcoin Depot says the system enables: real-time detection of suspicious patterns based on customers, locations, and transaction amounts. That means flagging first-time large transactions, repeat visits to the same kiosk within short windows, and transaction patterns consistent with scam typologies. The Massachusetts AG's lawsuit specifically argues Bitcoin Depot failed to act on these patterns even when it had the data to identify them. Whether universal ID changes that calculus depends entirely on what the company does with the verification data, not just the fact that it collects it. Massachusetts is seeking a court order to bar Bitcoin Depot from processing large transactions without additional user protections — a much more aggressive intervention than just requiring ID.

The Broader Industry Pattern

Bitcoin Depot isn't the only operator under fire. The American Association of Retired Persons (AARP) reported in February 2026 that 17 U.S. states have now passed laws requiring Bitcoin ATM operators to implement protections including daily transaction limits, fraud warning signs, and licensing requirements. Missouri's January 2026 Civil Investigative Demands targeted five operators simultaneously — Bitcoin Depot, CoinFlip, Athena Bitcoin, RockItCoin, and Byte Federal — signaling that regulators view this as an industry-wide problem, not a single-company issue. Meanwhile, the DC Attorney General's lawsuit against Athena Bitcoin found a median scam victim age of 71. The Iowa AG's dual lawsuit against Bitcoin Depot and CoinFlip makes parallel allegations about inadequate fraud prevention. Bitstop received a cease and desist from Nebraska for basic licensing failures. Not all operators face the same level of regulatory scrutiny — trust scores on this site range from A+ to F, calculated from public enforcement records. See the operators directory for the full breakdown. Bitcoin Depot's ID policy change is an attempt to signal improved compliance. The lawsuits suggest it has a long way to go.

What This Means for Bitcoin Depot Customers

What you need to know:

Bring ID every time. You now need a government-issued photo ID for every transaction at all 9,019 Bitcoin Depot kiosks, even if you've used them before.
Expect longer transactions. The verification step adds time to each purchase.
If you were a scam victim who used a Bitcoin Depot machine in Maine, you may be eligible for reimbursement under the $1.9 million settlement — check with the Maine AG's office.
If you're in Massachusetts, the AG is seeking additional protections for large transactions; watch for court-ordered changes.
Check the fee you're being charged. Multiple state lawsuits allege Bitcoin Depot charged fees exceeding its own posted rates. Compare the dollar amount you insert to the Bitcoin value you receive.
No legitimate government agency, company, or tech support service will ever ask you to send money through a Bitcoin ATM. If someone is pressuring you to use one, it's a scam. Visit our consumer protection resources for help.

ID verification may add friction to your transaction — and that friction is arguably a feature, not a bug. A few extra seconds at the machine gives you one more moment to reconsider whether the transaction makes sense. But ID alone won't protect you from a scam you've already been convinced is legitimate.

What This Means for Operators

Compliance takeaways:

Universal ID verification is becoming the industry baseline. If your machines don't require it for every transaction, you're now behind Bitcoin Depot — a company with an F trust rating. That's not a position you want to be in when regulators come calling.
ID alone will not satisfy state AGs. Massachusetts is seeking transaction-level protections for high-value purchases. Iowa and Missouri are focused on scam prevention systems. Build beyond ID.
17 states now have Bitcoin ATM-specific laws. If you operate across state lines, your compliance matrix just got more complex. Map your machines against each state's requirements now.
The Missouri CID pattern signals more states are coming. Five operators received simultaneous demands. If you weren't on that list, don't assume you're safe — you may just be next.
Securities implications are real. If you're publicly traded or raising capital, the Massachusetts AG's securities fraud claims against Bitcoin Depot (NASDAQ: BTM) should be a wake-up call. What you tell investors about scam rates and compliance must match reality.

Operators with clean regulatory records may find this environment works to their advantage if they can demonstrate to host locations and regulators that strong compliance was baked in from the start, not bolted on after lawsuits. For operators currently under investigation, the question isn't whether to upgrade compliance procedures. It's whether the upgrades come fast enough to matter in pending litigation.

What to Watch Next

Bitcoin Depot's ID rollout will be complete across all U.S. machines in the coming weeks. But the real question isn't whether the company can verify who's using its kiosks — it's whether it can prove to courts in Massachusetts, Iowa, and potentially Missouri that it's doing enough to stop those users from being victimized. The Massachusetts case is the one to watch most closely. If AG Campbell wins a court order restricting high-value transactions, it would set a precedent that could reshape how every Bitcoin ATM operator in the country does business. And the securities fraud component adds an entirely new dimension: if Bitcoin Depot misled NASDAQ investors about scam rates, the consequences extend far beyond state consumer protection law. The real test will be whether universal ID verification actually reduces scam rates — and whether Bitcoin Depot shares that data publicly. If the company's next quarterly SEC filing shows meaningful scam reduction, it strengthens the argument that the policy works and may influence other operators to follow. If scam rates remain stubbornly high despite universal ID, it will validate what critics and AGs have argued: the problem isn't identity verification, it's that Bitcoin ATM operators profit from transactions they know are fraudulent and have insufficient incentive to stop them. Seventeen states have already legislated Bitcoin ATM protections. With AARP now tracking the issue and AG offices in at least five states actively pursuing operators, federal regulatory interest is likely next. The question for every operator in this space is straightforward: adapt now, or be forced to by a court order.

Bitcoin Depot Now Requires ID for Every Transaction — After Three State Enforcement Actions in Four Months