On January 10, the Federal Trade Commission (FTC) issued an alert about a new cryptocurrency payment scam involving impersonators convincing consumers to send money obtained from a cryptocurrency automated teller machine (ATM) via a quick response (QR) code.

According to the FTC, this is a new twist on scammers pretending to be someone a person trusts (e.g., from the government, law enforcement, or a local utility company) to convince consumers to send the impersonator money. As in the usual impersonator scenario, someone calls pretending to be from the government, or maybe a romantic interest met online, or about winning the lottery or a prize. The scammer eventually asks consumers for money. Here is where the scam takes a new twist.

If a consumer believes the story the scammer tells and seems willing to engage, the scammer will stay on the phone to direct the consumer to withdraw money from his/her bank, investment, or retirement accounts. Then the impersonator will tell a consumer to go to a store with a cryptocurrency ATM (and they will stay on the phone with the consumer the whole time). Once at the crypto ATM, the scammer will direct the consumer to insert his/her money into the ATM and buy cryptocurrency. And then the QR code comes in: The impersonator sends the consumer a QR code with the scammer’s address embedded in it. Once the consumer buys the cryptocurrency, the impersonator has the consumer scan the QR code, so the money gets transferred to the scammer. And by doing so, the consumer’s money is gone.

What the FTC wants consumers to know is that no one from the government, law enforcement, or a utility company will ever tell a consumer to pay them with cryptocurrency. The FTC’s view is that if “someone does, it’s a scam, every time.” And, in the FTC’s view, “any unexpected tweet, text, email, call, or social media message — particularly from someone you don’t know — asking you to pay them in advance for something, including with cryptocurrency, is a scam.”