THE $7 BILLION SKIM

The Machine That Looks Like a Card Reader

Walk into almost any cannabis dispensary in America and you will see it: a sleek payment terminal sitting on the checkout counter, indistinguishable from the card reader at your local coffee shop. Swipe your debit card. Punch in your PIN. Collect your product. Simple, seamless, normal.

Except nothing about that transaction is normal.

That terminal is not processing a retail purchase. It is not sending a merchant transaction through the Visa or Mastercard network where those companies would collect their standard interchange fee—typically between 1% and 3% of the transaction amount, depending on card type and merchant category. Instead, the transaction is being coded as Merchant Category Code 6011—the code reserved exclusively for legitimate ATM cash withdrawals. It is being routed down what the industry calls “debit rails” through a sponsor bank, and it appears on the customer’s bank statement not as a purchase at a dispensary, but as a cash withdrawal from a generic ATM—sometimes at an address that has nothing to do with the dispensary at all.

Bloomberg reported that a purchase of pear-flavored THC chews at Theory Wellness in Great Barrington, Massachusetts showed up on a customer’s bank statement as an ATM withdrawal at the McDonald’s next door. Neither the customer, the dispensary, nor the McDonald’s knew it was happening.

This is the cashless ATM—and it has quietly become one of the largest financial frauds in American retail history.

$7 Billion and Counting: The Scale of the Scheme

The numbers are staggering. According to Bloomberg’s reporting, cashless ATMs have processed more than $7 billion in payments despite public warnings from the card networks. Cannabis dispensaries across the United States processed over $30 billion in total transactions in 2024. Before the December 2022 crackdown by NCR’s Columbus Data Services, industry analysts estimated that cashless ATM transactions accounted for approximately 25% of all U.S. cannabis sales—roughly $6.25 billion to $7.5 billion annually.

That’s $6.25 billion in transactions on which Visa and Mastercard collected zero interchange revenue.

Here is why: ATM transactions and merchant point-of-sale transactions operate under fundamentally different fee structures. When you buy a coffee with your Visa debit card, the merchant’s bank pays an interchange fee to your bank (the issuing bank). Visa sets these rates—currently ranging from about 0.05% plus $0.21 for regulated debit to 1.65% plus $0.04 or higher for credit—and takes a small network assessment fee. The merchant pays these costs through their “merchant discount rate.”

ATM withdrawals operate on completely different economics. The ATM owner collects a surcharge fee directly from the consumer and may receive a small interchange from the cardholder’s issuing bank. But the ATM transaction does not generate the merchant-side interchange that Visa and Mastercard depend on as a core revenue stream. By miscoding a retail purchase as an ATM cash withdrawal, the cashless ATM operators are not just circumventing banking restrictions on cannabis. They are siphoning the interchange revenue that would normally flow to the card networks and issuing banks—and redirecting it into their own pockets.

How the Gig Works: ISOs, Phantom ATMs, and Ported Terminals

The mechanics of the scheme rely on entities known in the merchant services industry as Independent Sales Organizations (ISOs)—middlemen that sell or lease ATM equipment and connect merchants to the payment network through sponsor banks.

Here is the playbook, as described by multiple industry sources and confirmed through lawsuit filings and regulatory documents:

Robbing the Customer at the Counter: The Consumer Nightmare Nobody Is Talking About

The interchange skim steals from Visa and Mastercard. The kickbacks enrich dispensaries and ISOs. But there is a third victim in this scheme who gets hit the hardest and has the least recourse: the consumer.

Regulated Green conducted field tests at dispensaries in multiple states to document the actual consumer experience of a cashless ATM transaction. The results were shocking—not because we expected the fees to be low, but because the total cost extraction from a single small purchase was so egregious that it would be illegal in virtually any other context in American commerce.

The round-up is only the first layer of fee extraction. Here is what actually happens to a consumer’s bank account when they swipe their debit card at a cashless ATM terminal:

The Round-Up. Because the terminal is coded as an ATM, it must round to whole-dollar denominations to maintain the disguise. Some dispensaries round to the nearest $5. Others, like the one we visited, round to the nearest $10 or even $20. On a $12.50 purchase, a $20 round-up means 60% of the amount charged to the customer’s card has nothing to do with the product they are buying. Yes, the dispensary is supposed to hand back $7.50 in cash change. But that assumes the budtender counts correctly, that the customer remembers to ask, and that the dispensary isn’t also skimming on the change.

The ATM Surcharge. The cashless ATM operator charges the consumer a surcharge fee—typically $2.50 to $3.50 per transaction—just as a real ATM would. This fee is technically disclosed on-screen, but in a dispensary checkout context, the consumer is standing at a counter with a line behind them, and the fee prompt blends into the PIN entry flow. On a $12.50 purchase, a $3.50 surcharge is 28% of the product price.

The Out-of-Network Lookup Fee. Because the cashless ATM is not in the consumer’s bank’s ATM network, the transaction triggers an out-of-network lookup—a routing fee charged by the ATM network to locate the consumer’s account at a bank that is not a network participant. This fee can range from $1.00 to $3.00 or more per transaction. The consumer is never asked to consent to this fee at the point of sale. It is not disclosed on the terminal screen. It simply appears on the consumer’s bank statement days later. In our field test, this fee was $3.00. We did not consent to it. We did not know it existed until we reviewed our bank statement.

The Balance Inquiry / Authorization Fee. Some cashless ATM configurations run a balance check before processing the withdrawal. This triggers a separate authorization inquiry fee—ranging from $1.00 to $3.00—charged by the ATM network or the consumer’s bank. Again, the consumer never consents to this charge. In our field test, a $3.00 balance inquiry fee appeared on our bank statement that we never authorized and were never informed about at the point of sale. We did not request a balance inquiry. The terminal ran one anyway—and charged us for it.

The Issuing Bank’s Foreign ATM Fee. Many banks charge their own customers a fee for using an ATM outside the bank’s network—typically $2.00 to $3.00 per transaction. Because the cashless ATM is registered as a third-party ATM, the consumer’s own bank may assess this charge on top of everything else. Not every bank charges this fee, and it did not apply in our specific field test—but for consumers whose banks do charge it, the total cost extraction is even higher.

Read that bottom row again. In our field test, a consumer buying a $12.50 pre-roll had $26.00 debited from their bank account. After receiving $7.50 in cash change, the net cost was $18.50—an effective fee rate of 48%. The $3.50 surcharge was at least disclosed on the terminal screen. But the $3.00 out-of-network lookup fee and the $3.00 balance inquiry fee—$6.00 in charges that appeared on our bank statement days later without our knowledge or consent—were not. We never authorized a balance inquiry. We were never told a network lookup fee would be charged. There was no disclosure on the terminal screen. The fees simply materialized on our statement.

This is not a credit card convenience fee. This is not a standard payment processing surcharge. No legitimate retail transaction in America hits the consumer with 48% in fees—let alone $6.00 in charges they never authorized. For context: the average credit card interchange fee on a standard retail purchase is 1.5% to 3%. Even the most predatory payday lending operations are required by state law to disclose their APR. The cashless ATM at a dispensary has no such obligation—because it is not supposed to exist. And unlike payday lenders, cashless ATM operators are charging fees the consumer never agreed to and never saw coming. If the $3.50 surcharge that appeared on our statement was a separate debit rather than a notation within the $20.00 withdrawal—which we are confirming with our bank—the effective fee rate rises to 76%.

The Legal Framework They’re Breaking: Regulation E, EFTA, and Consumer Disclosure

The Electronic Fund Transfer Act (EFTA) of 1978, implemented through Regulation E (12 CFR Part 1005), establishes the consumer protection framework for electronic fund transfers, including ATM transactions. The law is administered by the Consumer Financial Protection Bureau (CFPB). Its requirements are clear and specific:

Fee Disclosure Before Commitment. Under EFTA Section 904(d)(3) and Regulation E §1005.16, an ATM operator is required to provide the consumer with a notice disclosing the specific amount of any fee before the consumer is irrevocably committed to completing the transaction. The disclosure must appear on-screen or on paper issued from the machine. A consumer must have the opportunity to cancel the transaction after seeing the fee.

Complete Fee Disclosure. Under Regulation E §1005.7(b)(5), financial institutions must disclose all fees for electronic fund transfers or the right to make them. This includes per-transaction fees, surcharges, and any fees that vary by condition. The FDIC’s examination manual specifically requires that if a per-item fee is imposed only under certain conditions, “those conditions must be disclosed.”

Here is the problem: cashless ATMs systematically fail to disclose the full cost stack to the consumer. The on-screen prompt may show the ATM surcharge ($2.50–$3.50). But it does not disclose the out-of-network lookup fee—which in our test was $3.00. It does not disclose that the terminal will run an unauthorized balance inquiry—which cost us another $3.00. It does not tell the consumer that the transaction is being rounded up to the nearest $10 or $20, meaning they will be charged substantially more than the purchase price. And it certainly does not disclose that this is not actually an ATM withdrawal at all—it is a disguised retail purchase. In our field test, $6.00 in fees appeared on our bank statement that were never disclosed at the point of sale and to which we never consented. Under Regulation E, that is not a gray area. That is a violation. And if the $3.50 surcharge was separately debited on top of the $20.00 withdrawal, the total undisclosed extraction rises even higher.

Under the EFTA, an ATM operator may not charge a fee if the required disclosures are not provided. If the fee disclosures are deficient—and our field testing suggests they are systematically deficient—every surcharge collected by a cashless ATM operator may be unlawfully charged.

The SAR Gap: Where Is the Reporting?

Legitimate cannabis banking is one of the most heavily regulated financial relationships in America. Under FinCEN’s February 14, 2014 BSA guidance on marijuana-related businesses (MRBs), a bank that services a cannabis dispensary must:

File a Marijuana Limited SAR within 30 days of onboarding, and file continuing SARs every 90 days thereafter, for the entire duration of the relationship. As of 2024, FinCEN reported that approximately 816 banks and 182 credit unions were actively filing marijuana-related SARs, with nearly 350,000 total filings accumulated.

Conduct enhanced customer due diligence including verification of the dispensary’s state license, review of seed-to-sale tracking reports, analysis of whether the business implicates any DOJ enforcement priorities, and ongoing transaction monitoring for red flags.

Maintain a formal MRB bank policy and protocol that specifically addresses the institution’s procedures for banking marijuana-related businesses, including BSA/AML compliance procedures, transaction monitoring thresholds, and the reporting infrastructure for each transaction through seed-to-sale documentation.

This is critical context for understanding the cashless ATM fraud. When a bank legitimately services a cannabis dispensary, it does so through a rigorous, documented compliance framework. The bank issues what is known in the industry as a bank transparency letter—a formal acknowledgment that the institution understands it is processing transactions for a Marijuana Related Business (MRB), that it has established a bank policy and protocol for doing so, and that it is prepared to file the required SARs and report on each transaction using the dispensary’s seed-to-sale data. This is not a side deal with a VP or a business account manager. This is an institutional commitment, reviewed by compliance officers, documented in the bank’s BSA/AML program, and subject to regulatory examination.

Cannabis is, ironically, one of the most buttoned-up industries in the world when it comes to financial compliance. Every gram of product is tracked from seed to sale. Every dollar of revenue is reported. Every banking relationship is documented with SAR filings that tell FinCEN exactly what the bank is doing and why.

The cashless ATM obliterates all of this.

When an ISO registers phantom ATM terminal IDs and routes dispensary transactions through the ATM network, the sponsor bank does not know it is processing cannabis transactions. There is no MRB bank transparency letter. There is no enhanced due diligence. There are no seed-to-sale reports. There are no Marijuana Limited SARs. The transactions appear as routine ATM cash withdrawals coded under MCC 6011—and the sponsor bank’s compliance department has no reason to look twice.

This means the cashless ATM scheme doesn’t just defraud Visa and Mastercard of interchange. It doesn’t just gouge consumers with hidden fees. It actively undermines the federal financial reporting infrastructure that Congress and FinCEN built specifically to provide transparency into cannabis-related financial activity. Every cashless ATM transaction that should have generated a SAR filing but didn’t is a hole in the reporting framework—and a potential count of BSA non-compliance for the sponsor bank that unknowingly processed it.

The Tax Ghost: Kickbacks as Untaxed Revenue

Cannabis operators labor under one of the most punitive tax regimes in American business. Section 280E of the Internal Revenue Code prohibits businesses trafficking in Schedule I or II controlled substances from deducting ordinary business expenses, resulting in effective tax rates that industry observers say can reach 70% or higher.

Multiple sources told Regulated Green that kickback payments—or “rebates,” as they appear in contracts—from ATM operators are treated as ATM placement revenue—money received for allowing ATM equipment on the premises—rather than as cannabis sales revenue. Under this characterization, the income would not be subject to 280E because it is technically income from an equipment placement agreement, not from the sale of a controlled substance. Several operators described the kickback income as an “uncounted revenue stream.”

Whether the IRS would agree with this characterization is an open and untested question—but the fact that operators are structuring the payments this way suggests a deliberate strategy to shelter income from the crushing weight of 280E.

No Other Industry Acts Like This

In every other sector of American retail, interchange fees are a cost of doing business. No other industry has devised a mechanism to systematically avoid paying interchange on card-present, in-store transactions while still accepting cards. No other industry routes retail purchases through ATM codes to circumvent network rules. No other industry maintains a parallel kickback economy—dressed up as “rebates” in contract language—funded by diverted interchange revenue. And no other industry hits consumers with non-consented fees that appear on their bank statements days after a purchase while hiding behind the pretense of an ATM withdrawal.

As David N. Tente, executive director of the ATMIA (the global ATM trade group), told American Banker: cashless ATMs are “very harmful” to the legitimate ATM industry. “These are point-of-sale terminals that are handling retail sales transactions as if they were ATM withdrawals. All of which violates network and processor rules.”

The SDNY Precedent: Eaze and the First Domino

In March 2020, the U.S. Attorney’s Office for the Southern District of New York (SDNY) unsealed an indictment against Hamid “Ray” Akhavan and Ruben Weigand, charging them with conspiracy to commit bank fraud for their roles as consultants to Eaze Technologies, Inc.—the California-based cannabis delivery platform once dubbed the “Uber of weed.” The scheme, running from 2016 through 2019, involved the creation of phony online merchants—fake companies purportedly selling dog products, diving gear, carbonated drinks, green tea, and face creams—to disguise over $150 million in cannabis credit and debit card purchases from U.S. banks, Visa, and Mastercard.

Eaze’s former CEO, James Patterson, pleaded guilty to one count of conspiracy to commit bank fraud in February 2021. He admitted working with Akhavan and Weigand to conceal the nature of the transactions because he “understood that if banks were aware of the nature of the transactions they would not allow them.”

In March 2021, a jury convicted both Akhavan and Weigand following a four-week trial before U.S. District Judge Jed S. Rakoff. In June 2021, Akhavan was sentenced to 30 months in federal prison and ordered to forfeit $17.1 million. Weigand received 15 months and forfeited $384,000.

Manhattan U.S. Attorney Audrey Strauss: “This massive fraud undermined the fundamental integrity of the U.S. financial system, which relies on banks’ ability to identify the nature of the transactions they process.”

Visa Strikes Back: Secret Shoppers and $950,000 Fines

In December 2021, Visa issued a compliance memo warning it was “aware of a scheme where POS devices marketed as ‘Cashless ATMs’ are being deployed at merchant outlets and are operating in violation of the Visa Core Rules.” Mastercard followed with a similar warning in July 2023.

Visa deployed a secret shopper program—sending undercover agents into dispensaries to conduct test purchases. Between January and March 2024, Visa’s secret shoppers identified over 100 locations linked to Trulieve Cannabis Corp. using cashless ATMs through Switch Commerce and Pueblo Bank & Trust.

Visa fined Pueblo Bank & Trust $950,000. Pueblo passed liability to Switch Commerce. Switch paid $250,000—then sued Trulieve in February 2025 in Arizona state court, alleging fraud, racketeering, and conspiracy. The lawsuit revealed that at least 149 other Trulieve-linked terminals had already been terminated for similar violations before the Visa audit even began. As of September 2025, the case remains active before Maricopa County Judge Dewain D. Fox.

Whispers of Indictments: What’s Coming Next

Since the Eaze convictions, industry insiders have been whispering about the next wave of federal enforcement—and sources tell Regulated Green those whispers have grown louder.

The SDNY prosecution established a clear template: disguising cannabis transactions to deceive banks constitutes bank fraud under 18 U.S.C. § 1349, carrying a maximum sentence of 30 years. The cashless ATM model is, by multiple experts’ estimation, an even more deliberate and systematic version of the same underlying fraud—with the added elements of interchange theft, consumer fee exploitation, and BSA reporting evasion.

Multiple sources pointed to potential involvement of the Department of Justice’s Bank Integrity Unit and investigations into forged or misleading bank transparency letters used by ISOs to secure sponsor bank relationships. Lawsuits like Switch Commerce v. Trulieve are creating a paper trail. Civil discovery, sworn depositions, and internal communications between ISOs, dispensaries, and sponsor banks are entering the public record.