Monthly Archives: March 2026

Gas station hero stops crypto kiosk scams, again and again

Bob Sullivan

Once in a while, a human being does the right thing and you wonder why it took so long

I’ve long held the opinion that the only real use case for cryptocurrency is fraud; we can debate that.  Crypto kiosks, on the other hand, leave little room for discussion.  These ATM-like machines you’ll find in gas stations and convenience stores just make it easy for criminals to steal hundreds of thousands of dollars from victims. They have little other purpose.  No sane person would use the machines for a normal cash-crypto conversion; the fees are too high.

I talk to scam victims every week and for the past 18 months or so, nearly every story ends with a tragic scene of a victim shoving $100 bills into one of the Crypto ATMs.  Generally, these are crypto novices who spend a half-hour or more nervously shoving their life savings into these machines, bills getting spat back at them like a misbehaving vending machine, as onlookers avert their eyes.  Victims often believe they are minutes from being arrested on an outstanding warrant, or about to have all their cash stolen in some kind of bank conspiracy. It doesn’t matter why — they are being manipulated by crime gangs using AI tools, behavioral science, and teams of experienced worker bees.

But all that was no match for Eric Stewart, a gas station employee in small-town Tennessee who is a genuine digital age hero in my book.  Not long ago, Eric noticed a woman named Ellen walk frantically into his store. She was chattering on her cell phone and looking around nervously for the crypto kiosk. She also had $6,200 in her hands.  A few minutes earlier, Ellen had received a phone call from the county sheriff saying she’d missed a court hearing about her PPP loan, and there was a warrant out for her arrest. The caller knew exactly how much Ellen had borrowed through that pandemic-era program and demanded she repay half of it immediately — via bitcoin.

Eric didn’t avert his eyes, the way so many people do in the stories I hear. Instead, he stepped right in front of Ellen and confronted her. Here’s the scene, as told in our podcast, The Perfect Scam.

Eric Stewart: And that’s when I said, my very first question is, “Do you know who you’re talking to?” She said somebody said there’s a warrant out for her. A warrant? Yeah, and I said, “No ma’am,” I said, “No.” I said, “You can go to the police station. There’s no way that the money going to a Bitcoin machine is going, that’s not how you pay this. That’s not, that’s not how that gets paid. There’s, that’s not the form of payment that you would pay for something like this.”

Bob: And then Eric tries to be even more direct.

Eric Stewart: I was like, “Please, just hang up the phone. Just hang up the phone.” I said, “If it is a warrant, you can go to the police and ask them if there’s a warrant and everything.”

Bob: Ellen remembers looking up from her phone to listen to Eric.

Ellen: And then the manager came over and said, “Stop, that’s a scam. Don’t put any cash in that machine.”

Bob: Wow! That’s very dramatic.

Ellen: Yeah. The way I remember it, he, he just came over and said, “If they’re asking you to put cash in that machine, it’s a scam. Don’t do it.”

Bob: Wow.

Bob: So Ellen looks down at her money, back down at her phone, and tries to tell Karen what’s going on.

Ellen: On the phone I said, “The manager here is telling me this is a scam.” And she wasn’t even there anymore ’cause she could hear him talking to me.

So, Eric saved Ellen that day.  And you can probably already guess, this wasn’t the first time. Eric often notices agitated customers on their phone headed for the kiosk in his store, and stops them.  He does so in the gentlest way possible — after all, these people are scared and carrying a lot of money. In the episode, you’ll enjoy his homespun wisdom about how he does it. And you’ll enjoy his great accent. But more than anything, I hope you’ll enjoy his sense of decency and duty to his community.  He’s so decent, he actually feels regret for the one woman he wasn’t able to stop in time because the store was busy.

While we wait for cities and states to regulate or outright ban these machines (many are!), and we wait for tech companies to do the right thing, we’re going to need a whole bunch more Erics in this world.

Below is a partial transcript of the episode, but I hope you’ll listen to the whole thing.


———————-PARTIAL TRANSCRIPT———————–

[00:14:34] Bob: It was a small moment in time, but it was genuinely a life-changer for Ellen.

[00:14:40] Bob: I wonder if you remember, maybe like her facial expression when suddenly it dawned on her that, that yes, this was a scam? Have, do you remember anything like that?

[00:14:47] Eric Stewart: Yeah. Her face did change. And as I’m sitting there, exactly I could see, you’re exactly right, her face did change when it was coming to her an understanding of things that me and her were speaking to, making her understand that this is a scam and bringing obvious steps into this. So yeah, her face went from like confused and oh my goodness, and like, you could see a little bit of shock and the realization in her face. But yeah, I could see the relief on her face too right there at the end when she was leaving. Oh, more or less like I probably don’t have a warrant on me. I can’t believe I almost got scammed, but also that I don’t have a warrant out for me, I’m not going to lose… I had to lose all this money, spend all this money on what she thought she needed to do. The relief on her face when she left was, was a huge difference from when I first had approached her.

[00:15:49] Bob: Not only does Eric save Ellen from having a lot of money stolen; he cares for Ellen’s fragile emotional state too.

[00:15:57] Ellen: I just felt so foolish.

[00:15:59] Bob: Oh.

[00:15:59] Ellen: Really, and Eric was like, “It just happened to two other people here this morning.” He told me that.

[00:16:05] Bob: Wow!

[00:16:05] Ellen: He just said, “It happens to everybody.” He said or, “It could happen to anyone. You don’t feel bad.” ‘Cause I was saying, I feel so foolish. (chuckles) I can’t believe I almost put $6000 in this machine, and so he was just really nice, a nice guy.

[00:16:21] Bob: Five minutes out of his day or whatnot, but it really was a life-changing thing for you, right?

[00:16:26] Ellen: Absolutely, absolutely. I love Eric. I don’t hesitate at all to go into Kwik Mart anymore; you know what I mean?

[00:16:33] Bob: Eric, rightly so, enjoys feeling like he’s done something for the community.

[00:16:38] Bob: That must feel great for you.

[00:16:40] Eric Stewart: Yeah, it does, it does. It really does, and I remember, I don’t think I said anything to my wife about it, till the end of the day I was, oh yeah, by the way… But to me it’s like, it’s just, ’cause the way I think about it, what if that was your family member? What if that was your grandma, your aunt, you know your mother, you know, your neighbor, you know your best friend? Why would you not, why would you not help another person in need, ’cause that is someone’s grandma, that is someone’s mom, aunt, sister, relative, neighbor; they’re all those things. And I wouldn’t, why would you not want to help that person, when it takes a couple minutes, that’s it.

[00:17:20] Bob: But he didn’t even realize the depth of the trouble he saved Ellen from until I told him. Ellen would have had to make monthly payments with interest to pay back that $6200 she borrowed from her HELOC.

[00:17:34] Bob: So she didn’t have that money. She had to take out a loan to have that money.

00:17:38] Eric Stewart: Oh wow.

[00:17:39] Bob: She would have had years of $200 a month payments or whatever in addition to everything else. You really, it’s a big deal what you did for her.

[00:17:47] Eric Stewart: Wow, that’s amazing. That makes me feel even better now. Hah. That’s awesome.

[00:18:52] Bob: Yeah.

[00:18:53] Eric Stewart: Wow, that I was able to help that, prevent that. Wow.

00:18:57] Bob: Yeah, she had a HELOC, and so she borrowed money out of the HELOC in order to get the $6000. That would have been a years’ long problem for her that you stopped.

[00:18:04] Eric Stewart: Yeah, and stress especially if she’s on a fixed income. I know she was a little bit older, I don’t know how old she is and or anything like that. I know a lot of people are just living off of one check a month trying to survive, and then that stress added more. Wow, that would have been a lot more stress, yeah, wow. I’m going, God had put me there on purpose, for that, at that moment. Absolutely.

[00:18:29] Bob: Maybe you can tell from Eric’s matter of fact tone of voice, this wasn’t his first crypto ATM rodeo.

[00:18:37] Bob: This isn’t the only time you’ve stopped other people from doing this too, right?

[00:18:41] Eric Stewart: That’s correct, yeah.

[00:18:42] Bob: How many do you think?

[00:18:43] Eric Stewart: Easily two more, easily two more after that. And the last one, he was, I assume a spouse, and I’d had done the same thing. And I said, “Sir, just…” He was fighting me on it. He really was. And he moved the phone away from his cheek, and I was seeing on there, I said, “Sir, your phone for caller ID says, ‘SPAM RISK.’ It says on your phone just ‘SPAM RISK.'” I said, “Please just hang up.” And he fought me too. He had walked out that door. I told his wife, I said to whoever she was, I was like, “Hey…” She said, “I’ve been trying.” I said, “Please, just hang up that phone. Just get that phone from him and hang it up ’cause I promise they’re not going to call back.” I think he; he didn’t do it because there’s not that many of those ATMs or machines around, those Bitcoin machines. There’s not a lot of them.

[00:19:33] Bob: How did Eric learn to be so attuned to potential crypto ATM scams? Well, he listened.

[00:19:41] Eric Stewart: How I learned about this was, I had a elderly customer, unfortunately it’s been a lot of elderly people, same scenario was happening, and a customer had said, told us, he goes, “Hey, whoever that is over there, she been over there talking to, that’s a scam, ’cause I could hear the conversation on the phone going back and forth. That’s a scam.” And so that’s how I got the information on figuring out how it’s a scam just learning from that right there. And I just used my intelligence and common sense and put things together, hey, y’all, okay, this is a scam.

[00:20:15] Bob: But the first time you saw this, somebody actually tipped you off that they had heard the conversation and it was a scam.

[00:20:19] Eric Stewart: Yes, sir. She actually fought me.

[00:20:22] Bob: Fought you. Wow.

[00:20:24] Eric Stewart: Yeah, yeah. “Ma’am,” to the customer and I was like, “alright, since I work here, I’ll approach her.” And she goes, “No.” I said, “Do you know who you’re talking to?” She goes, “No, but it’s okay. I know what I’m doing.” And I was like, “Well someone overhead and said that you’re, you know, that you’re being scammed.” I was like, “Do you truly know who you’re talking to on the phone?” And she really fought me. I sat there and asked her a couple of questions and tried to use red flags, I tried to use, I can’t remember the question was, a red flag question is I think there is something there, “If you don’t know who you’re talking to, do, are you sure you should be doing this and putting that money in there?” And luckily, her husband had been sitting out in the car. I don’t know; this was a great scammer, whatever he or she had told this lady to actually convince her husband as well. These people are super topnotch. It goes from you leaving your destination where you’re at, physically going to the bank and withdrawing this cash, probably with a bank teller because it’s a couple thousand. I don’t know what the limit is on the ATM, I’ve never pulled, tried to attempt to pull that much money out, and they go from the bank to the Bitcoin machine and this whole time this is fighting traffic on the traffic, could easily, we could be at an hour now, they’re on the phone.

[00:21:45] Bob: Yeah.

[00:21:46] Eric Stewart: By the time we get to the Bitcoin machine, that’s an hour conversation easily, you know, so when I left it, I told her husband, I said, “Hey, y’all, that’s a scam that’s going on with your wife and everything,” and he goes, “I figured,” you know. “You might want to stop her.” And he went in there. I don’t know what happened, ’cause I was leaving for the rest of the day and hopefully they didn’t go through, or the minimum.

[00:22:09] Bob: But she ultimately didn’t believe you. She believed the person on the phone.

[00:22:13] Eric Stewart: Yeah, yeah, that person was really good. Cause for her husband, for her to defy her husband who was with her as well, to go to the bank and had gotten that far. That person, unfortunately, they are really good at their job.

[00:22:28] Bob: Do you have, ’cause one of the, I think, really important things you’ve mentioned is that when somebody comes in and they’re upset obviously, and they’ve got a lot of cash in their hands, they’re nervous, and so you’re very careful with how you approach them, right?

[00:22:43] Eric Stewart: Absolutely. Usually they have a phone in their hand, if it’s females, it’s going to be in the purse. The gentlemen, unfortunately, he had those little envelopes that you get from the bank, and you could see it in his pocket hanging out a little bit. I understand there was a lot of money, so I easily give him the space and let him know I’m not trying to rob you or anything, but I let him know I’m aware of the situation and of what’s going on. But yeah, most of them are just, they’re on the phone just like everyone else is, and but when they get to the machine they find it really easy, it’s right next to the ATM machine, so this is just like an average person coming in on the phone, but I wouldn’t say that they was hanging, having the money in their hands and all that, but yeah, I definitely give him the space. I give everyone the space ’cause you don’t know, so some stranger’s walking up to you. And you had a machine that either you put money in or you take money out of, so obviously, you want to make them feel, I want to make them feel safe around me.

[00:23:44] Bob: So Eric has learned to approach potential victims with great care.

[00:23:49] Eric Stewart: And I try to pull a flashlight over their head, let them think, I try to let their mind, not me tell them, because me telling them is not going to mean nothing because these scam people are smart. But let me alert them and let their senses say “Hey, wait a minute.” I try to use easy language, understandable language because obviously there’s a lot going through this person’s mind; fear, anxiety, I’m pretty sure, a little bit of shock of “Hey, what is really going on?” So I’m sure this person’s feeling all these emotions so I try to make everything as simple worded, for them to understand that “Hey, yeah, you know what? Let me stop this and not do this.”

[00:24:35] Bob: You are natural at the psychology of the situation. We hear all the time when family members say, “That’s a scam” that people don’t listen. Because sometimes when you’re that direct with someone in that state of mind, they reject it, but you have described it as shining a light over their heads so they can figure it out themselves. How did you get so smart about psychology?

[00:24:55] Eric Stewart: I don’t know. Like I said, I’m a people observer, and uh, I was in management in the fast-food industry for many years.

[00:25:04] Bob: Aha.

[00:25:05] Eric Stewart: And I noticed every employee is different. Some, you don’t have to say nothing to, they just do a great job. Some, you have to pat them on the back. Some you just have to slowly guide them. And then others, you have to tell them, “Aw, man, that’s amazing. Great job!” ‘Cause they need to hear that. Everyone’s different in the workforce and just, so I observed that and just noticed that. And I guess I used that, me watching people, working with people, understanding how they work and I just use my intelligence to guide me through those situations, scenarios with them.

State of Third-Party Risk Assessments

Organizations across many industries increasingly believe their Third-Party Risk Management (TPRM) programs are mature. The data in the ProcessUnity State of Third-Party Risk Assessments 2026 tells a more complex story.

While most organizations have established assessment processes, policies, and frameworks, the data from our 1,465 respondents uncovers that many have not achieved true program maturity, and the gap between perception and reality is growing.

That gap has a measurable cost. Organizations are experiencing frequent third-party breaches, prolonged assessment cycles, slow vendor responses, incomplete remediation, and persistent blind spots across their third-party ecosystems. In fact, organizations report experiencing an average of 12 third-party breaches per year, signaling that third-party risk is not an edge case, but a recurring operational reality. These outcomes highlight a critical truth: having processes in place is not the same as operating a mature, scalable, and effective TPRM program.

Ponemon Institute surveyed 1,465 IT and IT security practitioners in the US (632 respondents), Asia-Pac (402 respondents) and EMEA (431 respondents) who are involved in their organizations’ approach to assessing data risks created through outsourcing business functions to third parties. The purpose of this research is to gain insights into how organizations assess and minimize risks associated with both direct and indirect relationships with third parties. This includes identifying vulnerabilities and mitigating potential operational, reputational, financial and compliance risks.

On average, organizations have one data breach or security incident each month that was caused by a third party. Organizations represented in this research report they have experienced an average of 12 data breaches or security incidents caused by third parties in the past year. The two most serious consequences of these events were operational disruptions (64 percent of respondents) and financial loss (52 percent of respondents).

The following research findings illustrate the challenges of preventing third-party data breaches and security incidents. 

  • Few organizations have a budget dedicated to their TPRM programs. Resources are important to supporting organizations’ efforts to achieve a proactive or optimized level of maturity. Only 37 percent of respondents say their organizations allocate funding specifically for the TPRM program. Of those organizations, the average annual budget is $3.1 million.  
  • Reliance on manual and inconsistent assessments can result in a small percentage of third parties being assessed. Organizations have an average of 2,643 third parties in their portfolio and an average of only 36 percent of these third parties are assessed to determine risks and vulnerabilities.
  • The maturity of most TPRM programs is low. Fifty-two percent of respondents say their programs are reactive and assessments are still manual and inconsistent (30 percent) or ad hoc with only a few defined processes in place for third-party assessments. Less than half of respondents rate their TPRM program maturity as proactive which means assessments are standardized and repeatable for most third parties with defined policies, tools and remediation processes (29 percent) or optimized which is defined as the TPRM program being fully embedded in business operations using automation, advanced analytics and continuous monitoring to manage vendor risk proactively (19 percent). 
  • The IT or IT security functions are most responsible for third-party risk assessments, not the TPRM team. To have an optimized and mature TPRM program, automation, advanced analytics and continuous monitoring is key. For this reason, many organizations may be assigning responsibility for assessments to IT security/cybersecurity (30 percent of respondents) or IT (22 percent of respondents). Only 20 percent say the TPRM team is most responsible for conducting assessments. 
  • Assessments can be a drain on staff’s time and backlogs are a reality for many organizations. Outsourcing one or more assessment processes can be a solution to this problem. Forty-three percent of respondents say their organizations outsource part of the assessment process. Of these respondents, 59 percent say collection or monitoring is outsourced. 
  • To understand the extent of third-party risks, more organizations should measure the TPRM’s effectiveness. Fifty-three percent of respondents believe their TPRM assessments are very effective. However, less than half of respondents (49 percent) measure effectiveness. Of these respondents, 49 percent measure the increase in assessments completed, 37 percent say the metric used is the percentage of complete/accurate assessments and 36 percent say the metric used is sufficient staffing. 
  • Understanding the initial level of risk is a critical first step in a comprehensive third-party risk management program. This allows organizations to then implement appropriate controls to reduce third-party risk to an acceptable level.Fifty-two percent of respondents say their organizations use the inherent risk process to determine the frequency of third-party risk assessments. Of these respondents, 53 percent say they scope their assessment questionnaire or use a specific questionnaire based on the third-party’s inherent risk. 
  • Most organizations use homegrown/IT built tools or spreadsheets as part of the assessment. Sixty-seven percent of respondents say they rely upon homegrown/IT built tools followed by spreadsheets (64 percent of respondents). Sixty-one percent of respondents say they use a GRC platform and 58 percent of respondents say their organizations use TPRM platforms. 
  • Only 45 percent of respondents say their organizations use independent ratings of the third parties’ cybersecurity and risk posture as part of the assessment. Mostly used are SLAs (62 percent of respondents) and vendor documentation of their practices and policies to assess potential risks (51 percent of respondents). 
  • Despite lacking trust in fourth parties, few organizations assess the risk. Despite not having complete trust in visibility into fourth parties that could impact their companies, only 42 percent of respondents say their organizations assess fourth-party or subcontractor risk (23 percent) or only for critical suppliers (19 percent). 38 percent of respondents either have no trust (22 percent) or only slight confidence with minimal assurance with significant doubts (16 percent). Only 31 percent say they are highly confident with complete trust in visibility. Further, only 41 percent of respondents say they receive alerts from third parties to any security incidents generated by fourth parties in the last 12 months. If they did, it was an average of 15 alerts were received in the past year. 
  • Organizations are at risk because third-party assessments take a long time and often require further attention or remediation. Sixty percent of respondents say it can take 4 months to more than 12 months to complete just one assessment. Only 37 percent of respondents say it takes the team less than 8 hours (10 percent) or between 8 to 40 hours (27 percent). An average of 43 percent of third-party responses require follow-up or remediation and it can take an average of 6 days to remediate issues found during a third-party assessment with only one-third party.
  • Sixty percent of respondents say they wait for a vendor’s response to the questionnaire in 4 months to as long as more than 1 year. An average of 27 percent of third parties do not respond to questionnaires. Forty-five percent of respondents say they receive updates on changes in vendor risk posture only yearly (27 percent) or never (18 percent).
  • Due to the time and amount of effort because of mostly manual processes, 40 percent of respondents say they currently have a backlog of third-party assessments. The reasons for backlogs are incomplete information from vendor (67 percent of respondents), lack of vendor response (64 percent of respondents) and limited resources such as lack of budget, technology and in-house expertise (62 percent of respondents). 
  • Only 16 percent of respondents say that 90 percent to 100 percent of the third parties that required remediation are completed. During the onboarding process, 44 percent of respondents say it is between 26 percent to more than 50 percent of third parties that require remediation activities to meet their security and privacy requirements. The primary reasons are resource constraints (66 percent of respondents), technical dependency on another team or provider (59 percent of respondents) and data access uses (58 percent of respondents).
  • AI tools as part of the TPRM program may help organizations deal with the challenges revealed in this research. Forty-four percent of respondents have either fully (19 percent) or partially adopted AI (25 percent) for TPRM programs. Only 19 percent of respondents say there are no plans to adopt AI. AI is seen to address many of the challenges faced in identifying risks and inefficiencies. Fifty-three percent of respondents say the primary benefit of using AI is that it frees staff for higher-value work. Other benefits are real-time intelligence to identify vulnerabilities (48 percent of respondents) and management of TPRM programs (42 percent of respondents). 

Part 2. Key findings

This section of the report presents an analysis of the global findings. The complete research results are shown in the Appendix. The report is organized according to the following topics.

  • Background on Third-Party Risk Management (TPRM) programs
  • Threat assessment operating models and methods
  • Challenges in conducting third-party risk assessments
  • Regional differences

To read detailed key findings and the rest of this report, visit  ProcessUnity’s website.