Senator Lummis Says Senate Crypto Bill Could Target ATM Fraud Risks

Senator Cynthia Lummis (R-WY) has signaled that the Senate's pending cryptocurrency market structure bill could include provisions addressing fraud risks at Bitcoin ATMs — the first time a senior lawmaker has publicly connected federal crypto legislation to the growing wave of state-level enforcement actions against the industry. The comment came in response to a report about crypto ATM fraud in her home state of Wyoming, where — like the rest of the country — scam victims are increasingly being directed to Bitcoin ATMs to send irreversible payments to criminals. If federal legislation imposes new fraud-prevention mandates on Bitcoin ATM operators, it would represent a seismic shift from the current patchwork of state money transmitter laws and AG enforcement actions that have defined the regulatory landscape.

Why This Matters

Until now, the regulatory crackdown on Bitcoin ATM operators has been driven almost entirely by state attorneys general. Iowa, Massachusetts, Missouri, and Washington, D.C. have all filed lawsuits or issued investigative demands targeting operators like Bitcoin Depot, CoinFlip, and Athena Bitcoin for allegedly facilitating scam transactions and hiding fees. Federal legislation has remained conspicuously absent from the picture. Lummis's comment — while vague on specifics — is the clearest signal yet that Congress may attempt to create a federal framework that applies to Bitcoin ATM operators, not just the exchanges and token issuers that have dominated the market structure debate.

Key Context:

This is the first public statement from a senior federal lawmaker connecting crypto market structure legislation to Bitcoin ATM-specific fraud risks
Lummis chairs the Senate Banking Subcommittee on Digital Assets — she has direct influence over what goes into the bill
Wyoming has been one of the most crypto-friendly states in the country, making this acknowledgment of fraud risk particularly significant
The FTC reported consumers lost over $114 million to Bitcoin ATM scams in 2023 alone
State-level enforcement is currently the only active regulatory tool against Bitcoin ATM fraud

The State-Level Backdrop

Lummis's comments land in the middle of the most aggressive coordinated regulatory crackdown in Bitcoin ATM history. Attorneys general in at least four jurisdictions — Massachusetts, Iowa, Missouri, and Washington, D.C. — have filed lawsuits or issued civil investigative demands targeting major operators including Bitcoin Depot, CoinFlip, Athena Bitcoin, Byte Federal, and RockItCoin. The core allegations across these state actions follow two patterns: **Scam facilitation:** State AGs allege operators profit from transactions where victims — disproportionately elderly consumers — are being directed to Bitcoin ATMs by third-party scammers. The Massachusetts AG found that the median victim using Bitcoin Depot machines was 67 years old, with scam rates among high-value customers exceeding 80–90%. The DC AG's lawsuit against Athena Bitcoin found a median victim age of 71. **Fee opacity:** Multiple lawsuits allege "drip pricing" — displaying one Bitcoin price on screen while adding undisclosed fees of 15–25% at confirmation. Massachusetts specifically alleges Bitcoin Depot charged fees exceeding its own posted 23% cap in more than 7,000 transactions.

States with active AG enforcement actions

80–90%

Scam rate among high-value transactions (per state AGs)

Major operators hit by Missouri CIDs in Jan. 2026

67–71

Median victim age (MA and DC lawsuits)

These state actions have been effective but fragmented. Each state applies its own consumer protection statutes, its own fee disclosure standards, and its own enforcement priorities. A federal bill could either create a uniform national standard — which operators might actually prefer — or layer additional requirements on top of existing state mandates.

The Federal Preemption Question

The most consequential question isn't whether the Senate bill mentions Bitcoin ATMs — it's whether it preempts state law. If a federal crypto market structure bill establishes minimum fraud-prevention and disclosure standards for Bitcoin ATM operators, states could argue their own laws still apply (as they do with federal banking regulation in many contexts). Alternatively, Congress could include a preemption clause that would effectively take the enforcement baton away from state AGs. This is where industry interests diverge sharply. Operators facing lawsuits in multiple states might welcome a single federal standard — even a strict one — over the current reality of defending against four or five simultaneous state actions with different legal theories. Consumer advocates and state AGs, meanwhile, would likely resist preemption, arguing that state enforcement has been the only mechanism holding operators accountable. Lummis's own positioning makes prediction difficult. Wyoming under her advocacy has been the most crypto-friendly state in the nation, pioneering special-purpose depository institution charters and favorable digital asset regulations. But she's now acknowledging fraud risk in her own backyard. That tension — between promoting crypto innovation and protecting consumers from demonstrable harm — is likely to shape whatever provisions emerge.

What Lummis Didn't Say

It's worth noting what's missing. Lummis did not release draft language, cite specific provisions, or commit to including Bitcoin ATM-specific rules in the bill. "Could address" is doing a lot of heavy lifting in her statement. The Senate's market structure bill has been through multiple iterations already, and Bitcoin ATMs are a tiny piece of a much larger legislative puzzle that includes exchange regulation, token classification, and SEC/CFTC jurisdictional boundaries. Her acknowledgment of ATM fraud risks in her own state suggests the political calculus is shifting — the volume of consumer harm reports is becoming impossible to ignore even for crypto's strongest advocates in Congress.

What Federal Legislation Could Change

Bitcoin ATM operators currently operate under a patchwork of state money transmitter licenses, FinCEN registration requirements, and — increasingly — state consumer protection enforcement. There is no federal statute specifically governing Bitcoin ATM fee disclosures, scam prevention obligations, or transaction limits tailored to the kiosk format. Federal market structure legislation could standardize:

Fraud prevention protocols: Mandatory hold periods, transaction limits, or enhanced warnings for high-risk transactions
Fee disclosure: Standardized pricing displays to eliminate drip pricing
Reporting requirements: Uniform suspicious activity reporting to federal regulators
Consumer redress: Federal mechanisms for scam victims to recover losses

The difference between a requirement to "display fees prominently" and a requirement to "obtain affirmative consumer acknowledgment of total cost including markup before each transaction" is enormous in practice. The bill is still being drafted, and how these provisions are worded will determine whether they have real teeth.

What This Means for Consumers

What Bitcoin ATM Users Should Know Right Now:

Nothing has changed yet. A senator's comment about a pending bill is not a law. No federal statute currently provides Bitcoin ATM-specific consumer protections.
If someone tells you to go to a Bitcoin ATM to pay a bill, avoid a warrant, or claim a prize — it is a scam. No government agency, utility company, or legitimate business collects payment via Bitcoin ATM. Period.
State protections are your best tool today. If you've been scammed at a Bitcoin ATM, file complaints with your state attorney general, the FTC, and local law enforcement.
Recovery is unlikely. Bitcoin transactions are irreversible; victim restitution remains rare even in successful AG cases. Prevention is your strongest defense.
Visit our consumer protection resources for step-by-step guidance on reporting fraud and understanding your rights.

What This Means for Operators

Operators should treat Lummis's comments as an early warning, not a fire drill — but federal legislation is the scenario every Bitcoin ATM operator should be planning for. Here's what to watch: **Compliance infrastructure is now a competitive advantage.** Operators with robust KYC, fraud monitoring, and fee disclosure systems will be better positioned to meet whatever federal standards emerge. Operators who have been slow to implement fraud prevention — or who have actively resisted state AG demands — face the possibility of federal requirements they can't easily meet. **Don't assume federal law will save you from state actions.** Even if the bill passes with Bitcoin ATM provisions, it's unlikely to retroactively shield operators from pending state lawsuits. The Massachusetts, Iowa, Missouri, and DC cases will continue regardless. **The lobbying window is open.** The bill is still being drafted. Industry groups and individual operators have an opportunity to shape what "addressing specific risks" actually means in legislative text. **Watch for disclosure mandates, transaction limits, and mandatory scam-screening requirements.** These are the three most likely categories of federal intervention, based on the pattern of state AG complaints and the FTC's existing guidance on crypto fraud. Operators who haven't already upgraded their fraud prevention and fee disclosure practices in response to the state-level enforcement wave shouldn't wait for Congress to tell them to do it. The industry's track record of self-regulation — or lack thereof — is what brought political attention in the first place. Our operators directory tracks trust scores based on public enforcement records, reflecting the wide gap between operators who've invested in compliance and those who haven't.

What Comes Next

A senator's comment to a local reporter is a long way from a signed law. The Senate's crypto market structure bill faces a difficult path — competing committee jurisdictions, election-year politics, and deep disagreements about how much regulation the crypto industry should face. Bitcoin ATM-specific provisions, if they appear at all, could range from a single disclosure mandate to a comprehensive licensing regime. The specific question to track: does Bitcoin ATM fraud survive the drafting process as a named concern, or does it get folded into broader "consumer protection" language that may or may not reach the kiosk industry? Meanwhile, state attorneys general aren't waiting. The Missouri investigation is still expanding, Massachusetts's case against Bitcoin Depot is advancing, and more states are likely to follow. If Congress does act, it will be legislating on top of enforcement actions already in motion — not instead of them. But the signal matters. When a senator who chairs the Digital Assets subcommittee and represents the most crypto-friendly state in America says Bitcoin ATM fraud needs a federal response, the industry should take note. The question operators need to ask themselves: are they ready for Washington's version of what Missouri, Massachusetts, Iowa, and DC have already started?

Senator Lummis Says Senate Crypto Bill Could Target Bitcoin ATM Fraud Risks