The Denominator Scam: How Iowa's 98%, DC's 93%, and AARP's 92% “Scam” Stat Got Laundered Into a Push for Bitcoin ATM Bans

The campaign against Bitcoin ATMs has a statistics problem.

Iowa says 98% of certain transactions were scams. Washington, D.C. says 93%. AARP says 92% of older adults want laws against the kiosks. Those three numbers are now driving statewide bans, transaction caps, and federal proposals.

Set them next to the only datasets that actually measure the whole market — TRM Labs' blockchain analysis at ~1.2% illicit volume across the cash-to-crypto industry in 2023, and the FBI's 2025 IC3 data showing Bitcoin ATM losses at ~2.93% of total U.S. cryptocurrency fraud and ~1.6% of all U.S. cybercrime — and the gap is one to two orders of magnitude. Both sets of numbers are accurate. They measure different things.

The political headlines describe enforcement funnels: complaint intake, victim outreach, single-operator allegations in a single city during a single early window, and a survey question asked of an audience that had never heard of the technology. They do not describe how the average customer uses a Bitcoin ATM. That is the denominator scam — and it is now embedded in the findings of state bills, congressional testimony, and town-meeting warrants from Hawaii to Massachusetts.

None of this means fraud isn't real. Bitcoin ATM scams happen, individual losses are severe, and bad operators exist. The argument is narrower: when government investigators start with suspected victims, high-dollar users, police reports, and self-reported scams, they find a lot of scams. That is correct enforcement targeting. It is not a market fraud rate. Cited as one, it has now become the basis for prohibitions that will not solve the underlying social-engineering scams — they will simply move to other rails.

The 90%+ Myth

Three numbers — 98%, 93%, and 92% — are doing almost all the political work behind the current push to ban or sharply restrict Bitcoin ATMs. Side-by-side with the federal full-market data, the picture flips: the headline figures each measure a narrow, complaint-enriched slice and cannot be generalized; the full-market figures put Bitcoin ATM losses well under 3% of U.S. crypto-fraud losses and under 2% of all U.S. cybercrime losses.

The Flawed Statistics Driving the Bans

The Real Market Statistics

The first three numbers describe slices: a state's victim-reporting funnel, one operator's early kiosks in one city, and a survey of mostly unfamiliar respondents. The last describes the whole pie. Stack them on top of each other as if they are the same kind of measurement and you have a category error — one being marketed as a fraud-rate indictment of an entire industry.

Iowa's 98% Is Not a Usage Rate

We covered Iowa's lawsuits against Bitcoin Depot and CoinFlip in detail. For this piece, the key point is narrower: 98.16% describes "money Iowans reported sending" through Bitcoin Depot — and 94.92% through CoinFlip — drawn from victim outreach, consumer complaints, and police reports. Read the phrase carefully: reported sending. That is an enforcement-funnel denominator, not a market sample.

The selection effect compounds further down the petition: the Iowa AG alleged it spoke to 34 of the top 50 Bitcoin Depot users in Iowa by transaction size, and all 34 confirmed they used the machines because of a scam. High-dollar, repeated, urgent transactions are exactly the pattern scam victims generate. Starting the investigation at the top of the volume distribution structurally tilts the result toward the highest-risk subset — which is correct enforcement targeting and incorrect industry inference.

The Outreach Email Shows the Bias in Miniature

The Iowa Attorney General's outreach to at least one Bitcoin ATM customer illustrates the problem.

In a January 22, 2025 email from Assistant Attorney General James O'Hollearn — Assistant Attorney General for Consumer Protection — the office told a customer it was "looking into the Bitcoin ATM industry" and "interested in learning more about your experience." The email then added: "If you believe you may have been a victim of a scam, we would particularly like to hear from you."

That is not neutral survey language. It is fraud-primed outreach.

The email also offered three paths to respond: reply to the AG's office, call the Consumer Protection Division, or file a consumer complaint. Those are all channels built around problems, complaints, and suspected victimization — not around ordinary lawful use.

The customer who received this particular email had completed a Bitcoin ATM transaction of less than $100. That raises an obvious question: why was a sub-$100 customer swept into an inquiry framed around possible scam victimization? A consumer who bought a small amount of bitcoin for personal use has little reason to respond to an Attorney General's email. A scam victim does. That is self-selection bias — and if the state then counts the people who respond and says, "Look how many were scams," it has not measured Bitcoin ATM usage. It has measured the response rate of people prompted to think about whether they had been scammed.

The Press Conference Was Staged at the Iowa Bankers Association

The announcement was not staged at the Attorney General's office. It was held at the Iowa Bankers Association building in Johnston, with the association's branding behind the speakers and its President and CEO, Adam Gregg, listed among the official speakers — a detail later amplified by the American Bankers Association's Banking Journal. The Iowa AG's original press release announcing the suits has since been removed from the live iowaattorneygeneral.gov site; only the Internet Archive's Wayback Machine still preserves it. Banks are not neutral observers in this debate — Bitcoin ATMs compete with bank rails by letting cash users buy bitcoin without first routing money through a bank account. Announcing the enforcement story from a banking trade association's stage, and then circulating the resulting statistics through banking trade media and aligned consumer-advocacy groups, doesn't prove a conspiracy. It does show alignment.

The DC Athena Case: One Operator, One City, Early Months

We covered D.C.'s lawsuit against Athena Bitcoin separately. The denominator issue here is simple: D.C.'s 93% is an allegation about one operator's machines in one city, not a national Bitcoin ATM fraud rate. The complaint, which Athena disputes, covers a small fleet of kiosks during the operator's early months in the District.

Banking and consumer-advocacy channels now cite the Athena figure as though it were a general fact about the industry — a litigation allegation has become a talking point, and the talking point has become the rationale for statewide restrictions. That is a category error. A complaint about a small kiosk fleet in one city is not an industry usage rate.

AARP Turned Enforcement Stats Into Advocacy Ammunition

AARP has now taken these enforcement-case numbers and folded them into a national campaign for state restrictions on cryptocurrency kiosks.

In an April 2026 advocacy article, AARP wrote that Iowa Attorney General Brenna Bird sued two kiosk operators after an investigation found "at least 95 percent of transactions at their machines were fraudulent," and that D.C. Attorney General Brian Schwalb sued Athena Bitcoin after finding "93 percent of its transactions to be fraudulent."

That is exactly the slippage. Iowa's own fact sheet uses the narrower phrase "money Iowans reported sending," while AARP's advocacy language presents the finding as if it were a transaction-wide fraud rate. D.C.'s figure is an allegation about Athena Bitcoin's machines in one city during an early operating window, but it is now being used as part of a national policy push.

AARP's separate survey of Americans age 50 and older compounds the framing problem. The survey reported that 92% of older adults think laws designed to protect consumers from crypto-kiosk-related fraud and scams are important. But the same AARP report also found that fewer than one in four older adults — just 23% — had even heard of cryptocurrency ATMs or kiosks before the survey. AARP was asking a largely unfamiliar audience whether it supports laws to protect people from criminals using a technology most respondents did not know much about.

The answer was predictable. Ask people whether they support laws to stop criminals from stealing from seniors, and almost everyone will say yes. That is not evidence that the public supports bans, hard caps, or the destruction of lawful cash-to-bitcoin access. It is evidence that people oppose fraud.

From Press Release to Bill Text: A Citation Tracker

The clearest sign that the denominator scam matters is what has happened with these numbers downstream. The Iowa AG's 98% / 95% figures and the D.C. AG's 93% figure originated in two narrow enforcement contexts. They have since migrated into the formal findings sections of state legislation, written testimony before Congress, town-meeting warrants, and Attorney General press releases — cited in each forum as if they were nationally representative measurements of the Bitcoin ATM market.

For the broader policy context, see our January 2026 wave of Bitcoin ATM legislation — fifteen state bills filed in a single month, many leaning on these same headline percentages. Below is a partial map of where those figures now appear in the public legislative record.

Direct Inclusion in Bill Text or Legislative Findings

Formal Legislative and Congressional Testimony

Municipal and Local Legislative Proceedings

State Officials Whose Citation Drove Legislation

The Common Defect

Every citation above shares one feature: none discloses the denominator. The Hawaii bill does not say the 90% figure traces back to a small fleet of Athena Bitcoin kiosks in Washington, D.C. during the operator's first months in the District. The Maryland testimony does not say Iowa's 98% applies only to money "reported sending" by people who contacted the AG's complaint hotline. The Sharon, Massachusetts police detective calls it "an Iowa study" — it was not a study. It was a complaint-intake count compiled during active litigation.

The chain of transmission is now well established:

That is how a litigation press release becomes statutory findings text. And the Minnesota AG's own line — citing the D.C. 93% figure in the same document where his office acknowledges that "there's no consensus on what the percentages look like nationwide" — is perhaps the most candid single sentence in the public record. A regulator deploys the data while simultaneously admitting the data is contested.

The Broader Data Tells a Different Story

Two independent datasets — one drawn from victim complaints, the other from blockchain analytics — both contradict the idea that Bitcoin ATMs are a dominant scam channel. The first comes from the Federal Trade Commission's own consumer-complaint database. The second comes from TRM Labs' on-chain measurements.

Even by Complaint Volume, Crypto Is a Small Slice

The Federal Trade Commission publishes its consumer-complaint data publicly. When you pull "fraud reports by payment method," cryptocurrency does not lead. Credit cards, payment apps, debit cards, wire transfers, and bank transfers all generate substantially more scam reports than cryptocurrency does — and Bitcoin ATMs are only a subset of the cryptocurrency bucket.

Two things stand out. First, by complaint volume, cryptocurrency is the sixth-largest payment method for scam reports — well behind credit cards, payment apps, debit cards, wire transfers, and bank-to-bank transfers. Second, the dollar-loss leaderboard is dominated by investment-advice and imposter scams (totaling well over $2 billion in losses in this same FTC pull) — categories where the actual money movement happens through banks, brokerages, and traditional wire rails. If the policy goal is reducing total scam losses, Bitcoin ATMs are not the largest target. They are not even close.

The federal numbers tell the same story even more cleanly. The FBI's 2025 IC3 Annual Report recorded $333.5 million in Bitcoin ATM losses against $11.37 billion in total cryptocurrency fraud losses — meaning Bitcoin ATMs account for roughly 3% of the crypto fraud problem by dollar value, and about 1.6% of all U.S. cybercrime losses. The biggest driver of crypto fraud losses is investment fraud at roughly $7.2 billion — a category where the payment rail is overwhelmingly traditional banking, brokerages, and wires, not Bitcoin ATMs.

This is also worth flagging: Bitcoin ATMs are visible. Cash kiosks are physical, branded, and easy to point at. Wire transfers and Zelle pushes from a victim's bank account are not. That visibility makes Bitcoin ATMs an easier political target than the larger, less-photogenic payment rails — but visibility is not the same as proportional risk.

Critics will correctly note that a roughly $10,000 median individual loss in Bitcoin ATM cases is severe — and severity per victim does justify serious operator-level scrutiny, training of host clerks, real-time fraud interventions, and aggressive enforcement against bad actors. The denominator argument is not that Bitcoin ATM fraud is trivial. It is that a 3% slice of the U.S. crypto-fraud problem — and a smaller fraction of total scam losses — does not warrant policy framed as if it were 98%.

And by On-Chain Measurement, the Number Is Smaller Still

TRM Labs, a blockchain intelligence firm used by financial institutions and law enforcement, found that illicit volumes in the cash-to-crypto industry stood at 1.2% of total volume in 2023. TRM also found that cash-to-crypto services had processed at least $160 million in illicit volume since 2019, and that 79% of 2023 cash-to-crypto illicit volume went to known scam and fraud addresses.

That is a meaningful risk. The cash-to-crypto sector clearly has elevated risk compared with the overall crypto ecosystem, and that justifies serious operator-level scrutiny. But 1.2% is nowhere near 93%, 95%, or 98%. TRM's finding implies the opposite of the political narrative: the overwhelming majority of cash-to-crypto volume is not identified as illicit.

This is the difference between measuring the industry and prosecuting a case. Enforcement cases are supposed to focus on bad facts. Industry-wide policy should not pretend those bad facts are the whole market.

Litigation Is the Right Tool. Bans Are the Wrong One.

To be clear about what we are not arguing: fraud is real, scammers do direct victims to Bitcoin ATM kiosks, and the harm to individual victims is severe. The industry should not minimize any of that. The argument is about which response works.

State attorneys general using existing consumer-protection statutes to sue specific Bitcoin ATM operators is, in our view, the right enforcement model. It is operator-specific. It is fact-specific. It is adjudicated in court, where defendants can challenge evidence, dispute methodology, and be put to their proof. And it correctly recognizes that some operators have been considerably better than others at preventing scam transactions, disclosing fees, training host agents, and screening high-risk wallet destinations — while others have not. A consumer-protection lawsuit can sort those differences out. A statewide cap or a flat ban cannot.

That is exactly why the misuse of the headline statistics is so damaging. The Iowa and DC offices have legitimate, fact-rich cases against specific operators. The press-conference numbers, repackaged as if they describe the whole Bitcoin ATM market, risk burning the very credibility those offices need to win their actual lawsuits. Every time a 98% or 93% figure gets cited as a market-wide fraud rate, opposing counsel — and skeptical legislators — gain another reason to question the methodology behind the underlying enforcement work. Good cases deserve careful numbers.

The alternative being pushed in state legislatures — one-size-fits-all transaction caps, blanket bans, and "dumb" low daily limits applied uniformly to every operator regardless of compliance posture — does the opposite. It punishes the operators who built actual scam-prevention programs at the same rate as the operators who did not. And bans rarely stop the scam; they move it. Before Bitcoin ATMs, fraudsters used gift cards, wire transfers, bank transfers, payment apps, cash couriers, and money mules — channels AARP itself has acknowledged were preferred scam payment methods until scrutiny pushed scammers toward Bitcoin ATMs. If the underlying crime is social engineering, eliminating one payment rail does not eliminate the criminal enterprise. It only changes the extraction method.

Targeted enforcement against bad actors is consumer protection. Industry-wide prohibition based on enforcement-funnel statistics is something else.

What Responsible Regulation Looks Like

There is a serious middle ground between doing nothing and banning the industry. Reasonable safeguards can include:

• Clear, unavoidable fee disclosure before cash is inserted
• Receipts that break out fees, exchange rate, wallet destination, and operator contact information
• Escalated review for high-dollar, repeated, or unusual transactions
• Real-time fraud intervention — live hotlines and operator-side kill-switch tooling empowered to pause transactions in flight, the kind of operator-side prevention design that already exists in the industry
• Delayed settlement or cooling-off periods for first-time high-risk users
• Wallet-risk screening and blocking of known scam addresses
• Live-coaching detection when a user appears to be on the phone during a high-dollar deposit
• Refund rules for operator-retained fees when a scam is reported quickly
• Licensing and examination standards for operators

Those rules target the actual risk: coerced, high-pressure, scam-driven transactions. Bans and ultra-low caps do something different. They punish every user for the conduct of scammers and the failures of the worst operators. That is not consumer protection. It is prohibition dressed up as fraud prevention.

A Ban Backfires: It Doesn't Solve Fraud, It Multiplies It

The deepest problem with a ban is not that it is heavy-handed. It is that it is counter-productive on its own terms. A ban does not eliminate the underlying demand for cash-to-bitcoin conversion. It eliminates the regulated, traceable, KYC-bound way to meet that demand — and pushes everything that remains into channels that are worse on every metric the ban claims to care about.

Cash-to-bitcoin demand is not theoretical, and it is not shrinking — it is growing. Bitcoin's adoption curve continues to rise globally and in the United States, household bitcoin ownership has expanded year over year, and cash remains the preferred payment method for tens of millions of Americans — particularly in unbanked, underbanked, immigrant, and remittance-sending communities. Bitcoin ATMs sit precisely at the intersection of those two trends: rising bitcoin demand and persistent cash usage. The kiosk channel exists because the demand is real and growing, not because it was manufactured. Adults who prefer cash, who lack bank accounts, who do not want to link a bank to a bitcoin exchange, who send remittances, or who simply do not trust online platforms will not stop wanting bitcoin because a state legislature said so. They will buy it from someone. The only question a ban answers is from whom. The choice is not between "Bitcoin ATMs" and "no Bitcoin ATMs." It is between a regulated counterparty with cameras, KYC, transaction limits, SAR filings, blockchain receipts, and a phone number — and an unregulated counterparty with none of those things.

This pattern is well-understood in every other prohibition context. Demand does not disappear when supply is criminalized; it relocates to actors who are willing to operate outside the law. Bans on Bitcoin ATMs will reproduce that pattern. The people who already comply with anti-money-laundering rules, file SARs, run wallet-risk screening, and answer subpoenas are the ones who get pushed out. The people who never complied with anything pick up the demand. Investigators end up with fewer records, not more. Victims end up with less recourse, not more. Scammers end up with the same victims and a less traceable extraction method.

The Local Cost: Small Business and the Tax Base

The other constituency a ban silences is the host. Bitcoin ATM kiosks are placed in convenience stores, gas stations, laundromats, liquor stores, and small grocers — the kind of independent retailers that are increasingly squeezed by chain consolidation, card-network fees, and rising rents. The kiosk pays monthly rent to the host, drives incremental foot traffic, and creates a reason for cash customers to walk in the door. For many small operators, that revenue is the difference between staying open another quarter and not. A statewide ban does not just remove a payment option. It removes a line item from thousands of small-business P&Ls — disproportionately in working-class, immigrant-served, and rural commercial corridors where banking and bitcoin access is already thinnest.

The growing kiosk industry also generates state and local tax revenue: corporate income tax from operators, sales tax on kiosk-related revenue, business and occupation taxes on hosts, and licensing fees in states that already regulate the industry. A ban erases that base. The fraud losses cited in support of the ban, by contrast, are private losses to victims — they are not state revenue. Trading a real, recurring tax base against a category of private harm that, as the federal data shows, will continue to occur on other rails is not a sound public-finance trade.

The honest version of the policy debate is this: a ban does not protect consumers. It rearranges who gets harmed. It shifts demand from a regulated, traceable, KYC-bound, FinCEN-registered counterparty to an unregulated one. It raises prices. It removes evidentiary records that law enforcement actively relies on. It strips income from small-business hosts. It eliminates a state tax stream. And it leaves the underlying social-engineering scams — the actual harm — running on whatever rail is next. None of that is consumer protection. It is the appearance of action substituted for the work of building enforcement-grade safeguards on the rails people actually use.

The Missing Constituency: Lawful Users

The anti-kiosk campaign rarely talks about legitimate users.

Bitcoin ATMs serve people who prefer cash, people without easy access to online exchanges, people who do not want to connect a bank account to a bitcoin platform, immigrants and remittance users, cash-economy workers, privacy-conscious adults, and older users who may find a physical machine more intuitive than a centralized exchange.

Even the Iowa AG's Bitcoin Depot petition acknowledged that Bitcoin Depot publicly describes its customer base as including cash-preferred users, underbanked and unbanked individuals, remittance users, convenience users, and baby boomers who prefer a physical experience over an online exchange. Those uses do not disappear because AARP and banking groups decline to discuss them. They simply become politically invisible.

That is especially important for AARP's own constituency. Older Americans are not just potential victims. They are also adults with property rights, financial autonomy, investment goals, privacy concerns, and the right to use cash to buy lawful assets. A policy debate that treats every older Bitcoin ATM user as either confused or defrauded is not consumer protection. It is paternalism.

Fraud victims deserve protection. Bad operators deserve enforcement. Scammers deserve prison. But lawful users do not deserve to lose access to a financial tool because AARP, state attorneys general, and the banking lobby found a politically useful way to confuse enforcement statistics with market reality.

The Bottom Line