Thirty-five states have enacted some form of crypto ATM regulation since 2023, and 18 of those laws passed this year alone, according to a tracker AARP updated Sept. 14. The wave follows growing recognition among state lawmakers that cryptocurrency kiosks, machines that convert cash into digital currency, have become a common final step in scams that start with a phone call or a text. Indiana went further than regulation in March, becoming the first state to ban the machines outright.
Two tools before the next kiosk deposit: A new state law doesn’t cover every kiosk, but The Senior Fraud Defense & First-Hour Recovery Kit’s family code word and first-hour recovery plan do. Set the family code word before the next kiosk visit →
What the 35-State Count Covers
AARP’s tracker counts 35 states that have passed some form of crypto-ATM legislation since 2023, with 18 of those laws enacted in 2026 alone, a pace that outstrips the three years before it combined. The tracker lists California and Connecticut as the earliest adopters, both enacting laws in 2023, followed by a wave of additional states including Iowa and Nebraska in 2025. The laws vary by state: some cap the amount a new customer can deposit in a single day, some require a kiosk operator to post a fraud warning, and others require a waiting period before a first-time user’s transaction completes. AARP’s tracker groups the 35 states by the year each law was enacted rather than by the specific limit it sets, so two states that passed a law in the same year can still differ sharply in what a kiosk operator is required to do once that law takes effect.
Indiana’s Outright Ban
Indiana took a different approach than the daily-limit laws most states have passed: AARP’s tracker lists Indiana as the first state to ban cryptocurrency kiosks outright, with the ban taking effect March 9, 2026. Unlike a transaction cap, a ban removes the machines from the state entirely rather than slowing down how quickly someone can use one, a distinction that matters because most kiosk-related scam losses happen in a single visit, before a cap on a second or third transaction would come into play. AARP’s tracker frames Indiana’s ban as a model other states are now considering, though as of the tracker’s Sept. 14 update, no other state had followed Indiana all the way to an outright ban rather than a transaction limit.
Daily Limits: Virginia’s Approach
Virginia’s law, one of the daily-limit versions AARP tracks, caps a new customer’s deposit at $2,000 a day and an existing customer’s at $5,000, a distinction meant to catch a first-time user who is most likely being walked through a transaction by someone on the phone. An existing customer with an established pattern of smaller transactions can move more money before hitting the cap, while a first-time depositor, the profile most closely associated with a scam already in progress, is stopped at a lower threshold. AARP’s tracker does not say how many of the 35 states set a limit as low as Virginia’s, only that daily caps are the more common approach state lawmakers have chosen over an outright ban.
Why States Are Moving Now
The legislative wave follows loss figures state attorneys general have cited to justify new rules: Iowa’s attorney general has pursued a lawsuit over kiosk-related losses AARP’s tracker puts at approximately $20 million in that state alone. Nationally, the FBI’s 2025 annual fraud report counted more than 13,460 complaints and $389 million in losses tied to cryptocurrency kiosks that year, and AARP’s tracker cites FBI data showing people 60 and older accounted for roughly three-quarters of losses where an age was known. That concentration among older adults is the reason most of the new state laws, daily limits, warning requirements and Indiana’s outright ban alike, are being pushed by lawmakers citing senior-fraud statistics specifically. AARP’s tracker attributes that concentration among older adults partly to how the script unfolds: a caller stays on the phone with a target through the entire kiosk visit, a tactic that works most reliably on someone unfamiliar with how a cryptocurrency deposit is supposed to work in the first place.
What the Laws Don’t Cover Yet
None of the 35 state laws apply outside that state’s own borders, so a kiosk operator running machines in a state without a cap or a ban faces no equivalent restriction there, and a scam script that instructs a target to drive to a different location can route around a law that only covers where the target lives. AARP’s tracker also does not list a federal law covering crypto kiosks nationwide, so the current patchwork depends on each state passing and enforcing its own version rather than a single uniform standard. The FTC’s guidance on cryptocurrency scams recommends treating any request to deposit cash into a kiosk as a red flag regardless of which state’s law applies, since a legitimate agency, business or relative never asks for payment that way. Anyone who has already used a kiosk under pressure from a caller can also contact the Justice Department’s National Elder Fraud Hotline at 1-833-372-8311 for help with next steps. A kiosk operator that also runs machines through an app in a state with tighter rules raises a separate question AARP’s tracker does not address: whether an app-based transaction is covered by the same law written for a physical kiosk.
What a State Law Doesn’t Decide for One Household
A new state cap or an outright ban changes what a kiosk allows, but it does not change what a phone call asks a target to do in the minutes before reaching one. The instructions in that call, drive here, feed cash into this machine, come from the caller regardless of which side of a state line the kiosk sits on.
The Senior Fraud Defense & First-Hour Recovery Kit pairs the family code word for confirming a caller with the first-hour recovery plan for what comes next if a deposit has already been made.
See The Senior Fraud Defense & First-Hour Recovery Kit.
This article was produced with AI assistance and reviewed by a human editor prior to publication.
