Yep. If a security team sees 96% of credit card fraud is coming from users on Tor they are more likely to just block Tor than they are to try to figure out how to safely let the other 4% keep using it.