Arizona’s cryptocurrency kiosk consumer protection law has returned $171,332 in full refunds to 35 scam victims since taking effect on September 26, 2025, Attorney General Kris Mayes announced on August 12.
The recoveries mark the first official tally of direct financial relief under House Bill 2387, a first-of-its-kind state statute that mandates crypto ATM operators reimburse eligible customers who were fraudulently induced into making transactions. Mayes said her office stands ready to assist additional victims, but emphasized that the law’s 30-day reporting window is unforgiving.
“My office is happy to help any victim of crypto ATM fraud receive a refund they are entitled to under Arizona law,” Mayes said. “Knowing the signs of crypto ATM fraud can help protect you and your loved ones, but if you have fallen victim to this scam, contact my office right away. We are here to help.”
The announcement did not identify which kiosk companies issued the refunds, disclose individual amounts, or provide figures on claims that were denied. That leaves an open question about what share of eligible victims have successfully navigated the claims process.
How the Refund Mechanism Works
House Bill 2387, signed into law as Chapter 171 in May 2025, creates a tiered system of protections aimed specifically at new users of crypto kiosks. A “new customer” is defined as someone who has used a particular operator’s machines for fewer than 10 days. Only new customers qualify for the mandatory refund provision.
To claim a refund, a victim must contact both the kiosk operator and the Attorney General’s Office or another law enforcement agency within 30 days of the fraudulent transaction. The victim must then provide the operator with an official report from law enforcement or the attorney general determining that the transaction was fraudulently induced. Simply presenting a receipt or pointing to a warning screen on the machine is not sufficient.
The statute also imposes daily transaction limits that vary by customer status:
| Customer Type | Daily Transaction Limit | Refund Eligibility |
|---|---|---|
| New customer (under 10 days with operator) | $2,000 | Eligible under HB 2387 |
| Existing customer (10 or more days) | $10,500 | Not covered by refund mandate |
The tiered structure evolved significantly during the legislative process. An initial version introduced by Representative David Marshall Sr. in January 2025 applied a flat $1,000 daily cap to all customers. A committee amendment later split customers into categories with a 72-hour new-customer window, a $2,000 cap for new customers, and a $5,000 cap for existing users. The final signed version extended the new-customer window to 10 days and raised the existing-customer ceiling to $10,500.
Operators face ongoing compliance obligations beyond refunds. They must provide round-the-clock live customer service, display a toll-free support number, issue detailed receipts, and deploy blockchain tracing software designed to block transfers to wallets associated with fraud.
A $171,332 Response to a Much Larger Problem
The refund total, while meaningful for the 35 individuals who recovered money, represents a fraction of the broader fraud landscape. Mayes’ office has previously stated that Arizonans lost more than $177 million to crypto ATM scams in 2024 alone, the year before the refund law existed. More than two-thirds of the state’s crypto ATM fraud victims were over 60.
The two figures measure different things: $177 million is a single year’s total losses before the law took effect, while $171,332 is money returned to victims who reported in time under a statute that has been active for less than a year. The comparison illustrates the scale of the challenge rather than the effectiveness of the refund mechanism itself.
Mayes has acknowledged that the law’s transaction limits may not go far enough. In remarks made before the August refund announcement, she said, “I don’t think we’re done with this… the limit is still too high.” That same official later pointed to the refund total as evidence the law is working.
Nationally, the fraud problem continues to grow. The FBI’s Internet Crime Complaint Center recorded 13,460 crypto kiosk complaints in 2025, with reported losses near $389 million. That represents a 23% increase in complaints from 2024 and a 58% jump in losses. People aged 60 or older filed 6,188 of those complaints, accounting for more than $257 million in losses. The FBI cautions that kiosk-related complaint totals can include scams involving other payment methods, meaning the figures should not be attributed solely to kiosk transfers.
The scale of individual cases underscores why lawmakers acted. Phoenix police stopped a woman after she deposited $16,000 into a kiosk at an AM/PM gas station while a caller posing as PayPal guided her through the transaction. In Scottsdale, a man posing as an Uber driver allegedly stole $223,000 in cryptocurrency from multiple hotel guests. In Peoria, one victim stood at a single machine for two and a half hours feeding it cash and lost $30,000 before anyone intervened. Arizona had roughly 17 crypto ATMs a few years ago; it now has close to 600.
Divergent State Approaches
Arizona’s model of regulation plus mandatory refunds stands in contrast to the approaches taken by other states confronting the same problem.
Minnesota moved from safety rules to a full ban on crypto kiosks, which took effect August 1, 2026, after officials cited nearly $1 million in reported losses to scams targeting seniors. Indiana and Tennessee have also enacted prohibitions. Delaware and New Jersey are moving in the same direction: Delaware’s House Bill 441 would force operators to remove machines within 90 days, and a companion bill in New Jersey cleared committee in June 2026.
Georgia chose a middle ground similar to Arizona, imposing limits, warnings, and refund requirements rather than a ban. Missouri has taken a litigation route, suing operator CoinFlip over alleged scam-related transactions and seeking consumer restitution and civil penalties.
Washington, D.C. has pursued its own enforcement action. Attorney General Brian Schwalb sued kiosk operator Athena Bitcoin in September 2025, alleging that 93% of deposits made at its D.C. machines over a five-month stretch traced back to scams, with a median victim age of 71 and fees as high as 26% against an industry norm of 0.24% to 3%. The lawsuit also alleges Athena refused refunds even to customers it knew had been scammed.
At the federal level, the Stop Crypto ATM Scams Act, introduced by Representatives Sean Casten and María Elvira Salazar, would push Arizona’s basic model nationwide: daily transaction caps and mandatory scam warnings instead of an outright ban.
For Arizona victims, the most important requirement remains the rolling 30-day deadline. A person who believes a scammer directed them to a kiosk must notify the operator and either the Attorney General’s Office or law enforcement within that period. The state advises victims to retain their receipts and be prepared to provide the date, time, location, and amount of the transaction, along with details of how the scam occurred.
The 35 refunds announced this week provide the clearest official evidence yet that Arizona’s regulatory approach is producing direct financial recoveries. Future disclosures on total claims, rejected applications, and operator compliance would offer a fuller measure of how the model performs compared with states that have chosen to remove the machines entirely.
Credit: Source link
