Arizona Crypto ATM Law: 35 Victims Recover $171K in Scam Refunds
Arizona's first-in-class crypto ATM protection law has delivered real results. Since taking effect in September 2025, the measure has helped 35 people recover a combined $171,332 lost to crypto kiosk scams, including every fee they paid. The state's attorney general is now urging anyone who gets caught out to act fast, because a strict 30-day deadline stands between a victim and a full refund.
What the Arizona Crypto ATM Law Actually Does
The law places binding obligations on crypto kiosk operators doing business in Arizona. When a new customer is fraudulently induced into making a transaction, the operator must refund the full amount, fees included. That is not a discretionary goodwill gesture. It is a legal requirement.
How the law defines a "new customer"
The statute draws a clear line. A "new customer" is anyone who has used a particular operator for fewer than 10 days. That definition matters because the refund entitlement applies specifically to this group. People who have been using the same kiosk for longer than 10 days are treated as existing customers and fall outside the refund protection.
The law also caps how much a new customer can transact in a single day: $2,000. Existing customers face a higher cap of $10,500. The lower limit for new customers is a consumer-protection feature, designed to contain the damage if someone is targeted right after their first use of a machine.
The 30-day reporting window
Timing is everything. To qualify for a refund, a victim must do two things within 30 days of the fraudulent transaction. First, contact the kiosk operator directly. Second, notify the Arizona Attorney General's Office or another law enforcement agency. Both steps are required, and both must happen within that 30-day window. Miss it, and the legal entitlement to a refund is gone.
The victim must also provide the operator with an official report, issued by a law enforcement body, confirming that they were fraudulently induced into making the transaction. That official document is what unlocks the operator's obligation to pay.
Who Is Running These Scams, and How Do They Work?
Crypto ATM fraud typically follows a recognisable pattern. A scammer contacts the target, often by phone, text, or email, and creates a sense of urgency. Common pretexts include a fake utility disconnection notice, a supposed government debt, a romance relationship built over weeks, or a fraudulent investment opportunity promising high returns. The victim is then directed to a nearby crypto kiosk and told to deposit cash, which is immediately converted to cryptocurrency and sent to a wallet the scammer controls.
The speed of the transaction is exactly what makes crypto ATM fraud so damaging. Once the funds are sent to a self-custodied wallet, there is no bank to call and no payment processor to reverse the transfer. Arizona's law steps in before that finality bites, by putting the refund obligation on the operator, not on any hope of tracing stolen crypto on-chain.
Why older adults are disproportionately targeted
Scammers often focus on people who are less familiar with how cryptocurrency transactions work, particularly older adults. The physical presence of an ATM-style machine gives a false sense of legitimacy, making a crypto kiosk feel like a normal cash machine rather than an irreversible digital transfer. Arizona's daily transaction cap for new customers directly addresses this, limiting the maximum loss exposure during the period when a person is most vulnerable: their first interactions with a kiosk.
What the $171,332 Recovery Tells Us
The Arizona Attorney General's Office confirmed that 35 victims have received full refunds totalling $171,332 since the law came into force on 26 September 2025. Attorney General Kris Mayes stated that her office is "happy to help any victim of crypto ATM fraud receive a refund they are entitled to under Arizona law" and renewed the call for victims to make contact immediately after a fraudulent transaction occurs.
The figures reveal a few things worth noting from a consumer perspective. Thirty-five successful refund claims in less than a year suggests the reporting process is working, at least for those who know about the deadline. It also implies that an unknown number of victims may have missed the window, simply because they were not aware the law existed or did not act quickly enough.
The gap between awareness and protection
A law is only useful if people know it exists. Scam victims are often embarrassed or disoriented after the event, and many do not immediately recognise what happened as fraud. By the time they piece things together, a significant portion of the 30 days may already have elapsed. The attorney general's public announcement serves a dual purpose: celebrating the early results and reminding Arizonans that the clock starts at the moment of the transaction, not at the moment the victim realises they were scammed.
Step-by-Step: How to Claim a Refund Under Arizona Law
If you or someone close to you has been tricked into sending money through a crypto ATM in Arizona, the steps below follow directly from the law's requirements.
Step 1: Act immediately
Do not wait to see if the money comes back on its own, and do not spend time trying to contact the scammer. The 30-day clock runs from the date of the fraudulent transaction, not from when you decide to seek help.
Step 2: Contact the kiosk operator
Every crypto ATM must display operator contact information. Reach out to the operator in writing if possible, so you have a record. State clearly that you were fraudulently induced into the transaction and that you are requesting a refund under Arizona law.
Step 3: Report to law enforcement or the attorney general
File a report with the Arizona Attorney General's Office or local law enforcement. The Attorney General's Office has been actively supporting victims through this process and can be reached through the official state government website. You can also file a complaint with the Federal Trade Commission at ReportFraud.ftc.gov, though the state law's refund mechanism runs through Arizona-level reporting.
Step 4: Obtain and share the official report
The operator is legally required to refund you only after you provide an official report confirming you were fraudulently induced. Make sure you get a copy of that report from whichever agency handles your complaint, and send it to the operator within the 30-day window.
Step 5: Keep records of everything
Retain receipts from the kiosk transaction, any written communication with the operator, and all correspondence with law enforcement. These records protect you if the operator disputes the refund.
Tax Implications: What Happens When You Get a Refund
Here is something most guides on crypto ATM scams skip entirely: the tax angle. If you sent funds through a crypto ATM and then received a full refund, you need to think about how that sits in your tax picture, especially if the transaction involved converting cash to crypto and sending it on.
Was there a taxable disposal?
For most scam victims using a crypto ATM, the flow is: cash in, crypto purchased, crypto immediately sent out. If you never controlled the crypto in any meaningful sense and it was sent directly to a scammer's wallet, the IRS has not issued specific guidance covering every scam permutation. However, the general principle is that a purchase followed by a fraudulent transfer may not generate a taxable gain (because there is no gain), but it could still be a reportable transaction. When a full refund is issued under Arizona law, the operator is essentially unwinding the transaction, and the refund likely eliminates any gain or loss position you might have had.
If you lost crypto to a scam in a prior tax year before receiving the refund, a theft loss deduction may be relevant, though the rules on theft losses for individuals changed significantly after the 2017 Tax Cuts and Jobs Act. Consulting a tax professional is the right move before assuming a deduction applies. You can also read our breakdown of how crypto is taxed in the US for a fuller picture of the underlying framework.
Reporting requirements still apply
Even if a transaction was fraudulent, there may still be a reporting obligation on your crypto tax return, particularly if any exchange or kiosk operator issued a Form 1099-DA or similar document. A refund received in a different tax year from the original transaction adds another layer of complexity. Using a reliable crypto tax calculator to map the transaction chronology helps ensure you do not miss a reportable event or double-count a loss.
Scammers who target crypto holders do not stop at ATMs. We've covered the rise of fake IRS letters targeting crypto holders, another vector where victims can end up with both financial losses and tax complications.
What This Means Beyond Arizona
Arizona is one of the first US states to mandate operator-level refunds for crypto ATM fraud victims. The $171,332 recovery is a proof point that state-level intervention can create real consumer protection in an asset class where federal regulation is still evolving. Other states considering similar legislation will likely point to Arizona's numbers.
For users of crypto ATMs anywhere in the US, Arizona's approach is a reminder that the protections available to you depend heavily on your state. Someone transacting in a state without this kind of law has no equivalent legal backstop. The best defence remains recognising scam tactics before handing over cash, a reminder that no government agency, utility company, or legitimate investment platform will ever direct you to a crypto ATM to settle a debt or make an investment.
Frequently Asked Questions
Who qualifies for a refund under Arizona's crypto ATM law?
New customers, meaning people who have used a specific kiosk operator for fewer than 10 days, qualify if they were fraudulently induced into a transaction. They must report to both the operator and law enforcement within 30 days and provide an official report confirming the fraud.
What is the 30-day deadline and when does it start?
The 30-day window begins on the date of the fraudulent transaction, not on the date the victim discovers the fraud. Both the operator notification and the law enforcement report must happen within this period for the refund entitlement to apply.
Does the refund include fees paid at the kiosk?
Yes. The law requires operators to refund eligible new customers for the full transaction amount, including any fees charged at the kiosk.
Do I need to report the refund on my crypto tax return?
The tax treatment of a fraudulent crypto ATM transaction and a subsequent refund is nuanced. The refund likely unwinds any gain or loss position, but if the original transaction was reported in a prior tax year, or if a Form 1099 was issued, you should consult a tax professional to confirm how to treat both events correctly on your return.
What if I live outside Arizona? Are there similar protections in other states?
Arizona is among the first US states to enact a mandatory refund obligation on crypto kiosk operators. Other states do not currently have equivalent legislation, though some have issued consumer warnings. Federal consumer protection agencies such as the FTC accept complaints about crypto ATM fraud at ReportFraud.ftc.gov, but there is no federal statutory refund mandate equivalent to Arizona's law at this time.
Source: Cointelegraph