Arizona's cryptocurrency ATM consumer protection law has helped 35 scam victims recover more than $171,000 since the measure took effect in September 2025, offering an uncommon avenue for restitution in cases of crypto ATM fraud.

Enacted through House Bill 2387, the law mandates that cryptocurrency kiosk operators issue refunds to qualifying new customers who were fraudulently induced into conducting transactions. To be eligible, victims must file within 30 days and supply documentation from law enforcement or the Arizona Attorney General's Office substantiating the fraudulent activity.

Consumer Safeguards and Transaction Limits

Alongside the refund requirement, Arizona implemented several additional protections:

• New customers are subject to a $2,000 daily transaction limit.
• Existing customers face a $10,500 daily transaction limit.
• All crypto ATMs must display prominent scam warnings.
• Operators are required to provide physical or digital transaction receipts.
• Kiosks must offer round-the-clock customer service.

Under the statute, a "new customer" is defined as any individual within their first 10 days of using a cryptocurrency kiosk. This window is critical because the refund mechanism applies exclusively to qualifying new customers.

The Arizona Attorney General's Office has repeatedly cautioned that scammers frequently coerce victims into withdrawing cash and depositing it into cryptocurrency ATMs. Fraudsters have been known to impersonate banks, government agencies, utility companies, and law enforcement officials, which is why the law pairs refund eligibility with notice requirements and on-site disclosure rules intended to help intervene before more funds are sent.

Implications and the 30-Day Window

The recovery of more than $171,000 across 35 cases suggests the refund framework can deliver tangible consumer protection, equipping regulators with a mechanism that goes beyond standard warnings and transaction caps.

However, the 30-day filing deadline underscores the urgency of rapid action. Victims must notify both the kiosk operator and law enforcement or the Attorney General's Office within that timeframe to qualify for restitution, so the process depends on quick reporting once a scam is suspected.

Arizona officials have also stressed that legitimate businesses and government agencies do not demand cryptocurrency payments through ATMs. The state hosts approximately 600 cryptocurrency ATMs, making the machines a significant component of its consumer-fraud landscape.

The early recoveries may also draw attention from regulators in other states as they consider how to address crypto ATM scams using a mix of refund rules, transaction limits, and disclosure requirements rather than relying on warnings alone.