Arizona Attorney General Kris Mayes announced on August 12, 2026 that her office has secured full refunds totaling $171,332 for 35 victims of cryptocurrency ATM scams since the state's Cryptocurrency Kiosk License Fraud Prevention law took effect on September 26, 2025. "My office is happy to help any victim of crypto ATM fraud receive a refund they are entitled to under Arizona law," Mayes said in the announcement. "Knowing the signs of crypto ATM fraud can help protect you and your loved ones, but if you have fallen victim to this scam, contact my office right away. We are here to help."
This is the first hard number Arizona has published on its refund mandate in operation, and it changes the conversation for both sides of the counter. For consumers, it establishes that the statutory refund right is not theoretical — operators have paid. For operators, it confirms that a state AG is actively brokering refund demands transaction by transaction, and that the 30-day reporting window is the gate that determines whether a claim gets paid at all.
How the Refund Process Works
Under the law, which took effect September 26, 2025, cryptocurrency kiosk and ATM operators are required to issue full refunds — including all fees — to customers who report they were victims of fraud within 30 days of the transaction. The "including all fees" language matters: a refund under Arizona's statute is not the bitcoin's market value net of spread. It is the cash the customer inserted, with the operator's fee returned as well.
To qualify, the victim must report the fraudulent transaction to the Arizona Attorney General's Office or to local law enforcement inside that 30-day window. The AG's office frames the deadline as the single most consequential variable in whether a victim recovers money, warning that "waiting even a few days could mean missing the 30-day deadline to qualify for a refund."
What the Attorney General's Office tells victims to do:
- Report it right away. File a complaint with the Arizona Attorney General's Office or contact local law enforcement as soon as possible.
- Keep your receipt. The law requires kiosk operators to provide transaction receipts; hold on to yours as proof of the transaction.
- Provide as much detail as possible. Be ready to share the date, time, location, and amount of the transaction, along with any information about how the scam occurred.
- Don't be embarrassed to come forward. Per the AG's office, scammers are sophisticated and specifically target people under pressure.
What Else the Law Requires
The Cryptocurrency Kiosk License Fraud Prevention law also lowered daily transaction limits, added new on-screen warnings that customers must acknowledge before completing a transaction, and required kiosk operators to issue transaction receipts. The receipt requirement is doing double duty here: it is a disclosure obligation for operators and, as the AG's guidance makes explicit, the evidentiary backbone of a victim's refund claim.
The AG's release does not state how many refund requests were made overall, how many were denied, which operators paid, or how many claims fell outside the 30-day window. Nor does the release attribute any change in Arizona scam losses to the daily transaction limits or the on-screen warnings — whether those provisions reduce fraud volume remains an open policy question that this announcement does not answer.
The Prevention Guidance
Alongside the refund figures, Mayes' office repeated four warnings aimed at Arizonans before a transaction happens: only scammers demand payment in cryptocurrency, and no legitimate business or government agency will ever ask you to pay or "protect your money" using bitcoin; verify independently by hanging up and calling the organization back on a number you look up yourself, never one the caller provides; consult a family member or friend before making any significant financial decision involving cryptocurrency; and report suspicious activity to local law enforcement and the AG's office immediately.
The office also directs Arizonans to its public outreach program, which accepts presentation requests at azag.gov/office/outreach/presentation-request — a channel most relevant to senior centers, libraries, and community groups seeking fraud-prevention briefings.
What This Means for Arizona Victims
If you sent cash through a crypto kiosk because someone instructed you to — a caller claiming to be from a utility, a sheriff's office, Medicare, a tech support line, a romantic interest, or an "investment advisor" — your window is short and it is counted in days, not months.
Practical steps if you were scammed at an Arizona crypto kiosk:
- File with the Arizona Attorney General's Office or local law enforcement immediately. The 30-day clock runs from the transaction date, not from the day you realized it was a scam.
- Locate the receipt the kiosk printed. If the machine failed to issue one, document that — the statute requires operators to provide receipts.
- Write down the kiosk's exact location, the host business, the date and time, the dollar amount, and the wallet address if you have it.
- Do not pay anyone who contacts you offering to "recover" your crypto for a fee. Recovery-fee schemes routinely re-victimize people who have already lost money.
- Review our consumer protection resources for reporting steps in other states.
One structural caveat: Arizona's refund right runs against the kiosk operator. Where an operator has ceased operations, a refund demand becomes a creditor claim rather than a customer service request — a dynamic now playing out in the Bitcoin Depot Chapter 11 case, where Minnesota has filed a $1.15 billion claim over disclosed and undisclosed fee practices.
What This Means for Operators
Arizona is now demonstrably an active refund-enforcement jurisdiction, not merely a statutory one. Thirty-five paid claims in roughly eleven months means the AG's office has an established intake-to-refund pipeline, and that operators servicing Arizona kiosks should expect refund demands routed through the state rather than arriving directly from customers.
The operational implications are concrete. Receipt generation must be reliable at every Arizona kiosk, because a missing receipt is both a statutory violation and an evidentiary dispute the operator will likely lose. Refunds must return fees, not just principal, which means a scam refund is a full-loss event for the operator on that transaction — the spread does not survive. And because eligibility hinges on a 30-day reporting date, operators need transaction records timestamped and retrievable fast enough to verify or contest a claim inside that window.
Arizona's approach also sits inside a widening pattern of state statutes with refund mechanics: South Dakota's SB 98 pairs registration with a $1,000 daily cap and scam refund duties, and Louisiana's Act 482 gives consumers a full-refund claim against unlicensed operators. Operators tracking their own exposure across states can review enforcement histories in the operators directory.
What to Watch
The unanswered questions in this announcement are the ones that will define how much Arizona's law actually recovers: How many claims were filed but denied for missing the 30-day deadline, and would a longer window — Arizona currently counts from the transaction, not from discovery — materially raise recoveries? Which operators are paying, and are any resisting? With Hawaii's kiosk ban set for October 1, Minnesota's ban already in effect, and Texas lawmakers weighing a ban after reported $57 million in kiosk losses, Arizona's refund-and-disclose model is now one of the clearest live tests of whether regulation can preserve the kiosk business while making victims whole — or whether the states that chose prohibition drew the more durable conclusion.