Arizona AG Recovers $171,332 in Full Refunds for 35 Crypto ATM Scam Victims Under State Kiosk Law

Arizona Attorney General Kris Mayes announced on August 12, 2026 that her office has secured full refunds totaling $171,332 for 35 victims of cryptocurrency ATM scams since the state's Cryptocurrency Kiosk License Fraud Prevention law took effect on September 26, 2025. "My office is happy to help any victim of crypto ATM fraud receive a refund they are entitled to under Arizona law," Mayes said in the announcement. "Knowing the signs of crypto ATM fraud can help protect you and your loved ones, but if you have fallen victim to this scam, contact my office right away. We are here to help."

This is the first hard number Arizona has published on its refund mandate in operation, and it changes the conversation for both sides of the counter. For consumers, it establishes that the statutory refund right is not theoretical — operators have paid. For operators, it confirms that a state AG is actively brokering refund demands transaction by transaction, and that the 30-day reporting window is the gate that determines whether a claim gets paid at all.

Update — September 11, 2026

Arizona requires crypto kiosks to display scam warnings, issue receipts, screen suspect wallets and limit daily transactions — four separate obligations that sit underneath the refund right and are frequently collapsed into a single "Arizona has a refund law" shorthand. They are not the same thing, and the distinction determines what an operator has to build and what a victim can actually prove.

Reporting since the original announcement puts each control in its place. Blockchain analytics screening is a blocking control: transfers to wallet addresses already associated with fraud must be stopped before they execute. The daily caps are a throttle: a new customer is limited to $2,000 per day and an existing customer to $10,500 per day. The receipt requirement is documentary, and it is the piece that carries the most weight in a refund claim — Arizona receipts must record the operator, transaction time, amount, transaction hash, wallet addresses, recipient information, fees, exchange rate and refund policy.

Two clarifications that change how this story reads

First, the refund obligation is not a penalty for noncompliance. Arizona's statute requires refunds to eligible fraud victims even where the operator displayed every required warning, printed a complete receipt, ran wallet screening, and stayed inside the daily caps. The Attorney General's announcement did not identify the kiosk operators involved, allege violations, or announce orders against any company. Nothing in the $171,332 figure should be read as an enforcement finding against a named operator.

Second, the screening and cap provisions are preventive controls — they are not the stated basis for these 35 recoveries. The refunds ran through the statutory claim process, not through pattern detection in kiosk data.

The 10-day "new customer" limitation is the most consequential detail here and the one least likely to be understood by victims. A person who used the same operator's kiosks repeatedly over weeks — a common pattern in prolonged impersonation and romance scams, where a scammer walks a victim through multiple visits — may fall outside the refund right entirely, regardless of how quickly they report. The 30-day reporting clock is the deadline everyone discusses; the 10-day customer-relationship test is the eligibility screen that runs before it.

What remains unreported: which operators paid the $171,332, how many refunds each processed, how many claims were denied on the new-customer test versus the 30-day window, and whether any operator contested a demand. Arizona has published an outcome without publishing a denominator.

How the Refund Process Works

Under the law, which took effect September 26, 2025, cryptocurrency kiosk and ATM operators are required to issue full refunds — including all fees — to customers who report they were victims of fraud within 30 days of the transaction. The "including all fees" language matters: a refund under Arizona's statute is not the bitcoin's market value net of spread. It is the cash the customer inserted, with the operator's fee returned as well. [Updated: the refund right is limited to a "new customer" — a customer of that operator for less than 10 days — and also requires the victim to contact the operator and furnish an official report finding the transaction was fraudulently induced.]

To qualify, the victim must report the fraudulent transaction to the Arizona Attorney General's Office or to local law enforcement inside that 30-day window. The AG's office frames the deadline as the single most consequential variable in whether a victim recovers money, warning that "waiting even a few days could mean missing the 30-day deadline to qualify for a refund."

What Else the Law Requires

The Cryptocurrency Kiosk License Fraud Prevention law also lowered daily transaction limits, added new on-screen warnings that customers must acknowledge before completing a transaction, and required kiosk operators to issue transaction receipts. The receipt requirement is doing double duty here: it is a disclosure obligation for operators and, as the AG's guidance makes explicit, the evidentiary backbone of a victim's refund claim.

The AG's release does not state how many refund requests were made overall, how many were denied, which operators paid, or how many claims fell outside the 30-day window. Nor does the release attribute any change in Arizona scam losses to the daily transaction limits or the on-screen warnings — whether those provisions reduce fraud volume remains an open policy question that this announcement does not answer.

The Prevention Guidance

Alongside the refund figures, Mayes' office repeated four warnings aimed at Arizonans before a transaction happens: only scammers demand payment in cryptocurrency, and no legitimate business or government agency will ever ask you to pay or "protect your money" using bitcoin; verify independently by hanging up and calling the organization back on a number you look up yourself, never one the caller provides; consult a family member or friend before making any significant financial decision involving cryptocurrency; and report suspicious activity to local law enforcement and the AG's office immediately.

The office also directs Arizonans to its public outreach program, which accepts presentation requests at azag.gov/office/outreach/presentation-request — a channel most relevant to senior centers, libraries, and community groups seeking fraud-prevention briefings.

What This Means for Arizona Victims

If you sent cash through a crypto kiosk because someone instructed you to — a caller claiming to be from a utility, a sheriff's office, Medicare, a tech support line, a romantic interest, or an "investment advisor" — your window is short and it is counted in days, not months.

One structural caveat: Arizona's refund right runs against the kiosk operator. Where an operator has ceased operations, a refund demand becomes a creditor claim rather than a customer service request — a dynamic now playing out in the Bitcoin Depot Chapter 11 case, where Minnesota has filed a $1.15 billion claim over disclosed and undisclosed fee practices.

What This Means for Operators

Arizona is now demonstrably an active refund-enforcement jurisdiction, not merely a statutory one. Thirty-five paid claims in roughly eleven months means the AG's office has an established intake-to-refund pipeline, and that operators servicing Arizona kiosks should expect refund demands routed through the state rather than arriving directly from customers.

The operational implications are concrete. Receipt generation must be reliable at every Arizona kiosk, because a missing receipt is both a statutory violation and an evidentiary dispute the operator will likely lose. Refunds must return fees, not just principal, which means a scam refund is a full-loss event for the operator on that transaction — the spread does not survive. And because eligibility hinges on a 30-day reporting date, operators need transaction records timestamped and retrievable fast enough to verify or contest a claim inside that window.

Add to that a customer-tenure question most kiosk back ends were never built to answer on demand: whether a given customer had been a customer of that operator for fewer than 10 days at the time of the disputed transaction. That single data point determines whether the statutory refund right attaches. Operators without a clean first-transaction timestamp per customer will be litigating eligibility from incomplete records.

Arizona's approach also sits inside a widening pattern of state statutes with refund mechanics: South Dakota's SB 98 pairs registration with a $1,000 daily cap and scam refund duties, and Louisiana's Act 482 gives consumers a full-refund claim against unlicensed operators. Operators tracking their own exposure across states can review enforcement histories in the operators directory.

What to Watch

The unanswered questions in this announcement are the ones that will define how much Arizona's law actually recovers: How many claims were filed but denied — and were they denied for missing the 30-day deadline, or for failing the 10-day new-customer test? Which operators are paying, and are any resisting? Would counting the reporting window from discovery rather than from the transaction materially raise recoveries? With Hawaii's kiosk ban set for October 1, Minnesota's ban already in effect, and Texas lawmakers weighing a ban after reported $57 million in kiosk losses, Arizona's refund-and-disclose model is now one of the clearest live tests of whether regulation can preserve the kiosk business while making victims whole — or whether the states that chose prohibition drew the more durable conclusion.