Arizona has launched a dedicated fraud complaint process that lets Bitcoin kiosk scam victims pursue refunds under a new state law, according to consumer guidance from the Arizona Attorney General. The report says victims must take two concrete steps to be eligible: file a police report documenting the fraud, then submit a complaint to the Attorney General's office through a new cryptocurrency-kiosk fraud complaint path.
For consumers who have lost money at a Bitcoin ATM — often after being coached by a scammer to feed cash into a kiosk — this is the first state-backed mechanism in Arizona that ties a refund right to a defined complaint procedure, rather than leaving victims to chase irreversible blockchain transfers on their own. The process is grounded in House Bill 2387, the state's Cryptocurrency Kiosk License Fraud Prevention law, which the AG's guidance and press materials say took effect on or about September 26, 2025, with operator licensing required beginning January 1, 2026.
What the Complaint Process Requires
The Attorney General's guidance frames the new process as a structured, two-step path for victims who believe they were defrauded at a Bitcoin ATM in Arizona.
Steps Victims Must Take:
- File a police report documenting the fraudulent transaction with local law enforcement.
- Submit a complaint to the Arizona Attorney General through the new "Cryptocurrency ATM Fraud" complaint path and form now on the AG's website, which the AG's scam alert describes as a fraud-complaint option tied directly to HB 2387.
The Attorney General's office describes this as a new fraud complaint option tied directly to the law — not a generic consumer-complaint form. That distinction matters, because the refund rights only exist because the statute created them. The dedicated complaint form is the operational link between an individual victim's loss and the refund rights HB 2387 created.
What HB 2387 Actually Does
Beyond the complaint path, HB 2387 imposes a detailed compliance regime on kiosk operators. According to the AG's implementation guidance, the law requires licensing, conspicuous fraud disclosures, transaction limits, fraud monitoring, and refund rights for certain scam victims.
The law turns on a "new customer" versus "existing customer" distinction: a customer whose wallet with that kiosk operator is less than 10 days old is treated as new and capped at $2,000 per day, while a customer with a wallet active for more than 10 days can transact up to $10,500 per day. The dossier notes the $10,500 existing-customer ceiling replaced an earlier draft threshold of $5,000.
That 10-day threshold is designed to catch victims during the critical window when scammers typically pressure targets into moving large sums quickly, before they have time to reconsider or verify the transaction's legitimacy.
HB 2387 also requires operators to present two separate on-screen warning disclosures — covering common scam patterns and the irreversible nature of many crypto transfers — that the customer must accept before any transaction proceeds. Disclosures must be clear, conspicuous, and in the customer's chosen language. On completion, operators must hand over a physical or digital receipt that includes operator contact information, law enforcement contact information for fraud complaints, the transaction hash, wallet addresses, the exchange rate, and the operator's refund policy. That receipt requirement creates a paper trail victims can use when filing police reports and AG complaints.
How Arizona Compares to Other State Laws
Arizona is one of a growing cluster of states that moved in 2025 and 2026 to build consumer-protection scaffolding around Bitcoin ATMs, and the differences in their caps and refund mechanics are becoming the real story.
State-by-State Snapshot:
- Arizona (HB 2387): $2,000/$10,500 daily caps tied to a 10-day wallet-age test; AG-administered fraud complaint and refund path; licensing from Jan. 1, 2026.
- Alabama (HB 303): $1,000 daily caps, fraud warnings, scam refunds, and a privacy-coin ban, effective Oct. 1.
- Mississippi (HB 1625): Licensing with $1,000/$7,500 limits and fraud refunds, effective July 1.
- North Dakota (HB 1447): Money-transmitter licensing and a $2,000 daily cap, but no fee ceiling in the bill text.
The pattern is consistent: licensing, layered fraud warnings, daily transaction limits, and a refund avenue for scam victims. What distinguishes Arizona's approach is the explicit, AG-operated complaint form that connects a victim's police report directly to the statutory refund right.
Arizona's $10,500 existing-customer ceiling is notably higher than the caps in those states — versus Mississippi's $7,500 and Alabama's $1,000. Whether the higher threshold adequately protects consumers remains an open policy question the source material does not resolve. Scammers frequently coerce victims into completing multiple transactions over several days, and a $10,500 daily limit still permits substantial losses in a single fraud episode.
What This Means for Scam Victims
If you lost money at a Bitcoin ATM in Arizona, this report describes a concrete path that did not exist before — but it has prerequisites, and acting quickly matters because crypto transfers are difficult or impossible to reverse once funds move.
If you were scammed at an Arizona Bitcoin ATM:
- File a police report as soon as possible and keep the report number.
- Submit a complaint through the Arizona Attorney General's "Cryptocurrency ATM Fraud" form — not the generic complaint channel.
- Preserve every record from the transaction — the receipt, transaction hash, wallet addresses, exchange rate, and the operator's stated refund policy, all of which the law now requires operators to give you.
- Document the scam itself: who contacted you, how, and what you were told to do at the kiosk.
- Review our consumer protection resources for additional reporting channels.
Note a timing nuance: because eligibility and limits depend on whether your wallet was less than or more than 10 days old at the time of the transaction, that detail may affect how your claim is evaluated.
What This Means for Operators
For kiosk operators active in Arizona, HB 2387 converts fraud handling from a discretionary courtesy into a regulated obligation with the Attorney General as the enforcement backstop. The complaint form gives the AG a steady intake of victim allegations — and, by extension, a data trail on which operators and locations generate the most fraud reports.
Operators should treat the receipt and disclosure requirements as compliance hard stops, not formalities. Compliance teams need to confirm their kiosks deliver the two required warning disclosures, capture explicit customer acknowledgment, enforce the $2,000/$10,500 tiered caps based on wallet age, and generate receipts carrying every mandated data field — including law enforcement contact information and a stated refund policy. The wallet-age distinction also requires operators to track customer tenure precisely, since the cap turns on the 10-day threshold.
The broader risk is regulatory aggregation. Arizona joins Alabama, Mississippi, and North Dakota in building licensing and refund regimes, and other state attorneys general — including Missouri, which opened an investigation into five major operators — are watching the same conduct. An operator that mishandles Arizona refund claims is now creating a documented record that travels.
What the Dossier Does Not Yet Show
The right exists on paper; its real-world success rate is not yet documented. Several key facts remain unconfirmed in the available source material.
Open questions this publication will track:
- The primary statutory text and any administrative rules implementing the refund process have not been independently pulled.
- The number of complaints the Arizona AG has received so far, and any refund outcomes, are not available.
- Whether the law imposes direct operator liability for refunds or routes claims solely through the government complaint process remains unconfirmed.
What to Watch
The open question is enforcement reality: how many complaints will the Arizona AG receive, how will it adjudicate disputed refund claims, and will operators pay out — or contest liability — when those claims land? Watch for the first published refund outcome or enforcement action under HB 2387. That will tell operators and victims alike whether a government-routed complaint process delivers recoveries faster than the operator-by-operator refund pleas victims have relied on until now — and whether the 10-day window and $10,500 ceiling hold up, or whether future legislative sessions tighten those numbers based on the fraud data the AG collects.