What New Protections for Scam Victims Actually Cover

Since October 1, 2026, Alabama has required crypto ATM operators to refund customers who were tricked into a transaction. Customers in their first 30 days get the full amount back with fees, and everyone else gets half, as long as they report within 60 days. Few other 2025–2026 changes put money back in a victim's hands. Gift card warnings, longer brokerage holds and a House-passed federal bill aim to stop scams or chase the money. The basic US rule is unchanged: if you pressed send yourself, federal law generally does not make anyone refund you.

Key takeaways

Alabama's law covers only transactions at a crypto kiosk in the state. Refunds require contacting the operator, police and the Alabama Securities Commission within 60 calendar days.
Arizona has required kiosk refunds for new customers since September 26, 2025. Its attorney general says 35 victims had recovered $171,332 by August 2026. Indiana banned crypto kiosks outright on March 9, 2026.
New gift card laws in New Jersey and Maryland require stores to post scam warnings and use tamper-resistant packaging. Neither law gives you a right to a refund from the store.
FINRA's plan for longer brokerage holds is still awaiting SEC approval. The GUARD Act passed the House 414–7 on September 15, 2026, but it is not law and creates no refund right.
Regulation E still covers transfers someone else makes from your account, not payments you were talked into sending. In 2025, people aged 60 and older reported $7.7 billion in losses to the FBI, up 59% from 2024.

This article is general education, not legal advice. The exact law, your account terms and your facts decide what you can recover.

What it means for you

You were talked into a Zelle or other instant payment: nothing new at the federal level gives you a refund. Zelle's rules cover only "certain qualifying imposter scams" (see "What still isn't covered").

You paid by credit card: your strongest rights still come from the older Fair Credit Billing Act. Dispute in writing within 60 days of the statement.

You sent a wire: no new refund right exists. FinCEN says recovery of fraud-induced international wires is most likely when they are reported to law enforcement within 72 hours.

You bought gift cards for a scammer: the new state laws require warnings, not refunds. Call the card issuer at once and ask for a refund; the FTC says some issuers might give money back.

You fed cash into a crypto ATM: only some states, such as Alabama and Arizona, require refunds. Where they do, the deadlines are short and conditions apply (see the step-by-step section).

You live in a state with a new law: check whether it refunds (Alabama and Arizona crypto kiosks) or only warns (New Jersey and Maryland gift cards), who it covers and its deadline.

You are an older adult or help one: banks and brokers may pause a suspicious payment, but they don't have to. Name a trusted contact on each account (see the checklist).

What changed in 2025 and 2026

The table separates changes that can return money from those that only warn, delay or investigate, as of October 9, 2026.

Change	Status and date	What it does	What it does not do
Alabama crypto kiosk law	In effect October 1, 2026	Refunds (full or half), daily and monthly limits for new users, fraud warnings	Cover crypto bought on an app or exchange, or kiosks in other states
Arizona crypto kiosk law	In effect September 26, 2025	Full refund with fees for new customers (wallet under 10 days old) who report within 30 days with a police report	Refund existing customers, or anyone who reports after 30 days
Indiana crypto kiosk ban	In effect March 9, 2026	Prohibits operating a crypto kiosk in Indiana	Create any refund process
New Jersey gift card law	In effect October 1, 2025. State enforcement delayed to February 1, 2026.	Scam warning where gift cards are sold, secure packaging	Require the store or issuer to refund you
Maryland gift card law	Open-loop cards June 1, 2025. Store cards October 1, 2025.	Scam warnings in stores and online, secure packaging, staff training	Require the store or issuer to refund you
FINRA hold proposals	Filed with the SEC August 20, 2026, not yet approved	Longer holds for people 65 and older or impaired adults, a fraud "speed bump" for any adult	Apply to banks, or require any firm to act
GUARD Act (H.R. 2978)	Passed the House September 15, 2026	Lets local police use federal grants for fraud cases	Become law without Senate passage, or refund victims

AARP's state-by-state tracker, updated September 14, 2026, counts 35 states that have passed crypto kiosk laws since 2023, 18 of them in 2026. The measures it lists are mainly daily limits, fraud warnings, operator licensing and receipts. Alabama and Arizona go further and require refunds.

Arizona's refund covers only new customers, which the attorney general's crypto ATM fraud page defines as having a wallet less than 10 days old. They must report within 30 days and provide a police report finding they were defrauded. The attorney general reported on August 12, 2026 that the law had returned $171,332 to 35 victims.

Indiana took the other route: under House Enrolled Act 1116, kiosks have been banned since March 9, 2026, according to the state's Department of Financial Institutions. The attorney general enforces the ban, according to Sheppard Mullin.

Gift card laws work at the checkout. New Jersey's required consumer notice says no legitimate business or government agency will ask for payment in gift cards, and that a caller telling you to lie to the clerk is "likely a scam." The law took effect October 1, 2025, covers physical cards only and carries civil penalties of up to $1,000 per violation, according to Greenberg Traurig, which reports state enforcement was delayed to February 1, 2026.

Maryland's 2024 law requires similar notices in stores and online. It also requires tamper-evident packaging for both bank-network ("open-loop") and store cards, with some exceptions, and training for staff who sell them. A first violation generally draws a warning, according to the legislature's fiscal note.

The GUARD Act, short for Guarding Unprotected Aging Retirees from Deception, passed the House 414–7. Its sponsors say it lets existing federal grant money pay for fraud investigations, training and tracing technology. It still needs the Senate.

Crypto ATM refunds, step by step

Alabama's enrolled bill adds Section 8-7A-28 to the state code. A "new consumer" is someone making a first kiosk transaction in Alabama, or anyone within the 30 days right after that first transaction. Everyone else is an "existing consumer."

Limits. Operators may not accept more than $1,000 a day or $10,000 a calendar month from a new consumer, across all of their kiosks in the state, or more than $10,500 a day from an existing consumer.
Refunds. A new consumer who was "fraudulently induced" gets a full refund plus all fees. An existing consumer gets half. The bill says half "of the value of the transaction, including all fees." The Alabama Securities Commission's September 30, 2026 notice describes it as half "plus all fees."
Conditions. Within 60 calendar days of the transaction, contact the operator, a law enforcement agency and the commission, and file a report with police or the commission. A victim qualifies even if the operator failed to show the required warnings or receipt.
Other duties. Operators must block wallets flagged as linked to fraud, and those headquartered in the US must run a live, US-based, toll-free help line.

Illustrative example. The amounts are hypothetical. Someone uses an Alabama kiosk for the first time on day 1, inserting $1,000 in cash. That buys $900 of crypto and pays $100 in fees. On day 45, past the 30-day window and now an existing consumer, they insert $3,000: $2,700 of crypto and $300 in fees. Both payments went to a scammer.

Day 1 (new consumer):       refund = $900 + $100                 = $1,000
Day 45 (existing consumer): refund = ($2,700 x 0.5) + $300       = $1,650
  (if fees are halved too:  ($2,700 + $300) x 0.5                = $1,500)
Reporting deadlines:        day 1 + 60 = day 61;  day 45 + 60 = day 105

Reported on day 50:  $1,000 + $1,650 = $2,650 of $4,000 = 66%
Reported on day 70:  $1,650 of $4,000                   = 41%

Each transaction has its own 60-day clock. Waiting until day 70 costs this person $1,000, because the fully refundable first payment falls outside its window. The two readings of the fee wording differ by $150 here, so ask the operator in writing which it applies.

The FBI's May 15, 2026 kiosk alert counted 13,460 complaints and $389 million in losses tied to crypto kiosks in 2025, with losses up 58% from 2024. In its 2025 annual report, people 60 and older made 6,188 of those complaints, about 46%, and reported $257 million, about 66% of the losses.

What still isn't covered

Payments you sent yourself

Regulation E, the federal rule for electronic transfers, covers transfers made by someone else without your authority. Its official interpretation counts a transfer by someone who got your card, login or code "through fraud or robbery" as unauthorized. A payment you made yourself because of a lie is not, and nothing in 2025 or 2026 changed that.

The Protecting Consumers from Payment Scams Act, introduced in August 2024 to cover those payments, ended with the 118th Congress. No reintroduced version was on public record as of October 9, 2026.

Zelle and other instant payments

Zelle says it requires banks to fully reimburse confirmed fraud and "certain qualifying imposter scams" where the customer authorized the payment. It does not publish what qualifies.

The CFPB dropped its lawsuit against Zelle's operator in March 2025. In July 2026 a New York judge refused to dismiss the state attorney general's own suit, Reuters reported. Zelle says it will appeal. Neither case has produced a refund rule.

Wires

Regulation E excludes transfers through Fedwire and similar bank-to-bank wire systems. The exception is a remittance transfer, money a consumer sends abroad. You can cancel one within 30 minutes of paying if the money hasn't been picked up or deposited, and the provider must then refund it within three business days. FinCEN's Rapid Response Program, which asks foreign authorities to stop stolen wires, got a new fact sheet on April 15, 2026, but it dates from 2015 and starts only after police refer a case.

Holds that firms may, not must, use

The federal Senior Safe Act of 2018 shields trained bank and brokerage staff from liability when they report suspected exploitation of someone 65 or older. It does not require anyone to stop a payment.

Some states let banks delay suspicious transactions. North Carolina's governor signed a law on July 2, 2026 giving bank tellers the ability to refuse suspicious transactions. A bank "may, but is not required to" act, according to Moore & Van Allen.

On the brokerage side, FINRA's Regulatory Notice 26-02 proposed raising the maximum hold under Rule 2165 from 55 to 145 business days.

The version FINRA filed with the SEC on August 20, 2026, also adds Rule 2166. It would let a firm delay a transaction for up to 10 business days for any customer aged 18 or older when it reasonably believes fraud is involved, up from five days in the notice. Both rules permit holds; neither requires them. FINRA has extended the SEC's deadline to act to December 8, 2026.

Frequently asked questions

Does a crypto ATM refund law cover crypto I bought on an exchange app?

Not Alabama's. The act covers transactions "conducted or performed through a cryptocurrency kiosk," a physical terminal in the state, so crypto bought on an app falls outside it. The FTC's scam recovery guide still advises contacting the exchange right away and asking it to reverse the transaction.

Can my brokerage refuse to release my money because it suspects a scam?

It can, under current FINRA rules, if you are 65 or older or the firm reasonably believes an impairment leaves you unable to protect your own interests. The first hold lasts 15 to 25 business days, and the firm can extend it once by 30 business days after reporting the matter to a state agency or court. Younger customers get no such FINRA hold unless proposed Rule 2166 is approved.

Can the issuer still refund a gift card after a scam?

Sometimes. The FTC's gift card scam guidance says to contact the company that issued the card right away, "no matter how long ago the scam happened," because some issuers "might give your money back." Keep the card and the store receipt, since the card number supports your claim.

Is a company offering to recover my losses for a fee legitimate?

Treat it as a likely second scam. The FBI's 2025 report logged 10,516 recovery scam complaints with $1.4 billion in losses. A July 2026 FBI alert says IC3 never contacts victims directly and never charges to recover funds.

What counts as a billing error on a credit card?

Besides charges you didn't authorize, Regulation Z treats a charge for goods or services "not accepted" or not delivered as agreed as a billing error. Your written notice must reach the issuer within 60 days of the first statement showing the charge. The issuer must acknowledge it within 30 days and resolve it within two billing cycles, and never more than 90 days.

If you've just been scammed

Call the company that moved the money, using the number on your card, statement or receipt. Ask for a reversal or refund, and note the time.
File at ic3.gov the same day, with transaction IDs, account numbers, wallet addresses and the kiosk location if there was one. In the 3,900 cases in 2025 where the FBI's Recovery Asset Team asked banks to freeze funds, it froze $679 million of $1.16 billion, about 58%.
Check your state's clock. In Alabama, contact the operator, police and the Securities Commission (1-800-222-1253) within 60 days. In Arizona, new customers must report to the operator and to police or the attorney general within 30 days.
Report to the FTC at ReportFraud.ftc.gov. The FTC's step-by-step guide covers each payment method.
Close the gaps. Name a trusted contact at your bank and brokerage, and lower your daily transfer limits.