The law helps Iowans by:

Requiring refunds be issued to Iowans for fraudulent transactions processed by a cryptocurrency ATM if the Iowan takes certain steps (see below), generally within 90 days of a fraudulent or scam transaction.

Implementing a $1,000 daily transaction limit (and an aggregate $10,000 limit for the 30 days following an Iowan’s first transaction with a cryptocurrency ATM company).

Prohibiting cryptocurrency ATM operators from charging fees more than (i) $5.00 or (ii) 15% of the value of the cryptocurrency being bought, whichever is greater.

Requiring cryptocurrency ATMs to display enhanced scam warnings and disclosures related to the purchase.

Requiring operators of cryptocurrency ATMs to provide greater customer service and scam prevention procedures and requiring them to provide more detailed reporting to state consumer-protection offices.

For refund purposes, the law has different requirements for new consumers and existing consumers. New consumers are individuals who are using a particular brand/operator of cryptocurrency ATM for the first time. An individual remains a new consumer for 30 days following the first transaction with that particular operator. Anyone who is not a new consumer is an existing consumer.

Cryptocurrency ATM operators must disclose information to you in writing before completing a transaction. The disclosure must include:

The dollar value of the transaction,

The fees the operator is charging,

A notice that transactions are final (if the operator lacks a refund/reversal policy), and

Clear warnings about fraud.

Yes, cryptocurrency ATM operators must issue receipts. The receipt must include several things, including:

The dollar value of the transaction

The exchange rate between the cryptocurrency and U.S. dollars,

The fees the operator charged,

The operator’s refund policy, and

Contact information for consumer questions and complaints.

Cryptocurrency ATM operators must:

Use analytic tools to help detect suspected fraudulent transfers and to identify patterns indicating fraud or other illegal activities.

Have a dedicated law enforcement contact for fast communication when fraud is reported.

Provide live, toll-free telephonic customer service Monday through Friday, between 8:00 am and 10:00 pm.

Ensure that any third party using a cryptocurrency ATM to engage in transactions with Iowans complies with the law’s requirements, including its fee requirements.

You should immediately contact the Iowa Attorney General’s office. The Attorney General has the power to enforce the law against cryptocurrency ATM operators, which may include going to court to require compliance or obtaining civil penalties of up to $10,000 per violation. If you believe a cryptocurrency ATM operator is not complying with the act, you can contact the Attorney General’s office by phone at (515) 281-5926 or (888) 777-4590 and by email at cryptoscam@ag.iowa.gov. You can also file a compliance report here.

Attorney General Bird filed two lawsuits against cryptocurrency ATM operators. You can find copies of the lawsuits here.

You will receive a full refund for cryptocurrency ATM transactions you made as a new consumer if you meet all three of these conditions:

The transaction was one in which you were fraudulently induced to send money (for example, through a lie, false pretense, scam, or fraud).

You report the fraudulent transaction to both the cryptocurrency ATM operator and a government or law enforcement agency. The report must be within 90 calendar days of your last transaction as a new consumer. For example, if you made one transaction as a new consumer, the report must be made no more than 90 calendar days after that transaction. If you made three transactions as a new consumer, the report must be made no more than 90 calendar days after the third transaction.

You provide proof of the scam or fraud to the cryptocurrency ATM operator, such as a police report or a sworn declaration explaining the fraud.

If you are an existing consumer, you will receive a full refund for a cryptocurrency ATM transaction if you meet all three of these conditions:

The transaction was one in which you were fraudulently induced to send money (for example, through a lie, false pretense, scam, or fraud).

You report the fraudulent transaction to both the cryptocurrency ATM operator and a government or law enforcement agency. The report must be within 90 calendar days of the fraudulent transaction.

You provide proof of the scam or fraud to the cryptocurrency ATM operator, such as a police report or a sworn declaration explaining the fraud.

You were fraudulently induced to send money if you were tricked or deceived into sending money. Examples are someone claiming to be a government official, a tech-support agent, a law enforcement officer, or a friend or relative in need. This can also include romance scams, that is, where someone you thought you were dating made false claims about their identity, circumstances, or intentions. If you were deceived into sending money through a cryptocurrency ATM under false pretenses, you may qualify for a refund.

The law states that you must submit proof of the scam or fraud, including but not limited to submitting a police report or a signed written statement (called a sworn declaration) describing the fraud and what happened. Any additional supporting evidence is also helpful. You should save documents related to the scam including communication records, receipts, and transaction data. Those documents will help prove that you were the victim of a scam or fraud and can serve as evidence if prosecutors are eventually able to catch the scammer.

If you believe that you are a victim of a scam that involved sending money through a cryptocurrency ATM:

Immediately contact the Iowa Attorney General’s office by phone at (515) 281-5926 or (888) 777-4590 or by email at cryptoscam@ag.iowa.gov.

Contact your local police department or sheriff’s office.

Keep all documents related to your transactions, such as your receipts and any texts, emails, or other communications you had with the scammer.

Remember you are not alone. Millions of Americans are attacked by financial scammers every year. If one of these criminals has stolen your money, the Attorney General’s office is here to help.

Iowa Code § 533C.1004 is a new law that protects Iowans from scams and frauds facilitated through cryptocurrency ATMs. The law goes into effect on Tuesday, July 1, 2025. To read the new law, click here.

Unfortunately, scammers frequently use cryptocurrency ATMs to defraud Iowans. To better protect Iowans from those scams, the Iowa legislature passed a bill designed to reduce how much money Iowans lose through cryptocurrency ATMs and to set out requirements for companies to issue refunds.

A cryptocurrency ATM is a physical machine or kiosk into which individuals can insert cash (and sometimes debit/credit cards) to purchase cryptocurrency (e.g., Bitcoin). These machines are found across Iowa. Though they can be located anywhere, they are often in gas stations, grocery and convenience stores, vape shops, and restaurants.

The law applies to operators subject to Iowa’s cryptocurrency ATM provisions and requirements.

Users looking for reporting paths, process explanations, or contact information should return to the main Crypto ATM landing page.