Alabama's New Bitcoin ATM Law: Limits, Warnings, and Refunds

If a stranger on the phone has ever told you to go to a gas station and put cash into a Bitcoin machine, you've met the problem this law is aimed at. Since October 1, Alabama has rules for those kiosks, including daily limits, on-screen scam warnings, and a way for some victims to get money back.

The law is the Cryptocurrency Kiosk Fraud Prevention Act, House Bill 303. Representative Russell Bedsole of Shelby County sponsored it. According to LegiScan's vote record, the House passed it 101 to 1 and the Senate 30 to 0. It took effect October 1, 2026.

Why Alabama passed it

The scam is simple and it works. Someone poses as a bank, a government agency, a utility, or a relative, and says there's an emergency. The fix is always cash, and the cash goes into a kiosk. By the time anyone figures it out, the crypto has been sent to a wallet nobody can reach.

Local police have seen a lot of it. Captain Daniel Lowe of the Hoover Police Department told Fox 10 that residents there had lost more than $800,000 to scammers who sent them to crypto kiosks over five years. "A lot of people who are victims of these scams, they're not stupid people," he said. The Alabama Securities Commission told reporters that fraud complaints had nearly doubled over the prior year and described individual losses of $330,000 and $250,000.

What the kiosks have to do now

HB 303 adds a new section, 8-7A-28, to the Code of Alabama. It puts a long list of requirements on kiosk operators:

• Two warnings before you can proceed. At the start of a transaction, the screen must show two separate warnings. The first lists common scams: a new online romance that turns into requests for money, someone posing as your bank or a law enforcement officer, claims of a frozen account or identity theft, requests to pay a government agency, and so on. The second says crypto transactions are irreversible and that losses may not be recoverable. You have to accept each one before the transaction goes through.
• Clear costs. The operator has to disclose the dollar amount, every fee, the total, and the exchange rate compared with the market price.
• A receipt. Every transaction gets a physical or digital receipt with the operator's contact information, the time, the wallet address, the fees, and the refund policy.
• Blocking known scam wallets. Operators must use blockchain analytics software to stop transactions sent to addresses linked to fraud or other crime.
• ID checks on every transaction.
• Live customer service. Operators based in the United States must provide live, U.S.-based, toll-free help at all times, with the number posted on the kiosk.
• No bank look-alikes. A kiosk can't share space with a bank or use signs that suggest a bank is behind it. Operators also can't allow privacy coins, which are built to hide where money goes.

The limits

The caps depend on how new you are. A new customer, meaning someone on a first transaction or within 30 days of it, can't put in more than $1,000 in cash in a day or $10,000 in a month, counting every kiosk in the state. After that first 30 days, the cap is $10,500 a day.

Customers 60 and older are supposed to get "enhanced due diligence protections." The act doesn't say what those are. It tells the Securities Commission to write rules, so the details will come from there. I can't tell you yet what those rules look like.

Refunds for fraud victims

This is the part victims should read twice. If you were fraudulently induced to use a kiosk, the operator has to refund you, but how much depends on your history with it:

• New customer: a full refund, including fees.
• Existing customer: one-half of the transaction's value.

To qualify, you have to do all of this within 60 calendar days of the transaction:

1. Contact the kiosk operator.
2. Contact a law enforcement agency and the Securities Commission.
3. File a report with law enforcement or the commission.

You can still get the refund even if the operator never showed the required warnings or gave you a receipt. Keep every piece of paper anyway, and screenshot the transaction hash if you can.

A few cautions. The statute doesn't say who decides whether you were "fraudulently induced," so expect operators to push back. The act took effect on October 1, and it says nothing about transactions before that date, so people who lost money earlier shouldn't count on this refund right. And a refund of half is still half.

How it's enforced

The Alabama Securities Commission, which already licenses money transmitters under the same chapter of the Code, can assess civil penalties against operators that break the rules. The act also says the commission's proceedings don't prevent criminal prosecution or civil lawsuits under other Alabama laws.

If you've already been scammed

Time matters here. Call the kiosk operator, your local police, and the Securities Commission as soon as you realize what happened, and count the 60 days from the date of the transaction, not from the day you found out.

Hoover police have warned that police don't ask anyone to pay a fine in cryptocurrency. If someone calls and says otherwise, hang up and call the police yourself.

If you've lost money to a scam, or you're an operator or a business with questions about the new rules, call John Medaris Law at (205) 663-1584. We're at 230 Bearden Road in Pelham. We handle business and insurance disputes, and we'll tell you honestly what your options are, including when the answer is that the money is probably gone.