Older adults who fall for phone scams and are told to deposit cash into a cryptocurrency kiosk will soon encounter new barriers in Georgia. Starting July 1, kiosk operators in the state must display fraud warnings, offer live customer support, cap certain transactions, and provide refund rights to victims, all under Act 478, signed into law as HB 945. The Georgia Department of Banking and Finance has already proposed a companion rule requiring operators to report every kiosk location and process refunds in U.S. dollars, creating an enforcement framework that did not exist before.
Why Act 478 changes the calculus for kiosk fraud in Georgia
Cryptocurrency kiosks have become a preferred payment channel for scammers targeting older adults. The Federal Trade Commission documented the pattern in a September 2024 analysis: callers posing as government agents or tech-support workers instruct victims to withdraw cash, find a nearby machine, and scan a QR code that sends funds to a wallet the scammer controls. Because blockchain transactions are effectively irreversible, victims rarely recover their money.
Georgia’s response attacks the problem at the point of sale. Act 478 requires every kiosk screen to display scam warnings before a transaction begins, mandates that operators staff a live support line, and gives the DBF authority to set per-transaction dollar limits. The law also allows operators to place a temporary hold on any transaction suspected of involving the exploitation of an elderly or disabled person, a provision that directly targets the most common victim profile.
The DBF moved quickly to build out the regulatory details. Its proposed Rule 80-3-1-.07 would require operators to file the physical address of every kiosk they run in Georgia, submit to blockchain monitoring and analysis requirements, and issue any fraud-related refunds in fiat currency rather than cryptocurrency. Location reporting is the piece that gives regulators a map of the market for the first time. Without it, the DBF had no centralized way to know how many machines were operating or where they sat.
Federal data and Georgia enforcement actions behind the new rules
The FBI’s Internet Crime Complaint Center released state-level data on cryptocurrency kiosk complaints and adjusted losses covering 2025, including Georgia-specific counts. The dataset describes the typical scam sequence: a victim is directed to withdraw cash, locate a kiosk, and scan a QR code that routes funds to the scammer’s wallet. Those complaint figures gave Georgia legislators a concrete baseline when drafting HB 945.
The DBF had already signaled its willingness to act before the new law passed. In January 2025, the agency issued a cease-and-desist order against Blockchain Technology Machines, Inc., operating as RocketBTM, for alleged unlicensed money transmission tied to running virtual currency kiosks in Georgia. That order became final, establishing that the DBF views kiosk operations involving deposits to third-party wallets as money transmission requiring a state license. Separate guidance issued by the DBF had already laid out the licensing interpretation, but the RocketBTM enforcement action turned that guidance into a precedent with real consequences.
The FTC’s consumer-facing materials reinforce the same warning. A March 2024 consumer alert told readers that anyone directing them to a Bitcoin ATM is running a scam, period. The agency’s September 2024 data spotlight documented disproportionate losses among older adults nationally, giving Georgia’s legislative effort a federal data anchor.
What Act 478 still cannot guarantee for Georgia kiosk users
Several gaps remain even after July 1. No publicly available source lists the total number of licensed or operating kiosks in Georgia, or identifies every company running them. The location-reporting requirement in proposed Rule 80-3-1-.07 should close that gap once operators comply, but the DBF has not published a timeline for when the first location registry will be available or how quickly it will act on noncompliance reports.
The IC3 and FTC datasets provide state-level and national aggregates, but neither breaks out Georgia-specific victim age demographics or ties losses to individual kiosk locations. That means measuring whether the new law actually reduces elder fraud, as opposed to simply shifting it to other payment channels, will take time and better data collection at the state level.
