Kentucky Scam and Fraud Laws: Where to Report, Your Right to Sue (2026)

Kentucky's Consumer Protection Act gives some scam victims a right to sue, but only on its terms. A person who bought or leased goods or services primarily for personal, family or household purposes, and who lost money or property because of an unfair, false, misleading or deceptive practice, can sue for actual damages. Its private-suit section does not provide for triple damages, attorney's fees are up to the judge and can go to whichever side wins, and the deadline is generally two years from the violation.

Kentucky also lets banks and brokers place a temporary hold on a transaction when they suspect an older or impaired customer is being exploited, and it requires anyone who suspects exploitation of a vulnerable adult to report it. Scams can be reported to the Attorney General at 888-432-9257, which offers mediation but says it cannot act as your private attorney. A new Kentucky law on crypto ATMs, signed in April 2026, does not take effect until April 30, 2027.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers Kentucky state law: the Kentucky Consumer Protection Act (KRS 367.110 and following), Kentucky complaint offices, protections for vulnerable and older adults, Kentucky laws on phishing, home solicitation sales, telemarketing and crypto ATMs, and Kentucky court limits and deadlines. Federal refund and reporting rights are summarized briefly and covered in depth on our national guides. Out of scope: criminal defense, and the law of other states (if the scammer or business is elsewhere, that state's law may also matter).

First steps if you were scammed in Kentucky

Contact the bank, card issuer, payment app, wire company or crypto exchange that moved your money right away; that company is usually the only one that can stop or reverse a payment. Your federal rights depend on how you paid, and our guide on how to get money back after a scam goes through each payment method. For app transfers, see the Zelle and payment app guide, and if your bank has already said no, see what to do when a bank refuses a scam refund.

Then report it. Most scams go to the FTC at ReportFraud.ftc.gov, and online crime to the FBI's IC3; our where to report a scam guide lists every federal channel. The Kentucky offices below are in addition to those, not instead of them. If your Social Security number or accounts were exposed, see Kentucky identity theft laws.

Where to report a scam in Kentucky

Be realistic about what an Attorney General complaint does. The office says: "We can only file suit to protect the public interest. We cannot file a lawsuit whose only purpose is to recover money or property for you." It also says that if a business does not respond or refuses to cooperate, "there is generally nothing the Office can do except track this information for reporting and monitoring purposes," and that "We cannot act as your private attorney." Mediation is still worth trying against a real business with a reputation to protect.

The Attorney General can also go to court against a business. When a court has ordered a business to stop and it violates that order, the business can be made to pay a civil penalty of up to $25,000 per violation under KRS 367.990(1), but that penalty is paid to the Commonwealth, not to victims. We did not find a Spanish-language complaint option on the Attorney General pages we reviewed.

Kentucky's consumer protection law: can you sue?

Sometimes. KRS 367.170 makes "unfair, false, misleading, or deceptive acts or practices in the conduct of any trade or commerce" unlawful, and the statute says "unfair" means unconscionable. The right to sue over a violation is in KRS 367.220(1):

"Any person who purchases or leases goods or services primarily for personal, family or household purposes and thereby suffers any ascertainable loss of money or property, real or personal, as a result of the use or employment by another person of a method, act or practice declared unlawful by KRS 367.170, may bring an action under the Rules of Civil Procedure in the Circuit Court ... to recover actual damages."

Who can sue

Three conditions are built into that sentence. You must have bought or leased goods or services, mainly for personal, family or household use. You must have lost money or property. And the loss must result from an unlawful practice. Someone who paid for a fake product, a sham repair or a worthless service fits that pattern more easily than someone who simply sent money to an impostor posing as a bank, a relative or a government agency, who may not have bought anything. Whether your situation fits depends on the facts; a Kentucky lawyer can tell you.

A Kentucky appeals court has also required a direct relationship between the buyer and the seller. In Skilcraft Sheetmetal, Inc. v. Kentucky Machinery, Inc., 836 S.W.2d 907 (Ky. Ct. App. 1992), the Kentucky Court of Appeals said: "The legislature intended that privity of contract exist between the parties in a suit alleging a violation of the Consumer Protection Act." We have not checked whether later decisions have changed that.

What you can recover

Two points stand out. Fees are not guaranteed to a winning consumer, and because they go to the "prevailing party," a consumer who loses could be ordered to pay the other side's fees. And unlike some states, Kentucky's private-suit section has no damages multiplier and no minimum award, so what you can recover is generally tied to what you actually lost.

The honest limit

The Act needs a defendant you can identify, serve and collect from. That often works against a Kentucky business, a contractor or a seller with a real address. It usually does not work against an anonymous scammer behind a spoofed number, a fake website or an overseas crypto wallet. A judgment does not help if nobody can be found to pay it.

Protections for vulnerable and older adults in Kentucky

Who counts as an "adult." Kentucky's adult protection law, KRS chapter 209, does not turn on age. KRS 209.020(4) defines an adult as "a person eighteen (18) years of age or older who, because of mental or physical dysfunctioning, is unable to manage his or her own resources, carry out the activity of daily living, or protect himself or herself from neglect, exploitation, or a hazardous or abusive situation without assistance from others, and who may be in need of protective services." A healthy, independent 70-year-old scam victim does not fit that definition on its words; a person whose impairment leaves them unable to protect themselves may.

Exploitation is a crime. KRS 209.020(9) defines exploitation as "obtaining or using another person's resources, including but not limited to funds, assets, or property, by deception, intimidation, or similar means, with the intent to deprive the person of those resources." Under KRS 209.990, any person who knowingly exploits an adult causing a total loss of more than $300 commits a Class C felony; wanton or reckless exploitation over $300 is a Class D felony; and a loss of $300 or less is a Class A misdemeanor. The statute is not limited to caretakers. Report suspected crimes to local law enforcement.

A conditional route to triple damages. KRS 209.990(8) makes a convicted defendant "civilly liable to the victim of the offense or the victim's estate for treble damages, plus reasonable attorney fees and court costs" if, after sentencing, the defendant fails to return the victim's property within 30 days of a court order to do so, or falls 30 days or more behind on a court-ordered payment schedule. This needs a criminal conviction and a missed restitution order first; it is not a stand-alone claim. Once those conditions are met, the victim or the victim's estate can sue, and an interested person or entity as defined in KRS 387.510 has standing to bring the civil action on the victim's behalf.

Everyone must report. KRS 209.030(2) says "Any person ... having reasonable cause to suspect that an adult has suffered abuse, neglect, or exploitation, shall report or cause reports to be made," and the report goes "immediately" to the Cabinet for Health and Family Services. Knowingly or wantonly failing to report is a Class B misdemeanor. The duty applies to any person, which on its face includes bank employees.

Banks and brokers may hold a transaction. Kentucky's Protection from Financial Exploitation Act, KRS 365.245, lets a "qualified person" (a broker-dealer, investment adviser or financial institution such as a bank or credit union) place a temporary hold on a transaction or disbursement from the account of a "specified adult." That means a person 65 or older, or an adult the institution reasonably believes has a mental or physical impairment that leaves them unable to protect their own interests. The institution must first have made a report under KRS 209.030 and must reasonably believe exploitation has occurred, is occurring, has been attempted or will be attempted. It must give notice to the people authorized on the account no later than two business days after placing the hold.

The hold expires no later than 15 business days after it is placed, and can be extended to no later than 25 business days if the institution's internal review supports it; a state agency or a court can end or extend it. The law says the institution "may" hold a transaction, so it is a permission, not a duty. If you are worried about a parent, call Adult Protective Services and tell the bank or brokerage directly that you suspect a scam. Our elder fraud guide covers the federal side.

A 2026 bill, HB 794, would have changed Kentucky's financial exploitation law; it passed the House but had not become law when we checked the legislature's record in October 2026. The rules above are the law in force.

Kentucky scam laws on the books

Crypto ATMs: a new law that takes effect April 30, 2027

Kentucky enacted Senate Bill 189 (2026 Ky. Acts ch. 126), signed by the Governor on April 13, 2026. It creates a licensing system for virtual currency kiosk operators, overseen by the Department of Financial Institutions, in KRS chapter 286, subtitle 13. Those kiosk rules take effect April 30, 2027. They are not in force yet. Once they take effect, the main consumer rules are:

• Daily limits. Under KRS 286.13-090, an operator may not take more than $2,000 a day from a user, or $10,500 from a "new virtual currency kiosk user" over the first transaction day and the 29 calendar days after it.
• New users: a delay or a refund. For a new user, the operator must either wait 72 hours before processing the transaction or let the user cancel within 72 hours for a full refund at the operator's cost.
• Fee cap. Charges are capped at the greater of $5 or 18 percent of the transaction's value.
• Warnings. Each kiosk must display a notice that begins "WARNING: This technology can be used to defraud you," and operators must offer toll-free live customer service.
• Refunds for fraud victims. Under KRS 286.13-095(5), an operator "shall issue a refund of all virtual currency kiosk charges" for a transaction where the user was fraudulently induced, reported the fraud within 90 days to the operator and to the DFI, the Attorney General or state or local law enforcement, and submitted proof such as a police report or a sworn statement. The refund is due within 72 hours. As written, that refund covers the kiosk's charges; a refund of the full amount, including charges, applies when the operator or its agent or employee itself defrauded, deceived or misled the user. The law also says a fraud victim's eligibility for a refund cannot be waived or prevented by a disclosure.

A separate statute, KRS 367.356, has been in effect since July 15, 2026. It makes a violation of the kiosk subtitle (once that subtitle takes effect) or of KRS 369.137 (disclosure rules for hardware wallets) a violation of KRS 367.170, the Consumer Protection Act's ban on deceptive practices, and makes the Act's remedies available to the Attorney General or any other person. We have not confirmed how the purchase requirement in KRS 367.220 applies to a kiosk user's own lawsuit. If you lose money at a crypto ATM before April 30, 2027, the kiosk-specific limits and refunds above do not yet apply; contact the kiosk operator and law enforcement right away, file a complaint with the DFI, and see our guides on crypto and investment scams and tech support and fake invoice scams, which often end at a crypto ATM.

Phishing is a felony

KRS 434.697 makes it a crime to knowingly or intentionally solicit, request or take "any action to induce another person to provide identifying information by means of a Web page, electronic mail message, or otherwise using the Internet," while pretending to be someone else without that person's authority or approval. Phishing is a Class D felony. The section is a criminal law; it does not itself give a victim a right to sue. See our phishing guide for what to do if you clicked.

Theft by deception and gift card tampering

Under KRS 514.040(1), "A person is guilty of theft by deception when the person obtains property or services of another by deception with intent to deprive the person thereof." That is the general crime most scams fit.

Since June 27, 2025, KRS 434.635 has made gift card tampering a Class D felony: intentionally manipulating "a gift card's packaging or security features to access the gift card's information without authorization and with the intention of using the information to improperly access and utilize funds placed on the gift card by another." The law targets people who tamper with cards on store racks to drain them later, and it does not apply to an activated card. It does not address a scammer who talks a victim into buying cards and reading out the numbers; for that, see our gift card scams guide.

Door-to-door sales: three business days to cancel

Under KRS 367.420(1), a buyer in a home solicitation sale (a sale personally solicited at the buyer's residence) "has the right to cancel a home solicitation sale until midnight of the third business day after the day on which the buyer signs." Cancel by written notice to the seller. For a home solicitation loan secured by your principal dwelling, the period is ten business days (KRS 367.420(6)).

Telemarketing

Kentucky's telemarketing statutes, KRS 367.46951 to 367.46999, are tied to the Consumer Protection Act: under KRS 367.46967(1), a violation of them is an unfair, false, misleading or deceptive practice in violation of KRS 367.170. A 2007 law, KRS 367.46994, directed the Attorney General to ask the FTC to move the numbers on Kentucky's old state "zero call" list to the national Do Not Call Registry. The Attorney General's complaint page points to nocall.ky.gov for telemarketing complaints, but that address did not load when we checked in October 2026; you can report unwanted sales calls to the national Do Not Call Registry at DoNotCall.gov.

Suing a scammer or a business in Kentucky

Small claims. Under KRS 24A.230(1), Kentucky's small claims division hears civil cases where the amount claimed does not exceed $2,500, not counting interest and costs. Libel, slander, alienation of affections, malicious prosecution and abuse of process cases are excluded.

Deadlines. A lawsuit "for relief or damages on the ground of fraud or mistake" must be filed within five years (KRS 413.120(11)). Under KRS 413.130(3), the claim is not treated as having accrued "until the discovery of the fraud or mistake," but the suit must still be "commenced within ten (10) years after the time of making the contract or the perpetration of the fraud." A Consumer Protection Act claim has its own, shorter limit: two years after the violation, or one year after an Attorney General action ends, whichever is later. Our Kentucky statute of limitations guide covers other civil deadlines. If a collector is now chasing a debt the scammer ran up in your name, see Kentucky debt collection laws.

Who you can actually reach. Lawsuits work against people and businesses with a name, an address and assets. A scammer who hid behind a fake identity, a spoofed caller ID or an overseas account is usually not reachable through a Kentucky court. In those cases, the payment company, a fast report to law enforcement, and protecting your identity are where your effort pays off. Our guide on when a lawyer helps after a scam explains when legal help is worth it.

Related guides

• Scams and fraud: your rights and where to start
• How to get money back after a scam
• Where to report a scam
• Elder fraud
• Crypto and investment scams
• Zelle and payment app scams
• Phishing, smishing and vishing
• Gift card scams
• Kentucky identity theft laws
• Kentucky debt collection laws
• Kentucky statute of limitations

Last updated: October 2, 2026.

This article is general legal information, not legal advice. For your specific situation, contact your payment company, the Kentucky office named above, or a lawyer licensed in Kentucky.

Frequently Asked Questions

Can I sue a scammer in Kentucky?

Possibly, if you can identify and serve them. KRS 367.220 lets a person who bought or leased goods or services primarily for personal, family or household purposes, and lost money or property because of a deceptive practice, sue for actual damages within two years. An anonymous or overseas scammer is usually not reachable through a Kentucky court.

Does the Kentucky Consumer Protection Act give triple damages?

Not in the private-suit section. KRS 367.220 provides actual damages and equitable relief and preserves the right to seek punitive damages where appropriate, but it has no triple-damages provision. Attorney's fees are at the court's discretion and go to the prevailing party.

How long do I have to sue under the Kentucky Consumer Protection Act?

Two years after the violation, or one year after an Attorney General action ends, whichever is later (KRS 367.220(5)). The section does not require a demand letter before suing.

How do I report a scam to the Kentucky Attorney General?

Call the scam hotline at 888-432-9257 or use the online Consumer Complaint and Mediation Request form. The office can mediate with a business but says it cannot file a lawsuit just to recover money for you.

Will the Kentucky Attorney General get my money back?

Do not expect it. The office says it sues only to protect the public interest and cannot act as your private attorney. Contact your bank or payment company first.

Who do I call if an elderly person in Kentucky is being scammed?

Call Adult Protective Services at (877) 597-2331 or (800) 752-6200, and tell the person's bank. The Attorney General's Office of Senior Protection and Mediation is at 502-696-5300.

Can a Kentucky bank hold a transaction if it suspects elder fraud?

Yes, it may. Under KRS 365.245, a bank, credit union, broker-dealer or investment adviser that has reported suspected exploitation may hold a transaction from the account of someone 65 or older, or an impaired adult, for up to 15 business days, extendable to 25.

Is there a limit on crypto ATM transactions in Kentucky?

Starting April 30, 2027, KRS 286.13-090 limits kiosk users to $2,000 a day and new users to $10,500 over their first 30 days, and caps fees at the greater of $5 or 18 percent. Those rules are not in force before that date.

Is phishing a crime in Kentucky?

Yes. KRS 434.697 makes phishing for identifying information over the internet by pretending to be someone else a Class D felony.

Can I cancel a door-to-door sale in Kentucky?

Yes. Under KRS 367.420, a buyer can cancel a home solicitation sale until midnight of the third business day after signing, by written notice to the seller.

What is the small claims limit in Kentucky?

$2,500, not counting interest and costs (KRS 24A.230).

How long do I have to sue for fraud in Kentucky?

Five years under KRS 413.120(11), counted from when you discover the fraud, but no later than ten years after the fraud was committed (KRS 413.130(3)).