Colorado Scam and Fraud Laws: Where to Report, Right to Sue (2026)

Colorado's Consumer Protection Act lets an actual or potential consumer who was injured by a deceptive trade practice sue for the greater of their actual damages or $500, or three times their actual damages if they prove bad faith by clear and convincing evidence, plus costs and attorney fees if they win. The catch is a court-made rule: a private plaintiff must also show the practice significantly impacts the public, so a claim against a lone scammer who targeted only you is uncertain.

Colorado also has newer laws aimed at scams. Since January 1, 2026, crypto ATMs (virtual currency kiosks) must show a fraud warning, cap daily transactions and, in narrow cases, refund a first transaction to an overseas wallet. Since August 12, 2026, banks and credit unions may delay a disbursement from the account of someone 70 or older when they suspect financial exploitation. Scam complaints go to the Colorado Attorney General, which says it cannot investigate or prosecute your individual case.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers Colorado state law: the Colorado Consumer Protection Act (C.R.S. title 6, article 1), Colorado complaint offices, Colorado protections for older and at-risk adults, Colorado's crypto ATM law, and Colorado deadlines for suing. Federal refund and reporting rights are summarized briefly and covered in depth on our national guides. Out of scope: criminal defense, and the law of other states (if the scammer or business is elsewhere, that state's law may also matter). Statute quotations come from the official 2024 printing of the Colorado Revised Statutes and the signed 2025 and 2026 session laws named below.

First steps if you were scammed in Colorado

Contact the bank, card issuer, payment app, wire company or crypto exchange that moved your money right away, since that company is usually the one that can stop or reverse a payment. Your federal rights depend on how you paid; our guide on how to get money back after a scam walks through each payment method, and the Zelle and payment app guide covers app transfers. If your bank has already said no, see what to do when a bank refuses a scam refund.

Then report the scam. Most scams go to the FTC at ReportFraud.ftc.gov and online crime to the FBI's IC3; our where to report a scam guide lists every federal channel. The Colorado offices below are in addition to those, not instead of them. If the scammer got your Social Security number, bank login or other personal details, start with what to do if a scammer has your information.

Where to report a scam in Colorado

The Attorney General's scams page describes the problem plainly: "Scammers use email, mail, the Internet, social media, telephone calls and text messages in an effort to steal your identity and your money." Its complaint page is just as plain about limits:

"Please note: The Attorney General's Office does not have authority to provide legal advice or legal representation to individuals and does not have the authority to investigate or prosecute your individual case."

So treat an Attorney General complaint as a report, not a refund request. The office does say that "under certain circumstances, the department may seek to resolve disputes between consumers and businesses through informal negotiations" through its Consumer Mediation Program, and that consumers whose complaints are selected "will be notified by the department." That can help with a real business; it is unlikely to reach an anonymous scammer. According to the Attorney General's Stop Fraud Colorado site, Coloradans reported more than 800 imposter scams to the office in 2023.

For Spanish speakers, the Attorney General runs a Spanish-language fraud site, nomasfraudecolorado.gov, and a Spanish resources page. The FTC's federal report form is also linked from the Attorney General's page.

Colorado's consumer protection law: can you sue?

Sometimes. The Colorado Consumer Protection Act (CCPA) gives a private right to sue, but only to the people section 6-1-113(1) names. The action is available to any person who:

"(a) Is an actual or potential consumer of the defendant's goods, services, or property and is injured as a result of such deceptive trade practice, or is a residential subscriber ... who receives unlawful telephone solicitation ...; or (b) Is any successor in interest to an actual consumer who purchased the defendant's goods, services, or property; or (c) In the course of the person's business or occupation, is injured as a result of such deceptive trade practice."

The key phrase for a scam victim is "actual or potential consumer of the defendant's goods, services, or property." Someone who paid for a fake product, a bogus repair or a sham investment fits that language more easily than someone who simply sent money to an impostor posing as a government agency or a grandchild.

The deceptive practice must happen in the course of a business

Section 6-1-105(1) defines deceptive trade practices as things a person does "in the course of the person's business, vocation, or occupation." The list (as printed in 2024) includes knowingly or recklessly making false representations about goods, services or property, falsely claiming sponsorship, approval, affiliation or connection with someone (the core of most impostor scams), and, since 2022, a catch-all: when a person "knowingly or recklessly engages in any unfair, unconscionable, deceptive, deliberately misleading, false, or fraudulent act or practice." A 2026 law (HB26-1426, effective August 12, 2026) reworded the lead-in to "an unfair or deceptive trade practice" and did not repeal those provisions.

The public-impact requirement

This is where many scam claims run into trouble. In Rhino Linings USA, Inc. v. Rocky Mountain Rhino Lining, Inc. (Colo. Jan. 13, 2003), the Colorado Supreme Court, quoting its earlier decision in Hall v. Walter, listed five things a private CCPA plaintiff must prove:

"(1) that the defendant engaged in an unfair or deceptive trade practice; (2) that the challenged practice occurred in the course of defendant's business, vocation, or occupation; (3) that it significantly impacts the public as actual or potential consumers of the defendant's goods, services, or property; (4) that the plaintiff suffered injury in fact to a legally protected interest; and (5) that the challenged practice caused the plaintiff's injury."

The court added that "if a wrong is private in nature, and does not affect the public, a claim is not actionable under the CCPA." It pointed to factors such as the number of consumers directly affected, their relative sophistication and bargaining power, and evidence that the practice has affected other consumers or could in the future.

In 2019 the legislature provided that a case brought by the Attorney General or a district attorney "does not require proof that a deceptive trade practice has a significant public impact" (section 6-1-103). That sentence does not mention private plaintiffs. A 2025 bill (SB25-157, which would have treated certain evidence as showing a significant public impact) lost in the Senate on April 1, 2025. What that means for a reader: a business running the same trick on many people may meet the test, but a one-off scammer who targeted only you, or who was not really running a "business," may not. We have not reviewed a Colorado appellate decision applying the test to a scam victim, so treat a CCPA claim against a lone scammer as uncertain and get advice from a Colorado lawyer before relying on it.

What you can recover

Section 6-1-113(2) sets the damages in an individual case (class actions and cases under section 6-1-709 follow different rules). A defendant found to have engaged in a deceptive trade practice is liable for:

"(a) The greater of: (I) The amount of actual damages sustained, including prejudgment interest ...; or (II) Five hundred dollars; or (III) Three times the amount of actual damages sustained, if it is established by clear and convincing evidence that such person engaged in bad faith conduct; plus (b) In the case of any successful action to enforce said liability, the costs of the action together with reasonable attorney fees as determined by the court."

Three points matter. Triple damages are not automatic: you must prove bad faith by clear and convincing evidence, and section 6-1-113(2.3) defines bad faith conduct as "fraudulent, willful, knowing, or intentional conduct that causes injury." The $500 is a floor that applies when your actual damages are smaller. And costs and attorney fees are part of the liability only in a successful action.

The risk runs the other way too. Under section 6-1-113(3), a person whose CCPA suit the court finds "frivolous, groundless and in bad faith, or for the purpose of harassment" must pay the defendant's costs and reasonable attorney fees.

The deadline and notice

Section 6-1-115 sets the clock: a CCPA action "must be commenced within three years after the date on which the false, misleading, or deceptive act or practice occurred or the date on which the last in a series of such acts or practices occurred or within three years after the consumer discovered or in the exercise of reasonable diligence should have discovered the occurrence." The period may be extended one year if the plaintiff proves the defendant's conduct was calculated to make them hold off on suing.

Sections 6-1-113 and 6-1-115 do not themselves require a demand letter before suing. We did not search the rest of the act for a notice requirement, so ask a lawyer before filing.

Who the act does not cover

Section 6-1-106 says the act does not apply to conduct that complies with the orders or rules of, or a statute administered by, a government agency, or to publishers and broadcasters who run deceptive material without knowing it is deceptive. How that first exception applies to a particular bank or other regulated defendant depends on the facts.

The honest limit

Even a strong claim needs a defendant you can identify, serve and collect from. That often works against a Colorado business, contractor or seller with a real address. It usually does not work against an anonymous scammer who called from a spoofed number or disappeared with crypto. Our guide on when a lawyer helps after a scam explains which situations are worth a consultation.

Protections for older adults in Colorado

Criminal exploitation reaches anyone who uses deception. Under C.R.S. 18-6.5-103(7.5)(a), "a person commits criminal exploitation of an at-risk person when he or she knowingly uses deception, harassment, intimidation, or undue influence to permanently or temporarily deprive an at-risk person of the use, benefit, or possession of any thing of value." It is a class 3 felony if the thing of value is $500 or more and a class 5 felony if it is less. The law treats anyone 70 or older as an at-risk elder, and its at-risk definitions also cover adults with a disability as the law defines it (section 18-6.5-102). Theft from an at-risk person, by someone who knows the victim is at-risk, is also a felony under section 18-6.5-103(5).

Some professionals must report, to the police, within 24 hours. Section 18-6.5-108 makes listed professionals mandatory reporters when they observe or have reasonable cause to believe an at-risk elder (70 or older) has been mistreated. The list includes personnel of banks, savings and loan associations, credit unions and other lending or financial institutions. They must report "to a law enforcement agency not more than twenty-four hours after making the observation or discovery." The Colorado Department of Human Services confirms that mandatory reporters of suspected mistreatment of an at-risk elder "must contact the law enforcement agency."

Anyone else can call the county. If you suspect an at-risk adult is being mistreated, the state's Adult Protective Services page says to "call the county department where the at-risk adult lives to make a report." APS uses its own definition of an at-risk adult (an adult who cannot perform or obtain needed services or lacks capacity), which is narrower than simply being 70 or older. The department says APS receives more than 25,000 reports of suspected mistreatment or self-neglect in Colorado each year.

Banks and credit unions may delay a payment (since August 12, 2026). Colorado's ASSET Act (HB26-1110, C.R.S. 11-113-101 to 108) took effect August 12, 2026, and applies to transactions attempted or occurring on or after that date. A bank or credit union "may delay a disbursement from an account" if it reasonably believes an eligible adult is being financially exploited. An eligible adult is someone 70 or older, or an adult 18 or older who is susceptible to mistreatment or self-neglect because they cannot perform or obtain services necessary for their health, safety or welfare, or lack the understanding or capacity to make or communicate responsible decisions. As soon as possible, and within two business days, the institution must give written notice of the delay and the reason to the people authorized on the account (except anyone it believes is doing the exploiting) and notify local law enforcement or the county adult protective services agency. The statute sets an initial period of up to 90 days, which can be extended another 90 days while a law enforcement or adult protective services investigation is pending, and a court can order the delay removed.

The delay is permissive: the law lets the institution act but does not require it to. It also covers only people 70 or older and defined vulnerable adults, so it does not help a younger scam victim. If you are worried about a parent's account, tell the bank directly that you suspect a scam.

Investment accounts have a separate hold rule. Since 2017, Colorado broker-dealers and investment advisers may delay a disbursement from the account of an eligible adult (70 or older, or a susceptible adult) under C.R.S. 11-51-1005. That delay generally expires 15 business days after it starts, or up to 25 business days if the securities commissioner asks for an extension, unless the commissioner or a court extends it further.

Higher penalties in state enforcement. In cases the Attorney General or a district attorney brings, section 6-1-112 sets a higher maximum civil penalty for a deceptive trade practice committed against an "elderly person," defined as 60 or older. That penalty is paid to the state, not to the victim. Section 6-1-112 was amended in 2026, and we have not confirmed the current dollar amounts.

For fraud against anyone 60 or older, the federal DOJ National Elder Fraud Hotline (833-372-8311) can also help you report. See our elder fraud guide for more.

Colorado scam laws on the books

Crypto ATMs (virtual currency kiosks)

The Colorado Vending of Digital Assets Act (SB25-079, C.R.S. 11-112-101 to 103) took effect January 1, 2026. It sets three rules a scam victim should know.

Daily limits. Under section 11-112-103(6), "for a new customer, the maximum daily transaction limit of a virtual currency kiosk is two thousand dollars per customer," and for an existing customer it is $10,500. A new customer is one who has been a customer of the kiosk's owner or operator for less than seven days.

A warning on the screen. The kiosk must display a warning on screen that includes this text: "WARNING: THIS TECHNOLOGY CAN BE USED TO DEFRAUD YOU. IF YOU HAVE BEEN DIRECTED TO THIS MACHINE BY SOMEONE CLAIMING TO BE A GOVERNMENT AGENT, BILL COLLECTOR, LAW ENFORCEMENT OFFICER, OR ANYONE YOU DO NOT KNOW PERSONALLY, STOP THIS TRANSACTION IMMEDIATELY AND CONTACT YOUR FINANCIAL ADVISOR AND LOCAL LAW ENFORCEMENT." The receipt must include a phone number for the operator to register complaints.

A narrow refund right. Section 11-112-103(7) requires the operator, at its own expense, to cancel and fully refund a transaction only if all three conditions are met:

1. It was the customer's first virtual currency transaction.
2. It went to a virtual currency wallet or exchange located outside the United States.
3. Within 60 days after the transaction, the customer contacted both the kiosk operator and a government or law enforcement entity about the fraud and submitted proof of the fraud, such as a police report or notarized declaration.

Once notified that the transaction was fraudulent, the operator must issue the full refund within 72 hours. If you paid a scammer through a crypto ATM in Colorado, keep the receipt and act inside the 60 days.

The act's text does not itself set a penalty, name an enforcing agency, or create a separate right to sue. Whether kiosk operators must also hold a Colorado money transmitter license is a question we could not confirm. See our crypto and investment scams guide for the federal side.

Notario and immigration-consultant scams

Under C.R.S. 6-1-727(3)(c), a nonattorney "engages in an unfair or deceptive trade practice in an immigration matter" (wording as amended by HB26-1426, effective August 12, 2026) by representing, in any language, that they are a "notario publico, notario, immigration assistant, immigration consultant, immigration specialist," or using any other title that implies legal expertise in immigration law. Because it is a deceptive trade practice under the CCPA, the private right to sue described above can apply, subject to the same public-impact requirement. See our guide to notario fraud.

Unwanted sales calls

Colorado runs its own no-call list. Section 6-1-904 bars telephone solicitations to residential and wireless subscribers who have added their number and zip code to the Colorado no-call list, and section 6-1-905 says the public utilities commission administers it. A residential subscriber who receives unlawful telephone solicitation is among the people who may sue under section 6-1-113(1)(a). Scammers ignore these lists, so treat a scam call as a scam, not a sales call. Our phishing, smishing and vishing guide covers what to do if you answered or clicked.

Suing a scammer or a business in Colorado

Small claims court. Section 13-6-403(1)(a) lets small claims court hear cases where the amount claimed, "exclusive of interest and costs, does not exceed seven thousand five hundred dollars, including such civil penalties as may be provided by law." Individuals represent themselves there (section 13-6-407(2)(a)(I)). The Colorado Judicial Branch's small claims page confirms the $7,500 limit and notes that if you file for a larger amount, you can collect only $7,500 if you win.

Deadlines. A CCPA claim has the three-year limit above. A fraud claim generally must also be brought within three years after it accrues (C.R.S. 13-80-101(1)(c)), and under section 13-80-108(3) a fraud claim accrues "on the date such fraud, misrepresentation, concealment, or deceit is discovered or should have been discovered by the exercise of reasonable diligence." Our Colorado statute of limitations guide covers other civil deadlines.

Who you can actually reach. Lawsuits work against people and businesses with a name, an address and assets. A scammer who hid behind a fake identity, a spoofed caller ID or an overseas account is usually not reachable through a Colorado court. In those cases the payment company, a fast report to law enforcement, and protecting your identity are where your effort pays off.

Related guides

• Scams and fraud: your rights and where to start
• How to get money back after a scam
• Where to report a scam
• Government impersonation scams
• Tech support and fake invoice scams
• Money mule and fake check scams
• Colorado identity theft laws
• Colorado debt collection laws
• Colorado statute of limitations

Last updated: October 2, 2026.

This article is general legal information, not legal advice. For your specific situation, contact your payment company, the Colorado office named above, or a lawyer licensed in Colorado.

Frequently Asked Questions

Can I sue a scammer in Colorado?

Possibly, if you can identify and serve them. The Colorado Consumer Protection Act (C.R.S. 6-1-113) lets an actual or potential consumer injured by a deceptive trade practice sue, but courts also require the practice to significantly impact the public, so a claim against a scammer who targeted only you is uncertain. An anonymous or overseas scammer is usually not reachable through a Colorado court.

Does the Colorado Consumer Protection Act award triple damages?

Only if you prove by clear and convincing evidence that the defendant engaged in bad faith conduct, meaning fraudulent, willful, knowing or intentional conduct that causes injury. Otherwise a successful plaintiff recovers the greater of actual damages or $500 (C.R.S. 6-1-113(2)).

What is the significant public impact requirement?

The Colorado Supreme Court requires a private CCPA plaintiff to show the deceptive practice significantly impacts the public as actual or potential consumers (Rhino Linings, 2003). A wrong that is private in nature and does not affect the public is not actionable under the CCPA. The requirement does not apply to suits by the Attorney General or a district attorney.

How long do I have to sue under the Colorado Consumer Protection Act?

Three years from the deceptive act (or the last in a series), or three years from when you discovered or reasonably should have discovered it, under C.R.S. 6-1-115. It can be extended one year if the defendant's conduct was calculated to make you delay.

Will the Colorado Attorney General get my money back?

Do not expect it. The office says it cannot investigate or prosecute your individual case, though it may try to resolve selected complaints against businesses through its Consumer Mediation Program. Contact your payment company for a reversal.

Who do I call if an elderly person in Colorado is being scammed?

Call the county human services department where the adult lives to reach Adult Protective Services, and contact local police. Bank and credit union staff and other mandatory reporters must report suspected mistreatment of someone 70 or older to law enforcement within 24 hours (C.R.S. 18-6.5-108). The DOJ Elder Fraud Hotline (833-372-8311) helps with fraud against anyone 60 or older.

Can a Colorado bank stop a payment if it suspects elder fraud?

Since August 12, 2026, a bank or credit union may delay a disbursement from the account of someone 70 or older, or a defined vulnerable adult, if it reasonably believes the person is being financially exploited. It must notify the account parties and law enforcement or adult protective services within two business days. The law permits a delay; it does not require one.

What are Colorado's crypto ATM limits?

Since January 1, 2026, a virtual currency kiosk may take no more than $2,000 a day from a new customer (a customer for less than seven days) and $10,500 a day from an existing customer (C.R.S. 11-112-103(6)).

Can I get a refund from a Colorado crypto ATM after a scam?

Only in a narrow case: it was your first virtual currency transaction, it went to a wallet or exchange outside the United States, and within 60 days you contacted both the operator and a government or law enforcement entity and submitted proof of the fraud, such as a police report. The operator must then refund in full within 72 hours.

What is the small claims limit in Colorado?

$7,500, excluding interest and costs, under C.R.S. 13-6-403, as the Colorado Judicial Branch's small claims page confirms.