Oklahoma Scam and Fraud Laws: Where to Report, Your Right to Sue (2026)

Oklahoma's consumer protection law, the Oklahoma Consumer Protection Act (OCPA), gives an "aggrieved consumer" a private right to sue a person who committed one of the act's unlawful practices "in the course of the person's business." A consumer who wins recovers actual damages plus costs of litigation, including reasonable attorney's fees, and up to $2,000 more per violation if the court also finds the practice unconscionable. The act does not triple damages, and it does not apply to transactions regulated by another state or federal regulator, which can matter if your claim is against a bank.

Oklahoma also has a crypto ATM law in force since November 1, 2025, with a $2,000 daily limit for new customers, a 15% fee cap, and a full refund for a defrauded new customer who reports to both the kiosk operator and the Attorney General within 14 days. A separate law letting banks put a temporary hold on suspected exploitation of older customers takes effect on November 1, 2026.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers Oklahoma state law: the Oklahoma Consumer Protection Act (Title 15), Oklahoma complaint offices, Oklahoma protections for older and vulnerable adults, Oklahoma's crypto kiosk, anti-phishing and telemarketing laws, and Oklahoma court deadlines for suing. Federal refund and reporting rights are summarized briefly and covered in depth on our national guides. Out of scope: criminal defense, and the law of other states (if the scammer or business is elsewhere, that state's law may also matter).

First steps if you were scammed in Oklahoma

Contact the bank, card issuer, payment app, wire company or crypto exchange that moved your money right away, since that company is usually the one that can stop or reverse a payment. Your federal rights depend on how you paid; our guide on how to get money back after a scam walks through each payment method, and the Zelle and payment app guide covers app transfers.

If you paid at a crypto ATM, do one more thing immediately: report the fraud to the kiosk operator and to the Oklahoma Attorney General. Oklahoma's kiosk refund depends on both reports being made within 14 days (see the crypto ATM section below).

Then report the scam to federal agencies as well. Most scams go to the FTC at ReportFraud.ftc.gov and online crime to the FBI's IC3; our where to report a scam guide lists every federal channel. The Oklahoma offices below are in addition to those, not instead of them.

Where to report a scam in Oklahoma

The Attorney General's Consumer Protection Unit describes its job as "mediation of consumer complaints and taking legal action when necessary against individuals or businesses engaged in deceptive, fraudulent or unfair advertising or sales practices." It adds: "In many cases, the dispute can be resolved over the phone by a consumer representative or through a written mediation process." You can also reach the unit by email at ConsumerProtection@oag.ok.gov.

Mediation works best against a business with a name and an address that wants to keep its reputation. It is unlikely to reach an anonymous scammer, so treat a complaint as a report and a record, and keep working with your payment company in parallel.

The Banking Department notes that it regulates "Banks, Credit Unions, Trust Companies, Savings and Loans, Money Order Companies and Money Transmission Companies," but "we do not regulate each and every one you might find in Oklahoma. Some have federal regulators, while others are regulated by agencies in other states." It also says that "all money transmission companies operating in Oklahoma should be licensed by the Oklahoma State Banking Department," which includes crypto kiosk operators.

Oklahoma's consumer protection law: can you sue?

Sometimes. The private remedy is in 15 O.S. section 761.1(A), which makes a violation of the act render the violator:

"liable to the aggrieved consumer for the payment of actual damages sustained by the customer and costs of litigation including reasonable attorney's fees, and the aggrieved consumer shall have a private right of action for damages, including but not limited to, costs and attorney's fees."

Who can sue, and whom

Three limits decide whether the OCPA fits a scam.

The defendant must have acted in the course of business. Section 753 declares a practice unlawful when, "in the course of the person's business," the person does one of the things it lists. The list includes creating a false impression of being affiliated with a state agency, misrepresenting a mail solicitation as an invoice or billing statement, and committing "an unfair or deceptive trade practice" as defined in section 752. A fake business, a dishonest contractor or a seller that billed you for something you never ordered fits this language more naturally than a lone impostor who simply asked you for money. We have not found an Oklahoma court decision applying this phrase to an impostor scam, so do not assume either way.

You must be an "aggrieved consumer." The act does not define "consumer." It defines a "consumer transaction" broadly, as the advertising, offering for sale or purchase, sale, purchase or distribution of any services or property "for purposes that are personal, household, or business oriented," and it defines a deceptive trade practice as one that "has deceived or could reasonably be expected to deceive or mislead a person to the detriment of that person," which "may occur before, during or after a consumer transaction." Whether someone who sent money to a scammer without buying anything counts as an aggrieved consumer is a question the act does not answer and we have not found an Oklahoma case deciding. The Oklahoma Supreme Court lists four elements of a private OCPA claim, including that the challenged practice occurred in the course of the defendant's business and that the plaintiff, "as a consumer, suffered an injury in fact" (Patterson v. Beall, 2000 OK 92).

Regulated transactions are excluded. Section 754 says nothing in the act applies to:

"Actions or transactions regulated under laws administered by the Corporation Commission or any other regulatory body or officer acting under statutory authority of this state or the United States, or to acts done by retailers or other persons acting in good faith on the basis of information or matter supplied by others and without knowledge of the deceptive character of such information or matter"

Banks, credit unions and licensed money transmitters are regulated by state or federal agencies, so an OCPA claim against one of them may run into this exclusion. Your rights against a bank or payment company usually come from federal payment law and your account agreement instead (see how to get money back after a scam and what to do if your bank refused a scam refund).

What you can recover

A consumer who wins recovers actual damages, meaning the money actually lost, plus costs of litigation including reasonable attorney's fees. Section 761.1 does not contain a damages multiplier or punitive damages.

There is one add-on. Under section 761.1(B), if the unlawful practice "is also found to be unconscionable," the violator is liable to the aggrieved customer for "a civil penalty, recoverable in an individual action only, in a sum set by the court of not more than Two Thousand Dollars ($2,000.00) for each violation." One factor in deciding unconscionability is whether the violator "knowingly or with reason to know, took advantage of a consumer reasonably unable to protect his or her interests because of his or her age, physical infirmity, ignorance, illiteracy, inability to understand the language of an agreement or similar factor." That factor speaks directly to scams aimed at older people.

Separately, in a case the Attorney General or a district attorney brings, section 761.1(C) allows a civil penalty of not more than $10,000 per violation. That is an enforcement penalty, not money paid to the victim.

The risk of losing

The fee rule cuts both ways. Section 761.1 directs the court to determine whether a claim or defense asserted by the losing party was asserted in bad faith, was not well grounded in fact, or falls within the other grounds the section lists, and if so to order that party "to reimburse the prevailing party an amount not to exceed Ten Thousand Dollars ($10,000.00)." A weak or unsupported OCPA claim can cost you money.

Notice and deadline

Section 761.1 itself does not require a demand letter or other notice before you sue.

The OCPA also does not set its own filing deadline. Oklahoma's general limitation statute, 12 O.S. section 95(A), allows three years for "an action upon a liability created by statute other than a forfeiture or penalty" and two years for "an action for relief on the ground of fraud," with a fraud claim not accruing "until the discovery of the fraud." We have not confirmed which period Oklahoma courts apply to OCPA claims. Section 95(A)(4) also allows only one year for "an action upon a statute for penalty or forfeiture," which could apply to the $2,000 civil penalty, so the cautious approach is to act within one year if you may seek that penalty, and well within two years in any case.

Protections for older adults in Oklahoma

Exploitation is a felony, but the statute has limits. Under 21 O.S. section 843.4, an "elderly person" is "any person sixty-two (62) years of age or older." The crime reaches a person who exploits an elderly person or disabled adult while standing "in a position of trust and confidence" or having "a business relationship" with them, and any person who obtains or uses their funds while knowing or when they "reasonably should know that the elderly person or disabled adult lacks the capacity to consent." Exploitation of $100,000 or more is a Class C1 felony; less than $100,000 is a Class C2 felony, each with a fine of up to $10,000.

That means a stranger who phones a capable 70-year-old and talks them into sending money is not clearly covered by section 843.4. Other fraud laws can still apply to that scammer. Section 843.3 separately makes exploitation of a vulnerable adult a Class B4 felony.

Everyone must report exploitation of a vulnerable adult. Under 43A O.S. section 10-104, "Any person having reasonable cause to believe that a vulnerable adult is suffering from abuse, neglect, or exploitation shall make a report as soon as the person is aware of the situation to: 1. The Department of Human Services; 2. The Office of Client Advocacy within the State Department of Health; or 3. The municipal police department or sheriff's office." Failing to report is a misdemeanor; the statute sets maximum penalties of one year and $1,000.

"Vulnerable adult" is not an age category. It covers an incapacitated person or someone who, because of a physical or mental disability, incapacity or other disability, "is unable to manage his or her property and financial affairs effectively," among others. "Exploitation" includes the improper use of a vulnerable adult's resources "through the use of undue influence, coercion, harassment, duress, deception, false representation or false pretense" (43A O.S. section 10-103), which describes many scams.

Adult Protective Services. Oklahoma Human Services' APS program "assists adults who need help taking care of themselves, and who may be experiencing maltreatment." Its page lists 1-800-522-3511. For fraud against anyone 60 or older, the federal DOJ National Elder Fraud Hotline (833-372-8311) can also help you report; see our elder fraud guide.

Bank holds take effect November 1, 2026

Senate Bill 2067 was approved by the Governor on May 6, 2026, and "shall become effective November 1, 2026." Until then, the hold rules below do not apply. Once in force, the law:

• Covers a "protected adult," meaning "an individual sixty-two (62) years of age or older" or an incapacitated or vulnerable adult.
• Lets a financial institution place a temporary hold on a transaction or disbursement from a protected adult's account if it believes financial exploitation "has occurred, is occurring, has been attempted, is being attempted, or will be attempted." It must give notice of the hold "immediately, but in no event more than three (3) business days after the date the temporary hold is first placed."
• Ends the hold "not later than ten (10) business days" after it is placed, unless it is extended to no later than 20 business days because the institution's internal review supports its belief or an agency asks. An agency or court may end or extend a hold.
• Requires an institution that reasonably believes exploitation occurred to "promptly notify one or more of the proper agencies" (Oklahoma Human Services, a district attorney or law enforcement), and lets it notify a customer's trusted contact.

The law does not force a hold: "Nothing in this subsection shall require an institution to place a temporary hold." If you are worried about a parent's account, telling the bank directly that you suspect a scam gives it the information it needs to act.

Oklahoma scam laws on the books

Crypto ATMs (digital asset kiosks)

Senate Bill 1083 (Laws 2025, chapter 363) became law over the Governor's veto: the bill was vetoed on May 22, 2025, and the Senate (37 to 9) and House (78 to 4) overrode the veto. Its rules, codified at 6 O.S. sections 1520 and 1520.1, have been in force since November 1, 2025. For how these scams work, see our crypto and investment scams guide.

Refunds for new customers. Section 1520.1(G)(3) says the operator "shall issue a refund to a new customer for the full amount of all fraudulent transactions, including all transaction fees and charges that were charged to the customer pursuant to subsection I of this section, made while a new customer." The condition is strict:

"To receive a refund under this section, a new customer shall have been fraudulently induced to engage in the digital asset transactions and shall contact the digital asset kiosk operator and the Office of the Attorney General to report the fraudulent nature of the transactions within fourteen (14) days of the last fraudulent transaction to occur while the customer was a new customer."

A "new customer" is someone who had never transacted with a kiosk operator before, and only during the 72 hours after their first transaction. A customer who is not new can get back only the "transaction fees and charges," on request, and only if they were fraudulently induced and report to both the operator and the Attorney General within 14 days of the transaction (section 1520.1(G)(4)). Use the Attorney General's cryptocurrency kiosk complaint page for the report to the Attorney General.

Limits on the machine. An operator "shall not accept transactions of more than Two Thousand Dollars ($2,000.00), or the equivalent in digital assets, in a single day" with a new customer (section 1520.1(H)), and total fees and spread may not exceed 15% (section 1520.1(I)). The law requires a warning that begins "WARNING: LOSSES DUE TO FRAUDULENT OR ACCIDENTAL TRANSACTIONS ARE NOT RECOVERABLE AND TRANSACTIONS IN DIGITAL ASSETS ARE IRREVERSIBLE." Operators must also offer live customer service "Monday through Friday from 8:00 a.m. CST to 10:00 p.m. CST."

Licensing. A kiosk operator must be licensed in Oklahoma as a money transmitter. Operating without a license is a misdemeanor, punishable by a fine of $600 to $2,000 per violation or 30 days to one year in county jail, and the kiosk may be seized at the Attorney General's direction. A customer "fraudulently induced to engage in digital asset transactions" at a kiosk operated in violation of the licensing requirement "may file a civil suit against the digital asset kiosk operator for the amount of any losses sustained" (section 1520.1(A)(4)). That lawsuit right applies to an unlicensed operator.

Two 2026 bills are not law: Senate Bill 1915, which would have touched section 1520.1, was only read and referred to committee, and House Bill 3020, on a similar subject to SB 2067, stopped after a committee vote and was never enrolled.

The Anti-Phishing Act

Oklahoma's Anti-Phishing Act, 15 O.S. sections 776.8 to 776.12, bars creating "a web page or Internet domain name that is represented as a legitimate online business without the authorization of the registered owner of the business" and using it to solicit identifying information, with intent to fraudulently use that information (section 776.10). The act's own lawsuit right in section 776.11 belongs to internet access providers and to web page or trademark owners who are adversely affected, not to individual victims. But section 776.11(F) makes every violation also a violation of the OCPA, so a victim's route is the OCPA, with the limits described above. For what to do if you clicked a phishing link, see our phishing guide.

Caller ID spoofing. Under 15 O.S. section 776.23, a person who "knowingly inserts false information" into caller identification "with the intent to mislead, defraud or deceive" commits a misdemeanor, punishable by up to one year or a fine of "not more than Ten Thousand Dollars ($10,000.00) per incident." That conduct is also an OCPA violation.

Telemarketing and scam calls

• Seller registration. "No commercial telephone seller shall conduct business in this state without having registered with the Attorney General at least ten (10) days prior" (15 O.S. section 775A.3(A)).
• State do-not-call registry. The Telemarketer Restriction Act creates a statewide registry for consumers who do not want unsolicited telemarketing sales calls or messages, including text messages (section 775B.3). A willful violation is an OCPA violation. The Attorney General's complaint pages include a link to the registry.
• Telephone Solicitation Act of 2022. It bars covered calls before 8 a.m. or after 8 p.m. and bars spoofed caller ID (section 775C.4). A called party who is aggrieved by a violation may sue to recover "actual damages or Five Hundred Dollars ($500.00), whichever is greater," and the award may be increased up to three times if the violation was willful or knowing (section 775C.6).

Door-to-door credit sales

Under Oklahoma's Uniform Consumer Credit Code (14A O.S. sections 2-501 and 2-502), a buyer in a consumer credit sale of goods or services solicited at the buyer's home may cancel "until midnight of the third business day." It covers credit sales, not cash purchases. Separately, the federal FTC Cooling-Off Rule (16 C.F.R. part 429) generally lets a buyer cancel a door-to-door sale of $25 or more made at the buyer's home until midnight of the third business day after the sale, however it was paid for.

Suing a scammer or a business in Oklahoma

Small claims. Oklahoma small claims procedure covers "actions for the recovery of money based on contract or tort" where the amount sought, "exclusive of attorney fees and other court costs, does not exceed Ten Thousand Dollars ($10,000.00)" (12 O.S. section 1751(A)(1)). That is the usual place for a modest claim against a business or an individual you can identify and serve.

Deadlines. A common-law fraud claim must be brought within two years, and it does not accrue "until the discovery of the fraud" (12 O.S. section 95(A)(3)). An OCPA claim's deadline is less certain, as explained above. Our Oklahoma statute of limitations guide covers other civil deadlines.

Who you can actually reach. Lawsuits work against people and businesses with a name, an address and assets. A scammer who hid behind a fake identity, a spoofed caller ID or an overseas account is usually not reachable through an Oklahoma court, and a judgment does not help if nobody can be found to pay it. In those cases the payment company, a fast report to law enforcement and, for crypto kiosks, the 14-day refund reports are where your effort pays off. Our guide on when a lawyer helps after a scam explains when legal help is worth it.

Related guides

• Scams and fraud: your rights and where to start
• How to get money back after a scam
• Where to report a scam
• Crypto and investment scams
• Elder fraud
• Phishing, smishing and vishing
• Oklahoma identity theft laws
• Oklahoma debt collection laws
• Oklahoma statute of limitations

Last updated: October 2, 2026.

This article is general legal information, not legal advice. For your specific situation, contact your payment company, the Oklahoma office named above, or a lawyer licensed in Oklahoma.

Frequently Asked Questions

Can I sue a scammer in Oklahoma?

Possibly, if you can identify and serve them. The Oklahoma Consumer Protection Act (15 O.S. section 761.1) lets an aggrieved consumer sue a person who committed an unlawful practice in the course of that person's business; the act does not define consumer, and it excludes transactions regulated by another regulator. An anonymous or overseas scammer is usually not reachable through an Oklahoma court.

Does the Oklahoma Consumer Protection Act award triple damages?

No. Section 761.1 provides actual damages plus costs and reasonable attorney's fees, with no multiplier or punitive damages. If the practice is also unconscionable, the court may add a civil penalty of up to $2,000 per violation, paid to the consumer.

Can I sue my bank under the Oklahoma Consumer Protection Act?

It may be difficult. Section 754(2) says the act does not apply to actions or transactions regulated by any state or federal regulatory body, which can include banks. Federal payment law and your account agreement are usually the main routes against a bank.

Do I have to send a demand letter before suing under the OCPA?

Section 761.1 does not require pre-suit notice. Be careful anyway: if the court finds your claim was asserted in bad faith or was not well grounded in fact, it must order you to reimburse the other side up to $10,000.

How long do I have to sue for fraud in Oklahoma?

Two years for a fraud claim, counted from when you discover the fraud (12 O.S. section 95(A)(3)). The OCPA has no deadline of its own, and which general period applies to it is not settled. A one-year limit for actions on a statute for a penalty (12 O.S. section 95(A)(4)) could apply to the OCPA's $2,000 civil penalty, so act within one year if you may seek that penalty, and well within two years in any case.

Can I get my money back from a crypto ATM in Oklahoma?

If you were a new customer, meaning within 72 hours of your first kiosk transaction, and were tricked into the transactions, the operator must refund the full amount including fees, but only if you report to both the operator and the Attorney General within 14 days of the last fraudulent transaction (6 O.S. section 1520.1). Other customers who were tricked can recover only the fees, and only if they report to both the operator and the Attorney General within 14 days of the transaction.

What are the crypto ATM limits in Oklahoma?

A kiosk operator may not accept more than $2,000 a day from a new customer, and total fees and spread are capped at 15%. Operators must be licensed as money transmitters by the Oklahoma State Banking Department.

Who do I call if an elderly person in Oklahoma is being scammed?

Contact Oklahoma Human Services Adult Protective Services (1-800-522-3511) or local police or the sheriff; anyone with reasonable cause to believe a vulnerable adult is being exploited must report it under 43A O.S. section 10-104. The DOJ Elder Fraud Hotline (833-372-8311) helps with fraud against anyone 60 or older.

Can an Oklahoma bank hold a transaction if it suspects elder fraud?

Starting November 1, 2026, Senate Bill 2067 lets a financial institution place a temporary hold, generally up to 10 business days and extendable to 20, when it believes a customer 62 or older is being financially exploited. The hold is optional, not required.

What is the small claims limit in Oklahoma?

Up to $10,000, not counting attorney fees and court costs, for money claims based on contract or tort (12 O.S. section 1751(A)(1)).