Virginia Scam and Fraud Laws: Where to Report, Your Right to Sue (2026)

Virginia's consumer protection law, the Virginia Consumer Protection Act (VCPA), lets "any person who suffers loss" from a violation sue for their actual damages or $500, whichever is greater, and up to three times their actual damages (or $1,000, whichever is greater) if the violation was willful. The catch is who it reaches: the act covers a "supplier" that commits one of its listed prohibited practices "in connection with a consumer transaction," and it does not apply to banks, credit unions and other regulated financial institutions. Whether a particular scammer counts as a supplier depends on the facts.

Virginia also lets a bank or credit union delay a transaction for up to 30 business days when it believes in good faith that an older or incapacitated customer is being financially exploited, and a new Virginia law on cryptocurrency kiosks takes effect on July 1, 2027. Scam complaints about businesses go to the Virginia Attorney General, while complaints about state-chartered banks and credit unions and about investment fraud go to the State Corporation Commission.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers Virginia state law: the Virginia Consumer Protection Act (Virginia Code Title 59.1, Chapter 17), Virginia complaint offices, Virginia protections for older and incapacitated adults, Virginia's anti-phishing crime, its coming crypto kiosk law, and Virginia court limits and deadlines. Federal refund and reporting rights are summarized briefly and covered in depth on our national guides. Out of scope: criminal defense, and the law of other states (if the scammer or business is elsewhere, that state's law may also matter).

First steps if you were scammed in Virginia

Contact the bank, card issuer, payment app, wire company or crypto exchange that moved your money right away, since that company is usually the one that can stop or reverse a payment. Your federal rights depend on how you paid; our guide on how to get money back after a scam walks through each payment method, and the Zelle and payment app guide covers app transfers.

Then report the scam. Most scams go to the FTC at ReportFraud.ftc.gov and online crime to the FBI's IC3; our where to report a scam guide lists every federal channel. The Virginia offices below are in addition to those, not instead of them.

Where to report a scam in Virginia

The Attorney General's office says plainly that "Banks and other regulated financial institutions are exempt from the Virginia Consumer Protection Act, which this office enforces," and it points bank complaints to the State Corporation Commission. For a national bank or federal credit union, the federal regulators handle complaints instead; our where to report a scam guide covers those.

Be realistic about what a complaint does. The State Corporation Commission says its staff "may not act as the complainant's attorney" and "does not have the power to adjudicate complaints." A complaint is a report that can lead to enforcement, not a refund request. If you want your money back, the payment company and, against a business you can identify, a lawsuit are the routes that can produce it. If the business is based in another state, the Virginia Attorney General notes that the attorney general or consumer protection office in that state "has the greatest chance of obtaining a satisfactory result."

Virginia's consumer protection law: can you sue?

Sometimes, against the right defendant. Section 59.1-204(A) gives the right to sue:

"Any person who suffers loss as the result of a violation of this chapter shall be entitled to initiate an action to recover actual damages, or $500, whichever is greater. If the trier of fact finds that the violation was willful, it may increase damages to an amount not exceeding three times the actual damages sustained, or $1,000, whichever is greater."

Who can sue, and who can be sued

The plaintiff side is broad. The VCPA does not limit suits to a defined "consumer"; it says "any person who suffers loss," and "person" includes individuals and businesses (section 59.1-198).

The defendant side is narrower. Section 59.1-200(A) makes certain listed practices unlawful when committed by a "supplier" "in connection with a consumer transaction." A supplier is "a seller, lessor, licensor, or professional that advertises, solicits, or engages in consumer transactions" (or a manufacturer or distributor selling goods for resale in consumer transactions). A consumer transaction includes "the advertisement, sale, lease, license, or offering for sale, lease, or license, of goods or services to be used primarily for personal, family, or household purposes."

That fits a dishonest seller, contractor or service company. Whether it fits an impostor who called pretending to be from the government, a romance scammer, or a fake investment platform depends on the facts, because those schemes often involve no real sale of goods or services. A Virginia lawyer can tell you whether your situation fits.

Who the VCPA does not cover

Section 59.1-199 lists exclusions. Among them, the act does not apply to:

"Banks, savings institutions, credit unions, small loan companies, public service corporations, mortgage lenders ..., broker-dealers ..., gas suppliers ..., and insurance companies regulated and supervised by the State Corporation Commission or a comparable federal regulating body."

The act also excludes "those aspects of a consumer transaction that are regulated by the Federal Consumer Credit Protection Act," and "any aspect of a consumer transaction which aspect is authorized under laws or regulations of the Commonwealth or the United States." In practice, if your complaint is that your bank or credit union refused to refund a scam payment, the VCPA is generally not the route; your federal rights and the bank's regulator are.

What you can recover

• Damages: your actual damages or $500, whichever is greater.
• Willful violations: the court or jury "may" increase damages to not more than three times actual damages, or $1,000, whichever is greater. This is a ceiling that depends on a finding of willfulness.
• Attorney's fees: under section 59.1-204(B), a person who suffers loss "also may be awarded reasonable attorneys' fees and court costs." The word is "may," so the court decides.

Two limits on that. First, a supplier can make a written "cure offer" before its first responsive pleading. If you reject it and the actual damages you are awarded do not exceed its value, the supplier "shall not be liable for such person's attorneys' fees and court costs incurred following delivery of the cure offer" (section 59.1-204(C)). If you accept a cure offer, you cannot bring another suit substantially based on the same facts (section 59.1-204(A)). Second, under section 59.1-207, a supplier that proves a violation resulted from a bona fide error despite procedures reasonably adopted to avoid it (or was its manufacturer's or distributor's act it could not control) is not liable, though the court can still order restitution and attorney's fees and costs.

Section 59.1-204 itself does not require a private plaintiff to send a pre-suit demand letter. The written-notice requirement in section 59.1-203 applies to enforcement suits by the Attorney General, Commonwealth's attorneys and local government attorneys.

The deadline

Under section 59.1-204.1(A), a VCPA suit "shall be commenced within two years after such accrual." For VCPA claims "based upon any misrepresentation, deception, or fraud," section 8.01-249(1) says the claim accrues when the fraud "is discovered or by the exercise of due diligence reasonably should have been discovered." Time while a government agency's VCPA suit is pending does not count against you (section 59.1-204.1(B)).

Protections for older adults in Virginia

Exploiting a vulnerable adult is larceny. Virginia Code section 18.2-178.1 makes it unlawful for a person who knows or should know that someone is a vulnerable adult to, "through the use of that other person's impairment, take, obtain, or convert money or other thing of value belonging to that other person with the intent to permanently deprive him thereof," and says the person "shall be deemed guilty of larceny." A vulnerable adult is a person 18 or older whose impairment, including from age, leaves them lacking "sufficient understanding or capacity to make, communicate, or carry out reasonable decisions concerning his well-being" or with limitations that "substantially impair the adult's ability to independently provide for his daily needs or safeguard his person, property, or legal interests" (section 18.2-369). It is not a law about every person over a certain age; it turns on impairment. Virginia's general false pretenses law (section 18.2-178) also treats obtaining money "by any false pretense or token" with intent to defraud as larceny.

Report exploitation to adult protective services. Virginia's adult protective services law covers "any person 60 years of age or older, or any person 18 years of age or older who is incapacitated" (section 63.2-1603). Its definition of financial exploitation includes "forcing or coercing an adult to pay for goods or services against his will for another's profit, benefit, or advantage if the adult did not agree, or was tricked, misled, or defrauded into agreeing." Section 63.2-1606 requires certain professionals to report, including health care providers, law enforcement, guardians and paid caregivers. Anyone else can report to the local department of social services, and a person who reports in good faith is immune from liability unless they "acted in bad faith or with a malicious purpose."

Banks may report, and may delay the money. Bank and credit union staff are not on the list of mandated reporters, but section 63.2-1606(C) says "any financial institution staff who suspects that an adult has been exploited financially may report such suspected financial exploitation." Section 63.2-1606(L) lets staff refuse or delay a transaction, or refuse to disburse funds, when they believe in good faith it may involve financial exploitation of an adult:

"The financial institution staff may continue to refuse to execute a transaction, delay a transaction, or refuse to disburse funds for a period no longer than 30 business days after the date upon which such transaction or disbursement was initially requested ... unless otherwise ordered by a court of competent jurisdiction."

The institution must report the refusal or delay within five business days to the local department of social services or the adult protective services hotline. The power is permissive: a bank may hold the money, but the statute does not require it to. If you are worried about a parent's account, tell the bank directly that you suspect a scam. Separately, section 6.2-103.1 requires financial institutions to cooperate with a local department of social services investigating suspected exploitation.

For fraud against anyone 60 or older, the federal DOJ National Elder Fraud Hotline (833-372-8311) can also help you report; see where to report a scam.

Virginia scam laws on the books

Phishing is a felony

Section 18.2-152.5:1(A) makes it "unlawful for any person ... to use a computer to obtain, access, or record, through the use of material artifice, trickery or deception, any identifying information," and makes it a Class 6 felony. Selling or distributing the information, or using it to commit another crime, is a Class 5 felony (subsections B and C). For how phishing, smishing and vishing work and what to do if you clicked, see our phishing guide.

Crypto ATMs (virtual currency kiosks): new rules from July 1, 2027

In 2026 Virginia enacted a licensing law for virtual currency kiosks (Virginia Code Title 6.2, Chapter 22.2, sections 6.2-2239 through 6.2-2266). Every section takes effect on July 1, 2027, so none of these protections applies to a kiosk transaction made before then. Once in force:

• License required. A kiosk operator needs a license from the State Corporation Commission, and "any virtual currency transaction made in violation of this section is void" (section 6.2-2241).
• Transaction caps. A licensee may not accept more than $2,000 a day from a new user; the daily limit for any user is $5,000 and the monthly limit is $10,000 (section 6.2-2255). A new user is someone in the 14 days after their first kiosk transaction.
• 48-hour hold. A licensee must hold each new user's transaction for at least 48 hours, and during that time "the new user may contact the licensee to request the cancellation and full refund of such transaction" (section 6.2-2255).
• Fee cap. Charges may not exceed 18 percent of the value of the transaction (section 6.2-2256).
• Fraud refunds. In cases related to fraud, a licensee must refund the user's "transaction fees" (section 6.2-2254(F)). To get the refund, the user must tell the operator about the fraud within 90 days and submit a police report, government agency report or sworn statement within 120 days. The text refers to transaction fees; whether it also requires a refund of the money sent is not clear from the statute, so do not count on it.
• Warnings. Kiosks must display a warning that begins "WARNING: This technology can be used to defraud you." (section 6.2-2253).
• A right to sue. Under section 6.2-2266, any violation of the chapter "shall constitute a prohibited practice" under the VCPA, so a person who suffers a loss as a result of a kiosk operator breaking these rules can use the VCPA's private lawsuit described above.

If you lost money at a crypto ATM, report it right away to the kiosk operator, local police, and the federal channels in our crypto and investment scams guide.

Door-to-door sales: three days to cancel

For a sale made "at any residence other than that of the seller without prior invitation or appointment" (cash sales under $25 excepted), the buyer may cancel "until midnight of the third business day after the day on which the buyer signs an agreement or offer to purchase," by written notice (sections 59.1-21.2 and 59.1-21.3). Some sales are excluded, including those made after prior negotiations, and the right can be lost if you signed a dated emergency request waiving it and the seller has substantially begun the work.

Suing a scammer or a business in Virginia

Small claims court. Virginia's small claims court hears civil money claims "when the amount claimed does not exceed $5,000, exclusive of interest" (section 16.1-122.2), sharing that jurisdiction with the general district court. General district court hears larger claims, with jurisdiction up to $50,000, exclusive of interest and attorney fees, shared with circuit court above $4,500 (section 16.1-77(1)).

Deadlines. A VCPA claim has the two-year limit above. A common-law fraud claim also has a short clock: section 8.01-243(A) says "every action for damages resulting from fraud, shall be brought within two years after the cause of action accrues," and under section 8.01-249(1) a fraud claim accrues when the fraud is discovered or reasonably should have been. Our Virginia statute of limitations guide covers other civil deadlines.

Who you can actually reach. Lawsuits work against people and businesses with a name, an address and assets. A scammer who hid behind a fake identity, a spoofed caller ID or an overseas account is usually not reachable through a Virginia court. In those cases the payment company, a fast report to law enforcement, and protecting your identity are where your effort pays off. Our guide on when a lawyer helps after a scam explains when legal help is worth it.

Related guides

• Scams and fraud: your rights and where to start
• How to get money back after a scam
• Where to report a scam
• Elder fraud
• Crypto and investment scams
• Virginia identity theft laws
• Virginia debt collection laws
• Virginia statute of limitations

Last updated: October 2, 2026.

This article is general legal information, not legal advice. For your specific situation, contact your payment company, the Virginia office named above, or a lawyer licensed in Virginia.

Frequently Asked Questions

Can I sue a scammer in Virginia?

Possibly, if you can identify and serve them and they are a supplier who committed a prohibited practice in a consumer transaction. The VCPA (Virginia Code section 59.1-204) lets any person who suffers loss sue for actual damages or $500, whichever is greater, but whether a particular scammer is a supplier depends on the facts, and an anonymous or overseas scammer is usually not reachable through a Virginia court.

Does the Virginia Consumer Protection Act award triple damages?

Only if the court or jury finds the violation was willful. It may then increase damages to not more than three times actual damages, or $1,000, whichever is greater (section 59.1-204(A)); it is a ceiling, not automatic.

Can I sue my bank under the Virginia Consumer Protection Act?

Generally no. Section 59.1-199 says the VCPA does not apply to banks, savings institutions, credit unions and similar regulated companies. Complaints about a Virginia-chartered bank or credit union go to the State Corporation Commission's Bureau of Financial Institutions.

How long do I have to file a VCPA claim in Virginia?

Two years after the claim accrues (section 59.1-204.1). For claims based on misrepresentation, deception or fraud, it accrues when the fraud is discovered or reasonably should have been discovered (section 8.01-249(1)).

Does the VCPA pay my attorney's fees?

It may. Section 59.1-204(B) says a person who suffers loss may be awarded reasonable attorneys' fees and court costs, at the court's discretion. If you reject a timely cure offer and win no more than its value, the supplier is not liable for fees incurred after the offer.

Where do I report a scam in Virginia?

Complaints about businesses go to the Virginia Attorney General's Consumer Protection Section online or at 1-800-552-9963 (from Virginia). Problems with a Virginia-chartered bank or credit union go to the State Corporation Commission's Bureau of Financial Institutions (national banks and federal credit unions go to federal regulators), and investment fraud to the State Corporation Commission. Also report to the FTC and, for online crime, the FBI's IC3.

Can a Virginia bank stop a transaction if it suspects elder fraud?

Yes, it may. Under section 63.2-1606(L), staff who believe in good faith that a transaction may involve financial exploitation of an adult 60 or older or an incapacitated adult may refuse or delay it for up to 30 business days, and must report the delay within five business days. The law permits a hold; it does not require one.

Does Virginia regulate crypto ATMs?

Yes, starting July 1, 2027. Virginia Code sections 6.2-2239 through 6.2-2266 will require kiosk operators to be licensed, cap new users at $2,000 a day, hold new-user transactions for 48 hours, and cap fees at 18 percent. This kiosk law does not apply to transactions made before that date.

What is the small claims limit in Virginia?

Virginia small claims court hears civil money claims of not more than $5,000, excluding interest (Virginia Code section 16.1-122.2).