After Losing $30,000 to a Fake Microsoft Scam, Nashua Man Helps Drive New Hampshire Limits on Crypto ATMs

A Nashua man who lost $30,000 after calling a fake Microsoft support number has become a public advocate as New Hampshire moves to tighten consumer protections for cryptocurrency kiosks later this year.

How the Scam Worked

In 2022, Ken Heideman was preparing for a job interview and searched online for technical help. A pop-up on his computer directed him to a phone number he believed belonged to Microsoft. The person who answered convinced Heideman his bank accounts were at risk, kept him on the line for hours, and coached him to withdraw cash and deposit it into a cryptocurrency kiosk at a convenience store.

Daily withdrawal limits prevented him from turning over all his savings in one day. After telling his partner that night, Heideman realized it was a scam and contacted police. He later discovered his renter’s insurance included cybercrime coverage; with police reports, bank withdrawal records and kiosk receipts, AARP says he recovered $25,000 through that policy.

Image Credit: Samuel Boivin / Shutterstock.

New State Law: Senate Bill 482

Gov. Kelly Ayotte signed Senate Bill 482 on June 19; its protections take effect Dec. 16. Key provisions include:

• $2,000 Daily Limit — Operators cannot accept or dispense more than $2,000 per customer per calendar day across all kiosks under common control in the U.S.
• 48-Hour Hold on First Transaction — A customer’s first kiosk transaction must be held at least 48 hours. During that hold, the customer may cancel and receive a full refund before the cryptocurrency transfer completes.
• Refund Path for Fraud Victims — Customers fraudulently induced to make kiosk transactions may qualify for refunds (including fees) if they notify both the kiosk operator and a law enforcement or government agency within 14 days of the final fraudulent transaction.
• Fraud Warnings and Screening — Kiosks must display warnings that government agencies, courts, law enforcement, banks, utilities, tech support companies, employers and retailers do not demand payment via crypto ATMs. Machines must ask screening questions (including whether someone is coaching the customer); answers indicating possible fraud must block the transaction.
• Blockchain Analytics and Other Safeguards — Operators must use blockchain analytics to block transfers involving wallet addresses associated with scams, theft, sanctions or other illicit activity, and implement stronger identity verification, receipts, fee and price disclosures, and a dedicated communications channel for government agencies responding to fraud reports.

Scope of the Problem

New Hampshire Public Radio reported that Granite Staters lost about $22 million to cryptocurrency scams in 2024. Hampton police alone recorded more than $2.6 million in local losses tied to crypto ATM schemes, underscoring the rapid growth of these frauds.

Consumer Advice

Officials and consumer groups offer clear guidance to avoid becoming a victim:

• End any call that instructs you to withdraw cash and convert it to cryptocurrency. Legitimate organizations do not demand crypto payments to protect savings, resolve an arrest threat or fix a computer.
• Be suspicious if a caller insists on staying on the line while you visit a bank or kiosk — continuous coaching and secrecy are common scam tactics.
• If contacted about an account problem, independently call the organization using a number from a bank statement, card, bill or official website.
• If you already transferred money, contact law enforcement and the kiosk operator immediately and preserve receipts, wallet addresses, messages, telephone numbers and bank withdrawal records.

Bottom line: The new law adds multiple practical barriers to fast, irreversible crypto transfers at kiosks and creates a clearer path to refunds for some victims — but consumer vigilance remains essential.