If they are legit but they couldn't collect amount that is needed to start the project they will give back your investment.
If they are scammers they can run away with your money. There's no regular law for this situation.
That's right. If that ICO project has a pure intention and failed, they have to return your investment since they haven't reached their minimum target of investment. But they can just disappear without giving back the investor's money. That's the risk.