BTC $74,838 
EQQQQ $655.75 Last updated 8 Nov 2026, 12:03 UTC
ETH $2,124 
MGLOEURO $111,813 
USDT $0.9991 
BNB $686.08 
USDC $0.9995 
XRP $1.10 
SOL $86.73 
TRX $0.3177 Hacks & Security · Explained
California orders Coinflip to pay $4.8M to bitcoin ATM scam victims
State regulator says the operator's weak customer checks and monitoring let scammers drain victims' assets since 2021.
Key takeaways
- Compensation ordered. Coinflip must pay more than $4.8 million to California scam victims, which the DFPI described as full compensation.
- Fee refunds. The operator must also pay the DFPI over $350,000 in fees the regulator said were illegally charged.
- Older adults targeted. People 60 and older accounted for about 71% of reported kiosk fraud losses in the first half of 2024, per figures cited in the reports.
What happened
California's Department of Financial Protection and Innovation announced on Nov. 4 that it has ordered bitcoin ATM operator Coinflip to pay more than $4.8 million to state residents who were defrauded through its machines. The regulator characterized the payments as full compensation for scam victims, according to reports from Bitcoin.com News and Blockonomi.
The order covers a network of roughly 500 Coinflip kiosks in California, typically located in grocery stores, gas stations and convenience stores. Alongside the victim payments, the company must hand the DFPI more than $350,000 in fees the agency says were charged illegally, and it is required to stop unlawful, unfair, deceptive or abusive practices.
Investigators concluded that since 2021 Coinflip had not adequately identified its users or detected, prevented, reported and mitigated suspicious activity. The agency said those shortcomings allowed scammers to exploit customers and drain their assets. The findings also included transactions above California's $1,000 daily per-customer limit, a lack of written disclosures before purchases, and incomplete receipts.
DFPI Commissioner KC Mohseni said robust anti-fraud and consumer-protection practices are a requirement of doing business in California, not a suggestion. The agency based its action on the Digital Financial Assets Law, federal anti-money laundering requirements and the California Consumer Financial Protection Law.
First $82.9KLatest $74.1K-10.7% over the period
Points are daily observations, not closing prices.
Why it matters
The order is one of several state-level efforts to force crypto ATM operators to return money to fraud victims, many of them older adults. The DFPI noted that kiosk transactions are immediate, irreversible and hard for consumers to trace, which makes losses difficult to recover once cash has been converted. Scammers commonly pose as government agencies, businesses or technical support staff, send fake warnings about suspicious activity or computer security problems, and pressure victims to withdraw cash and feed it into a nearby machine. A QR code supplied by the fraudster routes the purchased bitcoin directly to a wallet the victim does not control. According to figures cited in the reports, impersonation schemes accounted for about 86% of kiosk fraud loss reports in the first half of 2024, and people 60 and older made up about 71% of reported losses in that period.
Background
California has taken action against other kiosk operators as well. The state shut down Hermes Bitcoin and imposed financial sanctions on RockItCoin, Coinme and Coinhub, and the DFPI maintains a Crypto Scam Tracker while accepting consumer fraud complaints. Other states have moved in parallel. Arizona announced on Aug. 12 that it had secured full refunds for 35 crypto ATM victims totaling $171,332, under rules covering customers who had used an operator for fewer than 10 days and reported the fraud within 30 days with supporting documentation. Alabama's refund requirements for crypto ATM scams took effect Oct. 1, offering qualifying new customers the full transaction amount plus fees and existing customers half the value plus all fees, with a 60-day reporting deadline for both groups. In Ohio, investigators traced and froze $15,300 stolen through a crypto ATM in a fake Microsoft support scheme, and a 63-year-old woman received her money back on Oct. 8 after agents worked with the Allen County Prosecutor's Office and obtained a search warrant.
What to watch
How Coinflip implements the required changes across its California kiosks, and whether victims receive payments on a schedule the regulator sets, are details the reports do not specify. The order adds to a widening pattern of state enforcement and reimbursement rules aimed at crypto ATM operators, so further actions against kiosk businesses in other states are worth monitoring.
Questions readers ask
What did California order Coinflip to do?
Pay more than $4.8 million in full compensation to scam victims in the state, return over $350,000 in fees the regulator says were illegally charged, and stop unlawful, unfair, deceptive or abusive practices.
Why did the regulator act?
Investigators found that since 2021 Coinflip failed to adequately identify users and to detect, prevent, report and mitigate suspicious activity, which the agency said let scammers exploit customers and drain their assets.
Who is most affected by bitcoin ATM scams?
The reports cite figures showing people 60 and older accounted for about 71% of reported kiosk fraud losses in the first half of 2024, with impersonation schemes making up about 86% of loss reports.
