California’s Department of Financial Protection and Innovation (DFPI) has ordered bitcoin ATM operator Coinflip to pay more than $4.8 million to California scam victims, the agency announced on Nov. 4. The order also requires the company to pay the regulator over $350,000 in illegally charged excessive fees.
Regulator Cites Failures in Fraud Safeguards
According to the DFPI, investigators found that since 2021 Coinflip had failed to adequately identify users and to detect, prevent, report, and mitigate suspicious activity. Those failures enabled scammers to exploit customers and drain their assets, the agency said.
“Robust anti-fraud and consumer-protection practices are a requirement of doing business in California, not a suggestion,” said DFPI Commissioner KC Mohseni.
The findings included transactions exceeding California’s $1,000 daily customer limit, missing written disclosures before purchases, and incomplete receipts. The DFPI cited the Digital Financial Assets Law, which regulates crypto businesses and sets kiosk safeguards, as well as federal anti-money laundering requirements. It also cited the California Consumer Financial Protection Law, which prohibits unlawful, unfair, deceptive, or abusive financial practices.
Kiosk Scams Target Older Adults
Coinflip’s California machines typically operate in grocery stores, gas stations, and convenience stores, according to the DFPI. The regulator described kiosk transactions as immediate, irreversible, and difficult for consumers to trace. It identified older adults as particularly vulnerable to fraud involving these machines.
Scammers use fraudulent support messages and impersonation tactics to pose as trusted organizations and fabricate account problems. The Federal Trade Commission has described schemes beginning with suspicious-activity claims or computer security warnings. Victims are then pressured to withdraw cash and move it through a nearby kiosk.
In these bitcoin ATM impersonation scams, a supplied QR code directs the purchased cryptocurrency into a fraudster’s wallet. Government, business, and technical support impersonation accounted for about 86% of kiosk fraud loss reports in the first half of 2024. People 60 and older accounted for about 71% of reported losses involving the machines during that period.
Enforcement Actions and State Refund Programs
Beyond compensation, California ordered Coinflip to cease unlawful, unfair, deceptive, or abusive practices. The action is part of continuing enforcement against multiple kiosk operators. Earlier actions included shutting down Hermes Bitcoin and imposing financial sanctions on RockItCoin, Coinme, and Coinhub. The DFPI maintains a Crypto Scam Tracker and accepts consumer fraud complaints.
Other states have also pursued refunds and recoveries. Arizona secured full refunds for 35 crypto ATM victims totaling $171,332, announced Aug. 12. Its mandatory reimbursement provisions cover qualifying customers who had been with an operator for fewer than 10 days. Eligibility also requires reporting within 30 days and documentation confirming fraudulent inducement.
Alabama’s crypto ATM scam refund requirements took effect Oct. 1. Qualifying new customers can receive the full transaction amount plus fees, while existing customers qualify for half the value plus all fees. Both groups face a 60-day reporting deadline.
Ohio investigators secured the return of $15,300 stolen through a crypto ATM in a fake Microsoft support scheme. A 63-year-old woman received her money back Oct. 8 after investigators traced and froze the funds. Agents coordinated with the Allen County Prosecutor’s Office and obtained a search warrant.
