California forces Coinflip to repay $4.8m to Bitcoin ATM scam victims

California regulators have ordered Coinflip to pay more than $4.8 million to people scammed at its bitcoin ATMs, saying the operator failed for years to stop fraudsters from using its kiosks. The state’s DFPI also told the company to hand back over $350,000 in excessive fees.

California targets Coinflip over Bitcoin atm scam victims

California’s Department of Financial Protection and Innovation (DFPI) has ordered cryptocurrency ATM operator Coinflip to pay more than $4.8 million in compensation to Bitcoin atm scam victims following an investigation into the company’s consumer protection practices.

Announced on November 4, 2026, the regulatory action addresses alleged failures in customer identification, suspicious transaction monitoring and fraud prevention.

According to the DFPI, these weaknesses allowed criminals to exploit customers using Coinflip’s cryptocurrency kiosks and transfer their digital assets to fraudulent wallets.

The regulator also directed Coinflip to pay more than $350,000 in excessive fees collected in violation of applicable financial regulations.

The order represents a significant financial penalty for the operator and reinforces California’s position on consumer protection within the rapidly evolving digital asset industry.

The investigation reportedly identified compliance shortcomings dating back to 2021. Authorities found that Coinflip had not adequately implemented procedures to identify customers, recognize suspicious transactions, prevent fraudulent activity or report potentially unlawful financial operations.

DFPI Commissioner KC Mohseni emphasized that cryptocurrency businesses must comply with established consumer protection standards when operating within the state.

“Robust anti-fraud and consumer-protection practices are a requirement of doing business in California, not a suggestion.” — KC Mohseni, Commissioner, California Department of Financial Protection and Innovation.

The statement reinforces the regulator’s position that companies providing cryptocurrency-related services cannot treat fraud prevention as an optional part of their operations.

How Bitcoin ATM scams operate and why consumers remain exposed

The DFPI’s findings also draw attention to the methods criminals use to target cryptocurrency ATM customers. Unlike conventional investment fraud, these schemes frequently rely on impersonation, intimidation and fabricated security threats to convince victims to transfer their money.

Fraudsters often contact individuals through phone calls, emails, text messages or computer pop-ups, pretending to represent government agencies, financial institutions or technical support companies. They then claim that the victim’s bank account, computer or personal information has been compromised.

Under the pretence of protecting their money, victims are instructed to withdraw cash and visit a nearby cryptocurrency ATM. The criminals subsequently provide a QR code that directs the cryptocurrency purchased through the machine into a wallet controlled by the scammers.

Once the transaction is completed, recovering the funds can become extremely difficult because cryptocurrency transfers generally cannot be reversed through conventional banking procedures.

The Federal Trade Commission (FTC) has previously warned about the growing use of Bitcoin ATMs in financial fraud. Its September 2024 consumer protection report highlighted the scale of the problem.

The agency also identified government impersonation, business impersonation and technical support fraud as major sources of reported losses.

Older consumers were particularly affected, accounting for approximately 71% of reported Bitcoin ATM fraud losses during that period.

These figures help explain why the compensation order for Bitcoin atm scam victims represents more than an isolated regulatory dispute. It highlights the importance of stronger transaction monitoring and consumer education across the cryptocurrency payment infrastructure.

California strengthens enforcement as Bitcoin ATM scam victims seek compensation

Coinflip’s regulatory difficulties form part of a wider enforcement effort targeting cryptocurrency ATM operators in the United States.

California has previously taken action against other companies operating in the sector, including Hermes Bitcoin, RockItCoin, Coinme and Coinhub.

The latest Coinflip order also addresses several specific compliance failures. Investigators identified transactions that exceeded California’s $1,000 daily customer limit, inadequate written disclosures before purchases and incomplete transaction receipts.

These requirements are important because customers need clear information about transaction costs, purchase limits and the risks associated with cryptocurrency transfers.

The DFPI’s action references California’s Digital Financial Assets Law, federal anti-money laundering requirements and the California Consumer Financial Protection Law.

Together, these regulatory frameworks establish obligations for businesses handling digital asset transactions and prohibit certain unfair or deceptive financial practices.

Arizona previously secured approximately $171,332 in refunds for 35 victims of crypto ATM scams. Its reimbursement framework includes eligibility conditions relating to the timing of transactions, fraud reporting and evidence that customers were deceived.

Alabama has also introduced refund requirements that distinguish between new and existing customers. Depending on eligibility, affected customers may recover their transaction amounts and associated fees, although reporting deadlines apply.

In another case, investigators in Ohio recovered $15,300 stolen from a woman through a cryptocurrency ATM scam involving a fake Microsoft support scheme.

These developments suggest that regulators are increasingly exploring ways to make cryptocurrency ATM operators more accountable when customers suffer losses through fraudulent transactions.

What the Coinflip decision means for cryptocurrency investors

The California enforcement action carries implications beyond the immediate financial consequences for Coinflip. It highlights an important issue for cryptocurrency investors: the security of the infrastructure used to purchase, transfer and store digital assets.

Bitcoin ATMs provide an alternative route for individuals who want to purchase cryptocurrency using cash. Their accessibility has helped expand cryptocurrency adoption, particularly among consumers who may not regularly use centralized exchanges.

However, convenience does not eliminate the risks associated with inadequate security procedures, misleading transaction information or fraudulent intermediaries.

Legitimate government agencies and technology companies do not require individuals to purchase Bitcoin through an ATM to protect their savings or resolve supposed account problems.

The FTC recommends independently verifying unexpected communications and reporting suspicious activities through official channels. Consumers can also consult the agency.

The $4.8 million compensation order sends a significant message to cryptocurrency ATM operators: expanding access to digital assets must be accompanied by adequate consumer protection.

As enforcement efforts continue across different states, companies operating in this market may face greater pressure to improve compliance, strengthen fraud detection and provide clearer transaction information.

The California decision offers an important example of regulators using existing financial protection laws to pursue compensation. For the wider cryptocurrency industry, it reinforces the need to balance accessibility and innovation with accountability and customer security.