California Orders Coinflip to Pay $4.8M for ATM Scams

By Elena Vasquez

California’s Department of Financial Protection and Innovation ordered Coinflip to pay $4.8 million to victims of Bitcoin ATM scams, according to DFPI’s findings in the enforcement action. California also ordered Coinflip to cease “unlawful, unfair, deceptive, or abusive practices,” placing compensation alongside compliance obligations. The available findings do not specify how many people the $4.8 million covers, how payments will be allocated, or how quickly reimbursement will occur.

What did DFPI find?

DFPI’s findings identified three compliance failures:

• Transactions exceeding DFPI’s $1,000 daily customer limit.
• Missing written disclosures before purchases.
• Incomplete receipts after kiosk transactions.

The regulator cited the Digital Financial Assets Law, which regulates crypto businesses and sets kiosk safeguards, and federal anti-money-laundering requirements. It also cited the California Consumer Financial Protection Law, which prohibits unlawful, unfair, deceptive, or abusive financial practices.

In plain terms, the case tests both how kiosks present a transaction and whether they leave records sufficient to resolve a dispute.

How does the scam work?

Scammers use fraudulent support messages and impersonate government, business, or technical-support organizations to fabricate account problems. The messages can falsely claim money needs protection, then pressure victims to withdraw cash and move it through a nearby kiosk.

The Federal Trade Commission has described such schemes as beginning with suspicious-activity claims or computer security warnings. A supplied QR code directs the purchased cryptocurrency into a fraudster’s wallet, completing the transfer requested through the impersonation.

DFPI identified older adults as particularly vulnerable to these machines. Government, business, and technical-support impersonation accounted for about 86%, or roughly six in seven, of kiosk fraud loss reports in the first half of 2024. People aged 60 and older accounted for about 71%, or seven in ten, of reported losses involving the machines during that period.

The clearest warning sign is an unsolicited support contact instructing a customer to convert cash through a nearby ATM.

What changes for California operators?

Coinflip’s California machines typically operate in grocery stores, gas stations, and convenience stores, according to DFPI. That placement makes transaction disclosures and receipts the operator’s clearest control points during a high-pressure purchase.

California is continuing enforcement against multiple kiosk operators, while the Coinflip order adds compensation to the duty to stop deceptive conduct. Earlier actions included shutting down Hermes Bitcoin and imposing financial sanctions on RockItCoin, Coinme, and Coinhub.

DFPI maintains a Crypto Scam Tracker and accepts consumer fraud complaints. Those channels support reporting, while individual recovery still depends on the facts and applicable program rules.

California is pairing money with enforcement: Coinflip must compensate affected customers and stop the practices cited in the findings.

What are other states doing?

Arizona announced full refunds for 35 crypto ATM victims totaling $171,332 on Aug. 12. That works out to an average of about $4,895 per victim, based on the announced figures.

Under Arizona’s mandatory reimbursement provisions, qualifying customers must have been with an operator for fewer than 10 days. They must also report within 30 days and provide documentation confirming fraudulent inducement. These conditions narrow eligibility, so announced refunds do not guarantee payment on every fraudulent-transfer report.

Alabama’s crypto ATM scam refund requirements took effect Oct. 1. Qualifying new customers can receive the full transaction amount plus fees, while existing customers can receive half the transaction value plus all fees. Both groups face a 60-day reporting deadline, so the recovery rate depends on eligibility and timely reporting.

Ohio investigators secured the return of $15,300 stolen through a crypto ATM in a fake Microsoft support scheme. A 63-year-old woman received her money back on Oct. 8 after investigators traced and froze the funds. Agents coordinated with the Allen County Prosecutor’s Office and obtained a search warrant.

State responses now combine mandatory reimbursement with targeted fund freezes, but each route depends on documentation, reporting speed, and a traceable destination for the money.

The next checkpoints are Arizona’s 30-day and Alabama’s 60-day claim windows, while California’s disclosure order sets operating standards for covered kiosks.