California’s Department of Financial Protection and Innovation (DFPI) issued an enforcement order on Nov. 4 requiring crypto‑ATM operator Coinflip to reimburse more than $4.8 million to victims of fraudulent kiosk transactions. The order also mandates the company to cease unlawful practices, pay roughly $350,000 in excessive‑fee penalties, and overhaul its consumer‑protection procedures.

BTC / USD
Source: CoinGecko. Prices are indicative.

Regulatory Findings and Violations

According to the DFPI, Coinflip failed to adequately verify user identities and to monitor, report, and mitigate suspicious activity since 2021. Those gaps allowed scammers to exploit the operator’s roughly 500 kiosks located in grocery stores, gas stations and convenience stores, often exceeding the state‑mandated $1,000 daily transaction limit. The regulator cited violations of the Digital Financial Assets Law, federal anti‑money‑laundering rules, and the California Consumer Financial Protection Law, which bars unfair or deceptive financial practices.

Scam Mechanics and Victim Profile

The agency’s investigation highlighted that scammers typically impersonate government, business or technical support agents, claim a user’s account is compromised, and pressure victims—many of them seniors—to withdraw cash and purchase cryptocurrency through a nearby kiosk. A fraudulent QR code then redirects the purchased coins to the fraudster’s wallet. The DFPI noted that older adults (60+) represented about 71% of reported losses in the first half of 2024, and that impersonation schemes accounted for roughly 86% of kiosk‑fraud incidents.

Broader State Actions and Consumer Remedies

California’s order follows similar actions in other states. Arizona recently secured full refunds totaling $171,332 for 35 crypto‑ATM victims, while Alabama and Ohio have enacted refund mechanisms for recent scams. The DFPI maintains a Crypto Scam Tracker and encourages consumers to file complaints, emphasizing that immediate, irreversible kiosk transactions are difficult to trace and recover without regulatory intervention.

What to Watch Next

Regulators are likely to increase scrutiny of crypto‑ATM operators nationwide, potentially extending similar compensation and compliance requirements to other jurisdictions. Stakeholders should monitor DFPI’s forthcoming guidance on anti‑fraud controls for kiosk operators, as well as any litigation or settlement developments involving Coinflip and other affected firms.