California’s Department of Financial Protection and Innovation (DFPI) has ordered bitcoin ATM operator Coinflip to pay more than $4.8 million to scam victims in the state. The regulator announced the order on Nov. 4 and described the payments as full compensation.

Coinflip must also pay the DFPI more than $350,000 in fees that the regulator said were charged illegally. The company operates about 500 kiosks across California.

The order comes as several states take steps to require crypto ATM operators to return money lost to fraud. Many of the affected victims are older adults. Arizona, Alabama and Ohio have each acted this year to help crypto ATM scam victims recover funds.

DFPI Findings

According to the DFPI, Coinflip failed to properly identify users beginning in 2021. Investigators also said the company failed to detect, prevent, report and reduce suspicious activity.

The regulator said those failures allowed scammers to exploit customers and drain their assets. Some transactions exceeded California’s $1,000 daily limit per customer.

The DFPI also found that Coinflip did not provide written disclosures before purchases and that some receipts were incomplete. The order requires the company to stop unlawful, unfair, deceptive or abusive practices.

The agency cited California’s Digital Financial Assets Law, which regulates crypto businesses and establishes rules for kiosks. It also referenced federal anti-money laundering requirements and the California Consumer Financial Protection Law.

“Robust anti-fraud and consumer-protection practices are a requirement of doing business in California, not a suggestion,” DFPI Commissioner KC Mohseni said.

Coinflip’s California machines are commonly located in grocery stores, gas stations and convenience stores. The DFPI said transactions made through the kiosks are immediate, cannot be reversed and can be difficult for consumers to trace. Recoveries announced by regulators this year have come through restitution orders and law-enforcement investigations rather than reversals of the original transactions.

Scammers frequently impersonate government agencies, businesses or technical-support workers. According to the Federal Trade Commission, they use false warnings about suspicious activity or computer security problems to pressure victims into withdrawing cash and depositing it into a nearby kiosk.

A QR code provided by the scammer then directs the purchased bitcoin to the fraudster’s wallet. During the first half of 2024, impersonation schemes accounted for about 86% of reported losses involving crypto kiosks. People aged 60 and older represented about 71% of reported losses involving the machines during that period.

The Coinlive account on X reported the order on Nov. 9, 2026:

JUST IN: Crypto ATM operator CoinFlip has been ordered to pay over $4.8 MILLION to scam victims in California. California's DFPI also ordered the company to refund more than $350,000 in excessive fees. An investigation found that CoinFlip failed to properly verify customer… — Coinlive (@CoinliveHQ) November 9, 2026

https://x.com/CoinliveHQ/status/2119673742775484636?ref_src=twsrc%5Etfw

Other States Pursue Refunds

Arizona announced on Aug. 12 that it had secured full refunds for 35 crypto ATM victims, totaling $171,332. The state’s rules cover customers who had used an operator for fewer than 10 days and reported the fraud within 30 days with supporting proof.

Alabama’s refund rules for crypto ATM scams took effect on Oct. 1. Qualifying new customers can recover the full transaction amount plus fees, while eligible customers can receive half of the transaction value plus all fees. Both groups must report the fraud within 60 days.

In Ohio, investigators traced and froze $15,300 stolen through a crypto ATM in a fake Microsoft support scam. The 63-year-old victim recovered the money on Oct. 8 after agents worked with the Allen County Prosecutor’s Office and obtained a search warrant.

Across states that have created refund rules, eligibility depends on reporting windows and proof requirements that differ from state to state.

The Coinflip order follows other California enforcement actions against kiosk operators. The state has shut down Hermes Bitcoin and imposed financial penalties on RockItCoin, Coinme and Coinhub. The DFPI also operates a Crypto Scam Tracker that accepts consumer fraud complaints.

Primary source: