California Orders $4.8M Payout to Bitcoin ATM Scam Victims

California Demands $4.8 Million Refund for Kiosk Fraud Victims

California's main financial regulator, the Department of Financial Protection and Innovation (DFPI), has taken major enforcement action against crypto kiosk operator Coinflip. On November 4, the agency ordered the company to pay more than $4.8 million in total compensation to victims who were scammed through its Bitcoin ATMs.

In addition to customer compensation, Coinflip must pay over $350,000 directly to the regulator to settle claims of illegally charged excessive fees.

State investigators found that starting in 2021, Coinflip failed to properly verify user identities. The company also failed to detect, prevent, report, or reduce suspicious activity across its network. According to the DFPI, these systemic security failures enabled fraudsters to target everyday consumers and drain their savings.

Robust anti-fraud and consumer-protection practices are a requirement of doing business in California, not a suggestion.

Where Coinflip Failed Consumer Protection Safeguards

Coinflip currently operates a network of approximately 500 crypto kiosks across California. These machines are commonly found in easily accessible places like grocery stores, gas stations, and local convenience stores.

During the investigation, regulators uncovered multiple regulatory violations across Coinflip's operations:

• Processing transactions that broke California's $1,000 daily limit per customer
• Failing to display mandatory written risk disclosures to users prior to cash transactions
• Issuing incomplete purchase receipts that omitted required transaction details
• Violating the state Digital Financial Assets Law and California Consumer Financial Protection Law
• Failing to meet federal anti-money laundering (AML) requirements

How Bitcoin ATM Impersonation Scams Work

Crypto kiosk transactions are processed almost instantly. Once money is sent, transactions are irreversible and extremely difficult for law enforcement to trace back to criminals.

Scammers take advantage of these features using impersonation tactics. They contact victims through fraudulent security alerts or fake pop-up warnings, pretending to represent trusted businesses, technology companies, or government agencies.

The fraudsters claim the victim's bank accounts are compromised and urge them to protect their funds immediately. Victims are told to withdraw cash from their bank and deposit it into a nearby Bitcoin ATM. The scammer provides a QR code, which routes the purchased cryptocurrency straight into the fraudster's private digital wallet.

Data from the Federal Trade Commission (FTC) highlights how widespread these tactics became during the first half of 2024:

• Government, business, and tech support impersonation accounted for about 86% of all reported kiosk fraud losses.
• Seniors aged 60 and older made up roughly 71% of total financial losses linked to crypto kiosk scams.

California Expands Enforcement Action Against Crypto Kiosks

Beyond ordering financial restitution, California regulators ordered Coinflip to immediately cease all unlawful, unfair, deceptive, or abusive practices.

This action is part of a broader crackdown on crypto kiosk operators across the state. Regulators have previously shut down Hermes Bitcoin completely and handed down financial penalties to several other operators, including Rock It Coin, Coinme, and Coinhub.

To protect the public, the DFPI maintains an active online Crypto Scam Tracker where residents can search reported fraudulent schemes and file official complaints.

Other US States Force Refunds for Kiosk Scam Victims

California is not alone in pushing for victim compensation. Law enforcement and regulatory agencies in several other states have successfully recovered funds for victims of Bitcoin ATM fraud:

• Arizona: On August 12, state officials announced they secured $171,332 in full refunds for 35 scam victims. Arizona rules mandate refunds for qualifying users who used an operator for less than 10 days, provided they report the fraud within 30 days with proof.
• Alabama: New crypto ATM reimbursement rules went into effect on October 1. Qualifying new customers can receive a 100% refund plus transaction fees, while existing customers receive 50% of the lost value plus all fees. Both groups must report the incident within 60 days.
• Ohio: On October 8, investigators successfully returned $15,300 to a 63-year-old woman targeted in a fake Microsoft technical support scam. Agents coordinated with local prosecutors and used a search warrant to trace and freeze the stolen funds.

Global Crypto ATM Count Drops Amid Tightening Regulations

As regulatory oversight intensifies across the United States, the physical crypto ATM landscape is shrinking globally.

According to data from kiosk tracking site CoinATMRadar, the total number of active crypto ATMs worldwide has dropped significantly, returning to levels last seen in 2021.

While major digital assets like Bitcoin (BTCBTC-1.84%) remain widely accessible through online exchanges and physical kiosks, investors should remain aware of market risks. Past performance of digital assets is not an indicator of future returns (Bitkub Market).