California Regulator Orders Coinflip to Pay $4.8 Million to Crypto ATM Fraud Victims

California's Department of Financial Protection and Innovation (DFPI) ordered Coinflip, a major U.S. Bitcoin ATM operator, to pay over $4.8 million to fraud victims and $350,000 in illegal fees for failing to properly identify customers and detect suspicious activity since 2021. A common scam scheme involving fake alerts, cash withdrawals, and QR codes is also spreading across Latin America and Spain.

California Regulator's Order

On November 4, 2024, California's Department of Financial Protection and Innovation (DFPI) ordered Coinflip to:

Pay over $4.8 million to fraud victims as full compensation
Return more than $350,000 in illegal fees
Cease using "unlawful, unfair, deceptive, or abusive" practices

Coinflip operates approximately 500 ATMs throughout California, primarily in supermarkets, gas stations, and neighborhood retailers.

Regulatory Failures Identified

The DFPI found that since 2021, Coinflip:

Failed to properly identify and verify customers
Did not detect, stop, or report suspicious activity
Allowed transactions exceeding California's mandatory $1,000 daily limit per customer
Failed to provide required written disclosures before transactions, with incomplete receipt information

DFPI Commissioner KC Mohseni stated: "Sound fraud prevention and consumer protection practices are a requirement for operating in California, not a suggestion."

How the Bitcoin ATM Scam Works

Stage 1: False Alert

You receive a call or message claiming to be from your bank, a government agency, or technical support of a major company. They warn of "suspicious activity" on your account or that your computer has been hacked.

Stage 2: Pressure to Withdraw Cash

The scammer instructs you to immediately withdraw cash to "protect" your money and take it to a nearby Bitcoin ATM.

Stage 3: QR Code Transfer

The scammer sends you a QR code. When you scan it at the ATM, any Bitcoin you purchase is directly transferred to the scammer's wallet address.

Stage 4: Irreversible Loss

Bitcoin transactions execute immediately, cannot be reversed, and are difficult to trace.

The Scope of the Problem

According to DFPI data for the first half of 2024:

Impersonation of government agencies, companies, and technical support accounted for approximately 86% of losses reported at Bitcoin ATMs
People aged 60 and older concentrated approximately 71% of total losses

Other Cases and State Actions

California has previously:

Shut down Hermes Bitcoin
Fined RockItCoin, Coinme, and Coinhub
Continues investigating other operators

Other states have taken action:

Arizona: Achieved full reimbursement of $171,332 to 35 victims in August 2024
Alabama: Requires full refunds to victims who report within 60 days starting October 1, 2024 (full amount plus fees for new customers; half amount plus fees for existing customers)

Spain is also increasing oversight of cryptocurrency ATMs.

How to Protect Yourself

Golden Rule: No legitimate bank, government agency, or company support team will ever ask you to protect your money using a Bitcoin ATM. If anyone does, it's a scam.

Protective Measures:

Hang up: Do not engage with unsolicited calls or messages
Verify independently: If concerned, contact your bank using the number on your card or their official website
Never scan suspicious QR codes: QR codes sent via message for ATM deposits belong to scammers
Report immediately: If victimized, save your ATM receipt and report to both police and the ATM operator immediately. Quick reporting increases the chance funds can be frozen
Warn vulnerable people: Inform elderly family members and friends about this scam—seniors are the primary targets

Critical Warning: If someone offers to recover your lost funds after a scam, this is a secondary fraud attempt.

This article is informational only and is not financial or legal advice.