CoinFlip: California Orders $4.81M Back to 20 Crypto ATM Scam Victims

California's financial regulator announced on Wednesday 4 November 2026 that one of the biggest crypto cash machine companies in the United States has agreed to pay back $4,811,483 to 20 customers it says were caught in scams. The company is CoinFlip, based in Chicago. The regulator is the Department of Financial Protection and Innovation, known as the DFPI, which supervises financial firms in California. The deal is a consent order, a settlement written down as a legal order, and CoinFlip did not admit anything.

Twenty people is a small number against a very large problem. That is worth saying plainly, because the headline figure can be misread. The $4.81 million is restitution, meaning money returned to specific victims. The DFPI says it covers 20 California consumers it identified, and it describes the payment as full compensation for them. It is not an estimate of everything Californians lost at CoinFlip machines, and the DFPI release read for this article does not give such a total.

The figures, and which one this article uses

Two payments sit in the order. The first is the $4,811,483 to the 20 victims. The second is $351,530 that CoinFlip must pay to the DFPI itself. The regulator describes that sum as excess fees, charged to California customers above what the law allows, and calls it disgorgement, a legal word for handing back money earned improperly. Added together the two come to $5,163,013, a total this article calculates itself. Law360 headlined the action as $5.1 million, which is that sum rounded down.

This article uses $4.81 million as the main figure because it is the amount that goes to people. The $351,530 is a separate payment to the state. CoinFlip must also stop what the order calls unlawful, unfair, deceptive or abusive acts or practices, with immediate effect.

What a bitcoin ATM is, and why scammers like it

A bitcoin ATM is a cash machine that works in reverse. A bank machine gives out banknotes. This one takes banknotes and turns them into bitcoin, a digital currency, which it sends to a digital wallet. A wallet is like an account number that anyone can open for free, and whoever holds its password controls the money inside. The customer scans a code on the screen to say which wallet should receive the coins. The operator earns its living on the difference between what the coins cost and what the customer is charged, plus fees. CoinFlip says it runs about 5,500 machines in six countries, including 48 US states, and that its network is the world's largest by transaction volume. About 500 are in California, usually inside grocery, petrol and convenience stores.

Scammers steer victims to these machines for the same reasons a legitimate customer finds them easy. The DFPI says crypto ATM transactions are immediate, irreversible and hard to trace. A card payment can be disputed and a bank transfer can sometimes be recalled. Cash pushed into a kiosk and sent to a stranger's wallet usually cannot be pulled back. The typical script has a caller posing as a bank, a tax office or a technology company, who tells an older person that their savings are in danger and must be moved to safety, and then talks them through the machine step by step. The DFPI says the scams hit older adults hardest. The FBI's Internet Crime Complaint Center counted $389 million lost through crypto kiosks across the country in 2025, a figure covered in the CMZ story on Bitcoin Depot.

What the DFPI says CoinFlip did wrong

The DFPI says its investigation found that, since 2021, CoinFlip failed to verify properly who was using its machines, and failed to detect, prevent, report and mitigate suspicious activity. In the regulator's words this let scammers drain people's money. Think of a stockbroker that never checks who its clients are and never reports a strange transfer: the rules that require those checks are the anti-money laundering rules, and CoinFlip is accused of not keeping an effective programme under them.

The order also lists plainer breaches of California's own crypto kiosk rules. According to a legal news summary of the order, the machines accepted more than $1,000 from one customer in a single day, on several occasions since 1 January 2024. California caps daily kiosk transactions at that level, and the limit exists to stop one scam victim from feeding in a lifetime of savings in an afternoon. Fees were above the legal maximum. The written warnings that must be shown before a transaction were missing required elements, and so were the receipts. The DFPI cites the Digital Financial Assets Law, the California Consumer Financial Protection Law and federal Bank Secrecy Act anti-money laundering rules.

Two officials were quoted in the release. Rohit Chopra, California's Business and Consumer Services Secretary and a former head of the federal Consumer Financial Protection Bureau, said California was stepping up because there is no federal consumer protection to rely on. KC Mohseni, the DFPI Commissioner, said crypto companies must be held accountable for enabling and profiting from scams.

CoinFlip's answer

CoinFlip neither admitted nor denied the DFPI's findings and conclusions, which is the standard wording of a consent order. The DFPI release carries no statement from the company. Banking Dive reported on 6 November that CoinFlip did not immediately respond to a request for comment. No CoinFlip statement on the California order had been found by 7 November 2026. Without one, the findings above are the regulator's, not facts that a court has tested.

Iowa and other states

California is not the first state to go after CoinFlip. In February 2025 Iowa's attorney general, Brenna Bird, sued CoinFlip and Bitcoin Depot in Polk County court under the state's consumer fraud law. Her office said Iowans had lost more than $20 million at the two companies' machines and that the operators took excessive and often hidden fees, which she put at 21% of the money sent through CoinFlip's kiosks. Both companies pushed back at the time, saying they had safety measures in place and rejecting the claim that they help fraudsters. Those are allegations, CoinFlip disputes them, and the Iowa case is separate from the California order. In May 2026 Missouri's attorney general, Catherine Hanaway, also sued CoinFlip, and CoinFlip called that suit meritless.

California has been working through the industry. The DFPI shut down an operator called Hermes Bitcoin and has fined RockItCoin, Coinhub and Coinme, the last of which agreed to a $300,000 penalty in 2025. CoinFlip is the largest name on that list so far.