- California ordered CoinFlip to pay more than $4.8 million to scam victims.
- DFPI found failures in customer checks and suspicious-activity monitoring.
- California law sets $1,000 daily kiosk limits, fee caps, and disclosure rules.
A crypto ATM can send a victim’s cash into a scammer’s wallet within minutes, with little chance of reversing the payment. California’s latest enforcement action raises a central question: how much responsibility should kiosk operators carry when weak safeguards enable fraud?
On November 4, California’s Department of Financial Protection and Innovation ordered CoinFlip to pay more than $4.8 million to residents defrauded through its kiosks. It must also pay DFPI more than $350,000 for excessive fees and stop unlawful practices.
CoinFlip Settlement Puts Crypto ATM Rules in Focus
CoinFlip operates about 500 crypto ATMs across California. The DFPI found that, since 2021, the company had failed to properly identify customers or detect, prevent, report, and mitigate suspicious activity.
The regulator cited transactions above California’s $1,000 daily customer limit, excessive fees, missing pre-transaction disclosures, and incomplete receipts. It said the conduct violated the state’s Digital Financial Assets Law and California Consumer Financial Protection Law, alongside federal anti-money-laundering requirements.
The restitution ties the company’s payment to its own compliance failures. The order does not create automatic liability for every scam loss.
Increasing Fraud Losses Lead to New Concerns About Kiosks
CoinFlip is not the only operator facing scrutiny as crypto ATM scam losses continue to rise. The FBI’s Internet Crime Complaint Center alone had more than 13,400 complaints of cryptocurrency-kiosk scams in 2025, in which victims lost over $388 million. That’s up from 2024, when victims over 50 lost more than $302 million.
Scammers often impersonate government agencies, businesses, tech-support staff or even family members to pressure victims into using crypto ATMs. The criminals will make the victim go to an ATM and steal their money in the form of crypto, then they will use a QR code to input the purchased crypto into their wallet. Often, they will remain on the phone.
Transfers are fast, non-refundable, and hard to track. DFPI cautions that they do not pay crypto ATM fees to settle an account issue or to protect funds.
Can Stronger Operator Controls Protect Crypto ATM Users?
Operators must obtain the user’s ID and agree to a $1,000 limit per day, and they will have to provide receipts that itemize expenses. Since 2025, they have had to reveal all fee and exchange rate data, clearly mark any final transactions, and charge fees no greater than 15 percent or $5, depending on the value of the digital asset.
Consumer data standards also impose requirements on transactional processing companies. An operator may not be able to identify and filter out each and every call a victim receives, but they can authenticate customers, look for alarming activity, cap limits, and flag warnings before payment.
We need good and understandable warnings that consumers can act on and reporting channels for abuse. Regulators need to regulate without blaming the victims.
The CoinFlip order suggests regulators may hold operators financially responsible when their own compliance failures contribute to consumer losses, without establishing that kiosk companies are automatically liable for every scam conducted through their machines.
Related: US NFP Forecast at 65K: Could Tonight’s Jobs Report Trigger a Bitcoin, Gold, and Dollar Reversal?
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
