Cash App Settlement Forces Block To Pay 46 States $45M, Back $120M CFPB Restitution

A 46-state coalition of attorneys general announced Wednesday that Block, Inc. — the parent company of Cash App — agreed to pay $45 million to settle a sweeping investigation into allegations that the company misled consumers about the app’s fraud protections. Block denied any wrongdoing.

The settlement, announced July 8 and filed in the Philadelphia Court of Common Pleas pending court approval, is the largest coordinated state-level consumer-fintech enforcement action of 2026. Led jointly by Oregon Attorney General Dan Rayfield and Texas Attorney General Ken Paxton, the bipartisan coalition spans 46 states and Washington, D.C. — every participating state except Hawaii, Missouri, South Carolina, and Wyoming.

“Cash App told people their money was safe, and millions of Oregonians and Americans believed them, including a lot of people who didn’t have other options,” Rayfield said in announcing the agreement. “When things went wrong, Block left them with nowhere to turn.”

What Regulators Alleged Cash App Was Actually Doing

According to the investigation, Block marketed Cash App as offering “advanced fraud detection” and safety comparable to a bank while allegedly failing to deliver either. The states alleged that Cash App’s account-creation process required no Social Security number, no date of birth, and imposed no limit on how many accounts a single person could open. Attorneys general alleged that Block was aware fraud on the platform was rising sharply as a result — and responded not by strengthening protections but by continuing to market the app aggressively, pushing users to deposit paychecks and government benefits directly into it.

The states also alleged a systemic phone-support gap. For years, Block printed a customer service number on its Cash Cards and listed one in its terms of service. According to the CFPB’s January 2025 consent order, that number led only to a prerecorded message; callers could not reach a live person. When users searched online for help, the investigation found, scammers had seeded Google search results with fake Cash App phone numbers — and the states alleged that Block, aware of this problem by at least late 2020, failed to warn users or take meaningful steps to address it.

Those fake support lines, regulators alleged, became the mechanism of a second wave of fraud: scammers posing as Cash App representatives tricked callers into surrendering login credentials, then drained their accounts.

The Cash App Fridays promotion drew additional scrutiny. Block ran the recurring social media campaign for years, encouraging users to publicly post their unique Cash App identifier for a chance to win a weekly prize. Multiple attorneys general alleged that Block was aware fraudsters were using the promotion to contact those users, claim they had won, and steal their login information. According to the state AG complaint, internal communications showed Block’s own staff were trained to expect defrauded customers to contact support as a result. The promotion continued regardless, regulators alleged.

New York Attorney General Letitia James added a further allegation: according to a New York court filing tied to the settlement, Block told customers their Cash App balances were FDIC-insured — a protection the CFPB explains the coverage gap in cases where a partner bank fails rather than the app itself, and that most Cash App users did not have.

Regulation E: The Law Regulators Say Block Failed to Follow

The investigation was not only about marketing claims. Regulators also alleged legal violations.

The Electronic Fund Transfer Act, also known as Regulation E, gives consumers the right to dispute unauthorized transfers — including transfers initiated without their knowledge or permission. Financial institutions are required to investigate those disputes within 10 business days and provide provisional credits during extended investigations.

The Consumer Financial Protection Bureau’s January 2025 consent order found that Block’s dispute investigations were, in the CFPB’s own description, “woefully incomplete.” According to the order, Block directed users to ask their banks to reverse transactions — then denied those reversals when banks came back to Block for reimbursement. The bureau also found Block deployed tactics that actively discouraged users from seeking help, reducing the company’s costs. Without admitting or denying those findings, Block agreed to pay $120 million to harmed consumers and a $55 million civil penalty.

The 46-state settlement announced Wednesday reinforces and backstops that earlier order. In a provision that reflects the current federal regulatory environment directly, the multistate agreement ensures that if the CFPB were to cancel its own consent order — as the agency has already done with at least two other settlements under the Trump administration, whose officials have moved to drastically curtail the bureau — Block’s restitution obligation would be absorbed into Oregon’s state-level agreement and remain legally enforceable.

“Under the new administration, the CFPB has canceled several settlements, including at least two in which restitution had not yet been paid,” the Oregon Department of Justice stated.

What the Settlement Requires Cash App to Change

The agreement imposes binding operational reforms that will affect how Cash App handles every future fraud complaint. Under the consent order, Block must:

Maintain live customer support around the clock, with a human available by phone at least 13.5 hours per day and by live chat at least 18 hours per day. Stop making false or misleading claims about Cash App’s safety and fraud protections. Discontinue any marketing practice known to facilitate fraud on the platform. Strengthen identity verification at account creation to reduce fraudulent account networks. Proactively educate users about the fraud schemes that have been targeting Cash App. Investigate unauthorized transaction claims and reimburse users as required under Regulation E. Build and maintain a comprehensive compliance management system, and respond to reported unauthorized transactions within three business days.

Block must also pay the 46 states $45 million, distributed by population formula. Separately, on the same day, Washington Attorney General Nick Brown announced a $20 million settlement with Block resolving a distinct investigation into allegations that Cash App facilitated fraudulent transfers of pandemic-era unemployment insurance benefits. Washington alleged the company processed at least $22 million in fraudulent payments over a five-month span in 2020 using stolen personal information.

What the $45 Million Does Not Do: Why That Distinction Matters Right Now

Block is already under obligation to pay between $75 million and $120 million directly to harmed consumers under the separate CFPB consent order from January 2025. The settlement administrator, Epiq, began mailing those checks on June 8, 2026, on a rolling basis. Eligible consumers do not need to file a claim or take any action — the CFPB identified recipients from Block’s own records.

The $45 million in Wednesday’s state AG settlement flows to the participating states, not to individual users. The two amounts serve entirely different purposes: state enforcement penalty versus federal consumer restitution.

There is a more important distinction embedded in the CFPB restitution structure that the settlement announcement does not explain clearly. Regulation E covers transactions initiated without the consumer’s knowledge or permission — what the law calls “unauthorized” electronic fund transfers. The CFPB’s consent order covers users whose unauthorized transfers were not properly investigated, users who did not receive refunds they were legally entitled to, and users whose accounts were locked without provisional credits.

But a significant portion of Cash App fraud — specifically, victims of the Cash App Fridays phishing scheme and users who called fake support lines and were persuaded to transfer funds — involves transactions that are technically “authorized” under Regulation E. In those cases, the consumer initiated or approved the transfer, even if they did so because they were deceived. Federal law does not automatically give consumers the right to reimbursement for authorized push-payment fraud, and the authorized vs. unauthorized Regulation E distinction means the CFPB’s eligibility criteria do not extend to all fraud victims equally.

Deloitte’s authorized push payment forecast estimates that fraud of this type — where consumers are tricked into authorizing payments — reached $8.3 billion in U.S. losses in 2024 and could climb to $14.9 billion by 2028.

Consumers with questions about CFPB restitution eligibility can contact the settlement administrator at cashappcfpbsettlement.com or by calling 888-832-1301. They can also contact the CFPB directly at consumerfinance.gov. Any unsolicited contact claiming to be from Cash App, a settlement administrator, or a state attorney general offering settlement payouts should be treated as a scam. Search results and social media are already populated with fraudulent settlement-payout pages exploiting this news.

Why This Settlement Is Bigger Than Block

Block’s combined settlements and regulatory penalties now total at least $360 million: the CFPB’s $175 million action from January 2025, a concurrent $80 million settlement with 48 state financial regulators over Bank Secrecy Act and anti-money-laundering failures, a $40 million penalty from the New York Department of Financial Services in April 2025 for similar AML failures (which also identified 169,000 unprocessed suspicious-activity reports in Block’s backlog), the $45 million in Wednesday’s consumer-protection settlement, and the $20 million Washington State unemployment-fraud settlement. Block’s Q1 2026 SEC quarterly filing also disclosed an ongoing Department of Justice investigation, with Block accruing $240 million as an estimated loss from that matter as of the first quarter of 2026.

The settlement’s significance extends well beyond Block. This is the most geographically expansive state AG enforcement action against a consumer-fintech platform in 2026 — and it comes in part because federal oversight stepped back.

The CFPB finalized a rule in 2024 that would have subjected large peer-to-peer payment platforms to systematic supervisory examinations comparable to those that banks face. That rule was dropped under the current administration. The same administration dropped the CFPB’s 2024 federal lawsuit against Zelle and its parent company, Early Warning Services, despite allegations that users lost over $870 million to fraud on that platform between 2017 and 2023. New York’s AG filed New York’s $1 billion Zelle lawsuit in August 2025, explicitly picking up the case the CFPB abandoned.

What Wednesday’s 46-state action illustrates is that peer-to-peer payment apps are operating in a regulatory environment where the federal safety net has contracted and state coalitions have stepped into the gap. For consumers, the practical consequence is a patchwork: protections depend on which state you live in, which attorney general acted, and whether your fraud was “unauthorized” under Regulation E or merely a scam you were tricked into authorizing.

“Even with these new safety measures, peer-to-peer payment apps like Cash App do not have the same safeguards as traditional banking,” Connecticut Attorney General William Tong said after announcing the settlement. “Be very careful whenever using these types of apps.”

Is Cash App Safe Now?

Block did not admit wrongdoing and characterized the settlement in a statement as resolving “a previously disclosed legacy matter that primarily relates to historical aspects of our business.” The company said it has “made significant investments in consumer protection, customer service and compliance” to serve its users.

The reforms the settlement mandates — live human phone support, strengthened identity verification, a compliance management system, and a requirement to investigate unauthorized transaction claims within three business days — are legally binding. Cash App’s 51 million-plus monthly users, its push into direct deposit banking, and its ongoing recruitment of unbanked Americans to the platform make compliance with those reforms a meaningful test of whether fintech companies can be held accountable through state enforcement when federal oversight retreats.

The Zelle enforcement pattern suggests that accountability, when it comes at all, arrives in some states, after years of harm — and not through the federal safety net Block’s marketing long implied was in place.

Frequently Asked Questions

Is the $45 million settlement money going to Cash App users?

No. The $45 million goes to the 46 participating state governments, distributed by population formula. Consumer restitution — between $75 million and $120 million — is a separate obligation from the CFPB’s January 2025 consent order with Block. That money is being distributed by settlement administrator Epiq; checks began mailing on June 8, 2026. Eligible consumers do not need to file a claim. Contact cashappcfpbsettlement.com or call 888-832-1301 for verified information. Any unsolicited messages claiming to offer settlement payouts should be treated as scams.

I was tricked into sending money to a scammer on Cash App — am I eligible for the CFPB restitution?

This depends on the nature of the fraud. The Electronic Fund Transfer Act and Regulation E cover “unauthorized” transactions — ones initiated without your permission. The CFPB restitution covers users whose unauthorized transfers were not investigated, users denied refunds they were owed, and users locked out of accounts without provisional credits. If you were deceived into sending money yourself — for example, by a fake Cash App Fridays message or by someone posing as Cash App support who convinced you to transfer funds — that transaction may be classified as “authorized” under federal law, which can affect your eligibility. Consumers whose accounts were actually taken over and drained without their initiation are more likely to fall clearly under Regulation E protection. Contact the CFPB or your state attorney general if you are unsure where your situation falls.

What specific changes does Cash App have to make under this settlement?

Under the terms of the consent order, Block must provide live customer support 24 hours a day, with a human reachable by phone for at least 13.5 hours daily and live chat available at least 18 hours daily. It must stop making false or misleading safety claims, discontinue marketing practices regulators alleged facilitated fraud — including Cash App Fridays — strengthen account-creation identity verification, educate users about scam schemes, and investigate unauthorized transaction complaints within three business days. It must also build a comprehensive compliance management system. These are legally binding requirements, enforceable by the states that signed the consent order.

Should I keep money stored in Cash App?

Consumer advocates generally recommend keeping as little money as possible in peer-to-peer payment apps and transferring balances to a traditional bank account regularly. State investigations alleged that Block implied to users that Cash App balances carried FDIC insurance comparable to a traditional bank account, when the coverage that applies is narrower. The apps are useful for moving money between people you know and trust; they are not designed to function as savings accounts or primary banking accounts with equivalent fraud protections. Review your account settings, enable two-factor authentication and Security Lock, and never provide your PIN or login credentials to anyone claiming to be Cash App support by phone, text, or email.