Fintech giant Block, Inc. has agreed to a $45 million settlement with a coalition of 46 U.S. states, resolving a massive investigation into allegations that the company misled consumers about Cash App’s safety and left millions of vulnerable users exposed to rampant fraud.
The multi-state probe, spearheaded by the Attorneys General of Texas and Oregon, alleged that Jack Dorsey’s digital payment company prioritized rapid, “frictionless” user growth over basic security measures. Regulators argued that Block engaged in deceptive practices by marketing Cash App as a secure, bank-like financial platform, specifically to unbanked and underbanked consumers, while failing to provide legally mandated fraud protection and resolution services.
Growth Over Security: How Scammers Exploited Cash App
According to state investigators, Cash App’s aggressively simplified onboarding required minimal identity verification, turning the platform into a playground for cybercriminals who easily created anonymous accounts to orchestrate scams.
The investigation highlighted several systematic failures that actively enabled fraud:
- The Invisible Support Team: For years, Cash App lacked a live customer service phone number. Desperate users locked out of accounts or needing fraud support often fell victim to fake 1-800 help numbers found online, which were actually operated by scammers who subsequently drained their bank accounts.
- “Cash App Fridays” Exploits: Block’s popular weekly social media giveaway, where users publicly posted their “$cashtag” handles to win cash prizes, was routinely hijacked by bad actors. Fraudsters impersonated Cash App representatives, contacting hopeful participants and tricking them into revealing their login credentials. Regulators claim Block was aware of this trend but continued the promotion for years.
- Failure to Investigate: State officials claimed that when actual fraud was reported, Block routinely failed to investigate unauthorized transactions or issue mandatory refunds, frequently locking innocent users out of their accounts for weeks with no recourse.
The Cost of Compliance
While Block did not admit to any wrongdoing, characterizing the settlement as a “legacy matter that primarily relates to historical aspects of our business,” the company is now legally bound to completely overhaul its consumer protection infrastructure.
Under the terms of the settlement, Block must implement:
- True Live Support: The app must offer 24/7 customer support, ensuring a live human is available by phone for at least 13.5 hours a day and via live chat for 18 hours a day.
- Strict Ad Marketing Rules: The company must stop making misleading claims about its bank-like safety and entirely discontinue marketing practices that are known to trigger high volumes of fraud.
- Tighter Onboarding: Block will be required to build a comprehensive compliance management system with stricter identity checks.
Beyond the $45 million state penalty, the agreement explicitly reaffirms Block’s prior commitment to distribute an additional $75 million to $120 million in consumer restitution under an earlier settlement with the Consumer Financial Protection Bureau (CFPB). Furthermore, the multi-state agreement acts as a safeguard: if federal enforcement slips under the current political administration, the state executive committee assumes the authority to enforce the massive restitution payout.
The Broader Impact on Fintech and Web3
For a company like Block, which heavily bridges the gap between traditional fintech and Web3 through its prominent Bitcoin trading revenues, the financial penalty isn’t existential. However, the operational mandates could reshape its trajectory.
Adding identity verification and robust live customer support introduces “friction” into a product that succeeded because of its frictionless nature. For the broader fintech and crypto-adjacent sectors, the message from state regulators is loud and clear: growth metrics can no longer come at the expense of consumer security.