Loading story…
Block, Inc., the owner of Cash App, agreed to pay $45 million to settle allegations from 46 states that it misled users about the app’s security protections and failed to adequately protect them from fraud. State investigators said Cash App presented itself as offering bank-like safeguards while maintaining weak identity verification, permissive account creation controls, and inadequate customer-support practices that allowed scammers to create networks of fraudulent accounts and exploit users seeking help.
Authorities said the absence of a real customer-support phone line until 2021 drove victims to fake scammer-run support numbers, while promotions including “Cash App Fridays” allegedly increased users’ exposure to scams. Under the settlement, Block did not admit wrongdoing but must provide 24/7 live customer support for fraud issues, maintain substantial human-staffed coverage, improve scam education, and halt marketing practices known to increase fraud; Vermont said it will receive $1.3 million from the multistate agreement, which also reinforces a related 2025 CFPB consent order requiring Block to distribute $75 million to $120 million to states.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Vermont announced it will receive $1.3 million from the $45 million multistate settlement with Block. State officials said the case involved allegations that Cash App failed to shield users from fraud and misrepresented the platform's safety.
Block agreed to pay $45 million to settle allegations from 46 states that it misled users about Cash App's security and failed to adequately protect them from fraud. The settlement requires measures including 24/7 live customer support for fraud claims, limits on risky marketing practices, and user education about common scams.
A related Consumer Financial Protection Bureau consent order in January 2025 required Block to distribute between $75 million and $120 million. The multistate settlement announced later was described as reinforcing that order.
On January 16, 2025, the CFPB ordered Block to provide up to $120 million in consumer refunds and other redress and to pay a $55 million penalty over Cash App's weak security practices and deficient handling of unauthorized transactions. The order also required 24-hour live customer service, proper fraud investigations, and timely refunds where appropriate.
Investigators said Cash App did not maintain a real customer-support phone line until 2021, which left users vulnerable to scammer-operated fake support numbers. The absence of accessible live support was cited as a factor that enabled fraud on the platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcetherecord.media
Open sourcevtdigger.org
Open sourceconsumerfinance.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apple is facing a California federal lawsuit after three customers said they lost a combined **$1.8 million in Bitcoin** by downloading a fake **Sparrow Wallet** app from the App Store. The complaint alleges the fraudulent iOS app impersonated the legitimate Sparrow Wallet product—even though the real wallet is not available on iOS—and tricked victims into entering their seed phrases, allowing attackers to transfer cryptocurrency to wallets they controlled. The lawsuit claims Apple misrepresented the App Store as a safe and trusted marketplace while failing to adequately review, monitor, and remove impersonation apps despite prior public warnings from Sparrow Wallet developer Craig Raw and reports from affected users. Apple said it has since removed the fake apps, terminated the associated developer accounts, and pointed to its existing anti-fraud enforcement measures and reporting channels for scams and intellectual property abuse.
Jul 31, 2026
The FBI said Americans lost more than **$388 million** to scams involving cryptocurrency kiosks in 2025, based on more than **13,400 complaints** filed with the Internet Crime Complaint Center. The bureau said fraudsters commonly instruct victims to withdraw cash, visit a crypto ATM, and transfer funds to attacker-controlled wallets, with complaints rising **23%** and losses increasing **58%** from the prior year. People over 50 accounted for more than half of the complaints and reported over **$302 million** in losses, while Texas, Florida, and California together logged more than **3,300 complaints** and about **$112 million** in estimated losses. The warning comes as regulators and lawmakers intensify scrutiny of the crypto kiosk industry. Minnesota, Indiana, and Tennessee have moved to ban cryptocurrency kiosks statewide, and operators including Bitcoin Depot, CoinFlip, and Athena are facing growing legal and regulatory pressure; Bitcoin Depot has also filed for Chapter 11 bankruptcy, citing state bans and tighter rules. Federal officials said the kiosks are being used in scams including fake investments, tech support fraud, and romance scams, and urged the public to verify payment requests through official channels and avoid sending funds to online-only contacts or unknown parties.
Jun 29, 2026
A malicious macOS app impersonating **Ledger Live** was distributed through Apple’s App Store and linked to the theft of more than **$9.5 million** in cryptocurrency from over **50 victims**. Investigators said the app used Ledger branding, fake credibility signals, and prompts for users’ seed or recovery phrases, allowing attackers to seize control of wallets and drain assets across multiple networks, including **Bitcoin, Ethereum, Solana, Tron, and XRP**. The fraudulent listing was reportedly published under **Leva Heal Limited** rather than Ledger and showed a suspicious version history that jumped rapidly from `1.0` to `5.0` within roughly two weeks. Blockchain investigator **ZachXBT** traced the stolen funds from intermediary wallets into more than **150 KuCoin deposit addresses**, after which they were laundered through a centralized mixing service known as **AudiA6**. Apple removed the app after user reports, and KuCoin said it froze the implicated accounts pending possible law enforcement action. The thefts, reported over a span of days in April, have intensified scrutiny of Apple’s app review process and underscored the continuing risk of fake wallet and financial apps appearing in trusted software marketplaces.
Jun 29, 2026