Attorneys general from 46 states announced a bipartisan $45 million settlement with Block, Inc. on July 8, 2026, resolving allegations that Cash App misrepresented its security, ran minimal identity verification, and left scammed users to fend for themselves without a working customer service line for years. New York Attorney General Letitia James, who co-led the coalition, said Block "failed to help users when they were scammed, misled consumers about the safety of Cash App, and failed to provide the fraud protection and resolution that it promised and was required to provide by law."
What Investigators Found
The joint investigation, co-led by Texas and Oregon, found that Cash App accounts could be opened without a Social Security number or date of birth, with no cap on how many accounts one person could create — a gap fraud rings could and did exploit. More strikingly, Block had no working customer-support phone number for years. Users searching online for help "ended up calling fake numbers set up by scammers," according to James, and Block "knew this was happening and failed to warn users or set up a real phone line until 2021." The company also kept running "Cash App Fridays" social promotions after learning they were being used to bait victims, while marketing the app's "cutting edge" fraud detection despite lacking a consistent system to back that claim.
Under the settlement, Block must maintain live customer support around the clock — a real person on the phone at least 13.5 hours a day and live chat at least 18 hours a day, building to full 24-hour coverage — and must stop marketing Cash App as offering bank-equivalent protections it didn't actually provide. Texas will collect roughly $5 million of the total; New York gets $1.6 million; smaller states receive proportionally less.
Not Block's First Fine
This is Block's second major regulatory hit in 18 months. On January 16, 2025, the Consumer Financial Protection Bureau ordered the company to pay up to $175 million — a $55 million civil penalty plus as much as $120 million (with a $75 million floor) in redress to Cash App users harmed by unresolved fraud disputes dating back to 2019, distribution of which only began in June 2026. The CFPB order already required 24-hour live-person customer service; the state settlement essentially forces Block to actually deliver on a promise a federal regulator extracted 18 months earlier and layers state enforcement — and state penalty exposure — on top of it.
The Case for the Crackdown
The strongest case for this action isn't abstract. Peer-to-peer payment apps occupy a genuine regulatory gray zone: they move money like banks but, absent a bank charter, don't automatically carry FDIC insurance or Regulation E's full unauthorized-transaction protections unless the provider builds and honors equivalent processes voluntarily. Cash App's own marketing blurred that line for users least equipped to notice the difference — scam victims searching for help are, by definition, people already in distress, and routing them toward fraudulent lookalike phone numbers because the real company offered none is a design failure with real victims, not a hypothetical one. A years-long absence of any legitimate support channel is not an edge case regulators are inventing; it is a documented operational choice a growing consumer product made and, per the state complaint, kept making after it knew the consequences.
Why the Mechanism Should Worry Innovation-Minded Observers
Even granting the underlying facts, the structure of this enforcement action deserves scrutiny. A Forbes analysis of the settlement notes the Trump administration has scaled back CFPB enforcement broadly — dismissing a number of Biden-era orders — while leaving Block's $175 million order from January 2025 intact. Forty-six state AGs then built an independent, overlapping enforcement track on the same underlying conduct. That's not obviously wrong, but it is a preview of the model fintechs should expect going forward: federal rulemaking retreats, state coalitions expand to fill the space, and a single company ends up managing compliance obligations set by up to 50 separate regulators plus a still-active federal one, each with its own metrics, deadlines, and penalty schedule.
That fragmentation is the real cost. A national payments company serving, per Forbes, roughly 59 million active users needs one clear operational bar for fraud handling and support access — not a patchwork where Texas's 13.5-hour phone-support floor and New York's chat-hour requirement diverge slightly from whatever the next state coalition negotiates. Congress, not a rotating cast of AG coalitions, is the body positioned to set a durable, uniform floor for nonbank payment-app consumer protections — something bills addressing nonbank payment oversight have gestured toward without passing. Until that happens, expect more settlements built this way: real harms, real remedies, but delivered through 46 separate negotiating tables instead of one clear federal standard.
The Compliance Signal
For other P2P and neobank operators, the message is unambiguous regardless of one's view on the mechanism: verification standards that don't collect basic identity data, marketing language implying bank-grade protection without delivering it, and an unstaffed support line are now proven multistate liability, not just federal exposure. Building real fraud-detection infrastructure and honest marketing copy is now demonstrably cheaper than the alternative — for Block, the two enforcement actions combined already exceed $220 million before accounting for the New York Department of Financial Services fine and additional pending litigation, including a Zelle-related case in New York.