Cash App disputes · FloridaCash App denied your dispute after your account was taken over. Federal rules still apply to that balance.

Last reviewed October 8, 2026 by Jackson McMillan, Florida attorney

Short answer: If a caller posing as Cash App support got your sign-in code and emptied your balance, those transfers are unauthorized under Regulation E, which covers a Cash App balance as a prepaid account. Cash App must investigate on the federal timeline and prove you made them, and a denial that fell short can be pursued within one year.

What happens in a fake "Cash Support" takeover?

A fake support call is an account takeover. The caller invents an urgent problem, a suspicious payment or a locked account, and walks you through "verifying" yourself by reading back the sign-in code Cash App just texted you. With that code the caller logs in as you, changes the contact details, and sends your balance to strangers.

Cash App's own pages give you the first piece of evidence. Its scam-awareness article says Cash Support "will never ask you to provide your sign-in code, PIN, or other sensitive information," and will never require you to send a payment, download a remote-access app, or complete a "test" transaction. It also says 1-800-969-1940 is the only phone number it uses for support. Anyone who asked you for a code was not Cash App, and the records will show the transfers came from a new login, often a new device, right after that call. If the caller instead persuaded you to send a payment yourself, federal law generally treats that payment as authorized; the reason is explained below.

Who is Cash App, who regulates it, and what do its terms say?

Cash App is operated by Block, Inc., a publicly traded Delaware corporation whose principal executive office is in Oakland, California. Cash App is a licensed money transmitter, not a bank; its Terms of Service say it is "a financial services platform, and not an FDIC-insured bank." The balance you hold there is the key fact for a denied dispute.

Block's Terms of Service describe the Cash App Balance as a "Prepaid Account" and carry the Consumer Financial Protection Bureau's prepaid-account disclosures. Regulation E's definition of "account" includes prepaid accounts, meaning an account that can be loaded with funds, is used mainly to pay unaffiliated merchants, withdraw cash, or send money to other people, and is not a checking account. So the federal error-resolution and liability rules apply to unauthorized transfers from a Cash App balance, with the prepaid-account variations described below. In its January 2025 consent order, the CFPB treated Block as a "financial institution" subject to Regulation E, including the prepaid-account error-resolution rules.

The Cash App Card is issued by Sutton Bank of Attica, Ohio, a state-chartered bank whose primary federal regulator is the FDIC. A Cash App balance is eligible for FDIC pass-through insurance only if you have a Cash App Card or a Sponsored Account (or sponsor one); otherwise, in the Terms' own words, the balance is "not protected by FDIC pass-through insurance." Insurance is about a bank failing, not about fraud.

Now the arbitration clause. The Cash App Terms of Service (last updated September 11, 2026) require binding individual arbitration before National Arbitration and Mediation (NAM) and waive class actions and jury trials. You can reject arbitration only by mailing an opt-out notice to Block, Inc. within 30 days of creating your account, or within 30 days of agreeing to updated terms. Mailing is the only method the Terms allow; there is no email or in-app opt-out. Small claims court remains available for individual claims.

Treat the clause as a hurdle rather than a wall. An arbitrator, not a judge, would decide the dispute, and a class action is off the table. But the arbitrator applies the same Regulation E rules, and the regulation says an agreement cannot increase your liability for unauthorized transfers beyond what the rule permits.

Public enforcement history, stated as the official documents state it. In January 2025 the CFPB entered a consent order against Block, Inc. (File No. 2025-CFPB-0001) finding, among other things, that Block did not properly investigate unauthorized-transaction disputes under Regulation E; it ordered a $55 million civil penalty and between $75 million and $120 million in consumer redress. Block neither admitted nor denied the findings, and as of October 2026 the order remains listed as in effect on the CFPB's docket. The same month, 48 state financial regulators, with Florida among the lead states, assessed an $80 million penalty against Block for Bank Secrecy Act and anti-money-laundering program deficiencies. In July 2026, 46 state attorneys general led by Oregon and Texas announced a $45 million settlement with Block over Cash App fraud-protection and customer-service practices, under which Block agreed to provide 24-hour live customer support, to investigate fraud claims and reimburse unauthorized transactions as the law requires, and to honor the CFPB redress obligations even if the federal order is not enforced. The state releases describe that settlement as resolving allegations and state no admission.

McMillan Law PLLC is not affiliated with Cash App and does not represent it. Cash App is named here because people search for help with its decisions.

How do I file a dispute with Cash App, and how long does it say it takes?

Cash App's help page says to open Support in the app, choose Cash App Card, then Dispute a purchase, or call 1-800-969-1940. It says disputes should be filed within 60 days of the statement, that it responds within 10 business days, provisionally credits eligible disputes if it needs longer, and may take up to 45 days.

Those figures track the federal timeline, and the law, not the help page, makes them binding. Cash App's contact page lists phone hours of 8 AM to 9:30 PM Eastern daily; the in-app route is open any time. Report every transfer, not just the largest, and report any profile changes the thief made.

Two points about provisional credit on a prepaid account. Cash App's page says provisional credits go only to "eligible disputes" and not to complaints about goods or services, so describe each transfer as unauthorized, which is a different category from a purchase dispute. And the regulation lets an institution require written confirmation of a phone report within 10 business days and withhold provisional credit if it never arrives, though it cannot delay the investigation while waiting.

If Cash App offers an appeal, use it, but not as your only step; the one-year clock keeps running while an appeal sits.

What does Regulation E require of Cash App after I report?

Once you report, Regulation E requires a decision within 10 business days, or a provisional credit within 10 business days and a decision within 45 days, with the result due within 3 business days of finishing. A denial must be written, with notice of your right to the documents relied on, and the company must prove the transfers were authorized.

The Electronic Fund Transfer Act (EFTA) is the federal statute, and Regulation E is the rule that implements it. A transfer is unauthorized when someone other than you initiates it without actual authority and you receive no benefit (12 C.F.R. § 1005.2(m)). The official commentary says that when a person obtains your access device, your card, code, or other means of access, through fraud or robbery, the transfers that person makes are unauthorized (comment 2(m)-3). A sign-in code read to an impostor is an access device obtained through fraud. The CFPB's Electronic Fund Transfers FAQs, still posted as of October 2026, apply that rule to consumers who were tricked into sharing account access information. Your carelessness in trusting the caller cannot be used to increase your liability (comment 6(b)-2).

The line that controls the case: if you sent a payment yourself because the caller told you to, federal law generally does not treat it as unauthorized, because you initiated it. Mixed cases are common, with the thief sending several transfers and then coaxing you into one more. Each transfer gets sorted on its own.

Your share of the loss. When an access device was lost or stolen and you report within 2 business days after learning of it, the most you can lose is $50, or the amount taken before notice if less (§ 1005.6(b)(1)). Later reports can raise the cap to $500, but only for transfers the company proves a timely report would have prevented (§ 1005.6(b)(2)). If an unauthorized transfer appears on a statement or account history and you wait more than 60 days, you can be liable for later transfers made after those 60 days and before your report, again only if the company shows a timely report would have stopped them (§ 1005.6(b)(3)). There is no reporting deadline for the first unauthorized transfers; the one-year limit to sue is the practical outer edge.

Prepaid-account timing. Where a prepaid account sends no periodic statements, the 60-day window runs from when you electronically access the account history showing the transfer or when the company sends a written history, and the company may use a 120-day window instead (§ 1005.18(e)(1), (2)). One real exception: if you never completed Cash App's identity verification, the liability limits and error-resolution rules may not apply until you do (§ 1005.18(e)(3)). Money pulled from a linked bank account or debit card is separately protected through your bank.

The investigation itself has rules. The company may not require a police report, a notarized affidavit, or a call to the recipient as a condition of investigating; it may not charge a fee; and if it finds an error it must correct it within 1 business day. If it finds no error, it must explain its findings in writing and tell you about your right to the documents it relied on, which it must then provide promptly (§ 1005.11(d)). When your liability is disputed, the statute puts the burden on the institution to prove the transfer was authorized or that the conditions for consumer liability were met (15 U.S.C. § 1693g(b)).

Why do Cash App disputes come back denied?

Denials of takeover claims, in my experience with denial letters generally, lean on the fact that the transfers passed authentication, came from a verified login, or went to a recipient added from inside the account. Those facts explain how the thief operated. They do not establish who initiated the transfers, which is the only question Regulation E asks.

Other reasons that appear in denials, and what each one misses:

• "The customer provided the sign-in code." A code handed over because of a lie is an access device obtained through fraud. The transfers the impostor made with it are unauthorized under the official commentary.
• "The payment can't be reversed." Whether money can be pulled back from a recipient has nothing to do with whether the transfer was authorized or whether the company owes you an investigation.
• "The customer sent the payment." If you did, this reason can hold up under federal law. If the thief did, it cannot. I check the login and device records for each transfer before accepting either version.

What are my options as a Florida Cash App user?

Florida has no state electronic-transfer statute, so the federal EFTA is the main tool, and it can be pursued in court or, if the arbitration clause applies, before an arbitrator. Block is a state-licensed money transmitter rather than a bank, which matters because Florida's deceptive practices law exempts banks and credit unions but not other finance companies.

I work from a single office in Tampa and handle these claims for people throughout Florida; nothing about a Cash App dispute requires an in-person meeting, since the record lives in the app and in email.

Two Florida decisions guide how I evaluate a denial. In Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022), the court found that the institution had not reasonably investigated a disputed debit and had not met its burden of proving the transaction was authorized. In Katz v. JPMorgan Chase (S.D. Fla. 2015), the court held that an error-resolution claim accrues when the institution's deadline passed, which fixes when the one-year clock starts.

On the state-law side, Florida's Deceptive and Unfair Trade Practices Act exempts banks, credit unions, and savings associations, not other finance companies (Fla. Stat. § 501.212). Whether it adds anything against a money transmitter depends on the facts; a Florida federal court has held that a licensing violation alone cannot support that claim. Courts also require a concrete injury, and losing the use of your money generally counts.

What is a denied Cash App dispute worth?

If Cash App violated the EFTA in handling your dispute, you can seek your actual damages, meaning the stolen balance and related losses, plus statutory damages of $100 to $1,000, plus reasonable attorney's fees and costs. When the company skipped provisional credit and did not investigate in good faith, the law allows up to three times your actual damages.

The statutory figure does not depend on how much was taken; the court sets it by weighing the frequency, persistence, and nature of the noncompliance and whether it was intentional (15 U.S.C. § 1693m(a), (b)). Fee shifting is what makes a $600 takeover worth pursuing.

Trebling has two triggers (§ 1693f(e)). First, the institution did not provisionally recredit the account within the 10-business-day period and either did not investigate in good faith or had no reasonable basis to believe there was no error. Second, it knowingly and willfully concluded there was no error when the evidence could not reasonably support that conclusion. The multiplier applies to your actual damages, the money you lost, not to the statutory $100 to $1,000.

Defenses exist: a bona fide error made despite reasonable procedures limits recovery, and the statute allows fees against a consumer who brings a claim in bad faith or to harass. You don't pay me unless you win. I take these cases on contingency: no attorney's fees and no case costs owed to me unless you recover money. If a case is lost, a court can sometimes order the losing side to pay the other side's court costs, and some Florida laws, including the security deposit and deceptive practices statutes, also let the winner recover attorney's fees from the loser. I explain that risk before anything is filed, and every term is in a written agreement before you sign.

What deadlines apply to a Cash App dispute?

Report a stolen phone or compromised login within 2 business days of learning of it to hold your share at $50. Report every unauthorized transfer within 60 days of the statement or of viewing the history that shows it. Mail any arbitration opt-out within 30 days of opening the account. Bring any EFTA claim within one year.

The year runs from the violation, not from the theft (15 U.S.C. § 1693m(g)). For a mishandled dispute, that is the company's failure, so the South Florida court in Katz counted from when the 10-business-day deadline passed. Even so, I treat the date of the first unauthorized transfer as the safe deadline.

When a hospital stay, a long trip, or a similar extenuating circumstance kept you from reporting on time, the regulation requires the reporting periods to be extended to a reasonable time (12 C.F.R. § 1005.6(b)(4)). Say so when you report, in writing.

What should I do today?

• Get back in and lock down. Reset your Cash App password through the official app or 1-800-969-1940 (never a number from a text or call), turn on every security setting, and change your email password. If your phone number stopped working, call your carrier.
• Report every transfer the thief made through Support in the app or by phone during its posted hours, and say "unauthorized" for each one. If anything is requested in writing, send it within 10 business days and keep proof.
• If the dispute was denied, request in writing every document Cash App relied on, and note the date you asked.
• Report the linked-account leg to your bank if any transfer pulled money from a linked bank account or debit card; the bank has its own deadlines.
• Gather the documents: the denial message; screenshots of each transfer with date, amount, and recipient $cashtag; the sign-in code texts with timestamps; new-device or new-login alerts; the fake support call in your call log; your account history for the period; and a police report if you made one (helpful, not required).
• Don't pay a "recovery" service. Anyone who contacts you offering to get the money back for a fee is almost always the same operation.
• Send it to me. Request a free case review and include the screenshots and the denial. I'll tell you which transfers federal law covers, whether Cash App met its deadlines, and what I would do about the denial.

Sources: 15 U.S.C. § 1693a(12); § 1693f(e); § 1693g(b); § 1693m(a), (b), (c), (f), and (g); 12 C.F.R. § 1005.2(b)(3) and (m); § 1005.6(b); § 1005.11; § 1005.18(e); Regulation E official interpretations 2(m)-3, 6(b)-2, 11(b)(1)-2, 11(c)-2, and 11(c)-3; CFPB, Electronic Fund Transfers FAQs (page last modified January 2025; checked October 8, 2026); CFPB Consent Order and Stipulation, In re Block, Inc., File No. 2025-CFPB-0001 (January 15 and 16, 2025); Conference of State Bank Supervisors release on the $80 million Block, Inc. penalty (January 15, 2025); Oregon Department of Justice and California Attorney General releases on the multistate Block, Inc. settlement (July 8, 2026); Cash App Terms of Service (last updated September 11, 2026); Cash App help articles on disputing a Cash App Card transaction, recognizing scams, and contacting Cash Support; Cash App Prepaid Card Program Agreement (Sutton Bank); FDIC BankFind record for Sutton Bank; Block, Inc. Form 10-K (fiscal 2025); Katz v. JPMorgan Chase (S.D. Fla. 2015), 2015 WL 11251764; Monroe v. Grow Financial Federal Credit Union (M.D. Fla. 2022), 2022 WL 17417034; Cross v. Point & Pay (M.D. Fla. 2017), 274 F. Supp. 3d 1289; Fla. Stat. § 501.212. Last reviewed October 8, 2026.