California Scam and Fraud Laws: Where to Report, Your Right to Sue (2026)

California has two consumer protection laws that matter after a scam, and they work differently. The Consumers Legal Remedies Act (CLRA) lets a "consumer" (an individual who buys or leases goods or services for personal, family or household use) who is harmed by a practice the act lists as unlawful sue for actual damages, punitive damages and restitution, and a court must award attorney's fees to a consumer who wins. The Unfair Competition Law (UCL) lets anyone who lost money or property to an unfair or fraudulent business practice sue, but the statute itself provides for an injunction and the return of money or property, not damages.

California also adds protections you will not find in federal law: a $1,000 daily limit and a fee cap at crypto ATMs, a private right to sue phishers, a five-business-day cancellation right for people 65 and older who buy from a door-to-door seller, and mandatory attorney's fees in elder financial abuse cases. Complaints go to the Attorney General, or to the Department of Financial Protection and Innovation (DFPI) for crypto kiosks and money transmitters, but neither office acts as your lawyer.

Information last verified on October 2, 2026. This article has not been reviewed by a licensed lawyer.

Jurisdiction scope: This guide covers California state law: the Consumers Legal Remedies Act and the Unfair Competition Law, California complaint offices, protections for older and dependent adults, and California rules on crypto ATMs, phishing, immigration consultants and door-to-door sales, plus California court limits and deadlines. Federal refund and reporting rights are summarized briefly and covered in depth on our national guides. Out of scope: criminal defense, and the law of other states (if the scammer or business is elsewhere, that state's law may also matter).

First steps if you were scammed in California

Contact the bank, card issuer, payment app, wire company or crypto exchange that moved your money right away; that company is usually the only one that can stop or reverse a payment. Your federal rights depend on how you paid, and our guide on how to get money back after a scam goes through each payment method. For app transfers, see the Zelle and payment app guide.

Then report it. Most scams go to the FTC at ReportFraud.ftc.gov, and online crime to the FBI's IC3; our where to report a scam guide lists every federal channel. The California offices below are in addition to those, not instead of them. If your Social Security number or accounts were exposed, see California identity theft laws.

Where to report a scam in California

Be realistic about what an Attorney General complaint does. The office says: "Complaints are used by the Attorney General's Office to learn about misconduct and to determine whether to investigate a company. However, the Attorney General's Office cannot provide legal advice or assistance to individuals." The complaint form asks you to acknowledge that "the Attorney General cannot answer legal questions or give legal advice to me and cannot act as my personal lawyer." If a state agency regulates the business, the Attorney General's page says to complain to that agency. For help finding a lawyer, the page lists the State Bar's lawyer referral line, (866) 442-2529.

The DFPI is the place for crypto kiosk problems, but note the limit on its reach. Its complaint page says: "We do not regulate national banks including, but not limited to: Bank of America, Wells Fargo, JP Morgan Chase, Union Bank, and Citibank." The DFPI offers translation in more than 240 languages.

California's consumer protection laws: can you sue?

Sometimes, and which law you use decides what you can win. The table compares the two.

The CLRA

Civil Code section 1780(a) gives the private right to sue:

"Any consumer who suffers any damage as a result of the use or employment by any person of a method, act, or practice declared to be unlawful by Section 1770 may bring an action against that person to recover or obtain any of the following: (1) Actual damages, but in no case shall the total award of damages in a class action be less than one thousand dollars ($1,000). (2) An order enjoining the methods, acts, or practices. (3) Restitution of property. (4) Punitive damages. (5) Any other relief that the court deems proper."

Two conditions are built in. The practice must be one that section 1770 declares unlawful, and you must be a "consumer." Section 1761(d) defines that word: "'Consumer' means an individual who seeks or acquires, by purchase or lease, any goods or services for personal, family, or household purposes." Someone who bought a fake product, a sham repair or a worthless service fits that pattern more easily than someone who simply sent money to an impostor posing as a bank or a government agency, who may not have sought or bought anything. Whether your situation fits depends on the facts; a California lawyer can tell you.

Fees. Section 1780(e) says: "The court shall award court costs and attorney's fees to a prevailing plaintiff." It cuts the other way only in a narrow case: a defendant may get reasonable fees if the court finds the plaintiff's case "was not in good faith."

Older and disabled consumers. Under section 1780(b)(1), a consumer who is a senior citizen or a disabled person may be awarded up to $5,000 on top of other damages. The trier of fact must find all three of the following: the consumer suffered substantial physical, emotional or economic damage; one of the factors listed in Civil Code section 3345(b) is present; and an additional award is appropriate. Section 1761(f) defines a senior citizen as a person "65 years of age or older."

Treble damages are narrow. The CLRA does not triple damages across the board. Section 1780(c) requires treble actual damages only for a violation of one specific item on the list, section 1770(a)(24).

The 30-day notice. Section 1782(a) requires that "Thirty days or more prior to the commencement of an action for damages" the consumer notify the business of the alleged violations and demand that it correct them. "The notice shall be in writing and shall be sent by certified or registered mail, return receipt requested, to the place where the transaction occurred or to the person's principal place of business within California." If the business gives or agrees to give an appropriate remedy within 30 days of receiving it, no damages action may be brought (section 1782(b)). You can file for an injunction right away without notice and add damages later, after the 30 days, by amending the complaint (section 1782(d)).

Deadline. A CLRA case must be brought "not more than three years from the date of the commission of such method, act, or practice" (section 1783). Note that this runs from the act itself.

The UCL

Business and Professions Code section 17200 defines unfair competition to include "any unlawful, unfair or fraudulent business act or practice and unfair, deceptive, untrue or misleading advertising." Under section 17204, a private person may sue only as "a person who has suffered injury in fact and has lost money or property as a result of the unfair competition."

What a court can order is set out in section 17203: it may stop the practice and make orders "as may be necessary to restore to any person in interest any money or property, real or personal, which may have been acquired by means of such unfair competition." The section lists those remedies and no damages provision. So the UCL is a route to getting back what was taken, not to extra compensation. The deadline is four years after the claim accrued (section 17208).

The honest limit

Both laws need a defendant you can identify, serve and collect from. That often works against a California business, a contractor or a seller with a real address. It usually does not work against an anonymous scammer behind a spoofed number, a fake website or an overseas crypto wallet. A judgment does not help if nobody can be found to pay it.

Protections for older adults in California

The legal definition. Welfare and Institutions Code section 15610.30(a)(1) defines financial abuse as when a person "Takes, secretes, appropriates, obtains, or retains real or personal property of an elder or dependent adult for a wrongful use or with intent to defraud, or both." It also covers anyone who "Assists in" doing so. The conduct counts as wrongful if the person "knew or should have known that this conduct is likely to be harmful to the elder or dependent adult" (section 15610.30(b)).

A civil lawsuit with fees. Under section 15657.5(a), when a defendant is found liable for financial abuse, "in addition to compensatory damages and all other remedies otherwise provided by law, the court shall award to the plaintiff reasonable attorney's fees and costs." If the victim also proves "recklessness, oppression, fraud, or malice" by clear and convincing evidence, certain limits on damages in Code of Civil Procedure section 377.34 do not apply (section 15657.5(b)).

A crime. Penal Code section 368(d) covers a person who is not a caretaker and who commits theft, embezzlement, forgery, fraud or identity theft against an elder or dependent adult, knowing or when they reasonably should know the victim's status. When the value is over $950, it is punishable by a fine of up to $2,500 or up to a year in county jail, or by a fine of up to $10,000 or imprisonment for two, three or four years, or both. When the value is $950 or less, the penalty is up to a year in county jail, a fine of up to $1,000, or both. Report suspected crimes to local law enforcement.

Banks must report. Under section 15630.1, "all officers and employees of financial institutions" (including banks and credit unions) are mandated reporters of suspected financial abuse of an elder or dependent adult. They must report by phone or a confidential online tool "immediately, or as soon as practicably possible," and, if they reported by phone, send a written or online report within two working days, to Adult Protective Services or local law enforcement. A failure to report can bring a civil penalty paid by the financial institution, up to $1,000, or up to $5,000 if willful. That penalty is not money paid to the victim. Section 15630.1 is a reporting law and does not itself give banks power to hold or delay a transaction; we have not confirmed whether any other California law does.

Brokers and investment advisers can delay a withdrawal. Section 15630.2 treats broker-dealers and investment advisers as mandated reporters too, and section 15630.2(j)(1) lets them "temporarily delay a requested disbursement from, or a requested transaction involving, an account of an elder or dependent adult" when, after an internal review, they reasonably believe it may result in financial abuse. Within two business days they must give written notice of the delay to everyone authorized to transact on the account (unless that person is suspected of the abuse) and notify Adult Protective Services, law enforcement and the DFPI. The delay ends 15 business days after it began, can be extended on an agency's request to no more than 25 business days, and a court can extend it further.

If you are worried about a parent, call Adult Protective Services at 1-833-401-0832, and tell the bank or brokerage directly that you suspect a scam. For fraud against anyone 60 or older, the federal DOJ National Elder Fraud Hotline (833-372-8311) can also help; see where to report a scam.

California scam laws on the books

Crypto ATMs (digital financial asset kiosks)

California regulates crypto ATMs in Financial Code sections 3901 through 3907, which took effect January 1, 2024. The core rules:

• Daily limit. Section 3902: "An operator shall not accept or dispense more than one thousand dollars ($1,000) in a day from or to a customer via a digital financial asset transaction kiosk."
• Fee cap. Since January 1, 2025, section 3904 limits charges per transaction to the greater of $5 or 15 percent of the U.S. dollar amount of the transaction, measured at the market price on a licensed exchange.
• Disclosures and receipts. Since January 1, 2025, section 3905 requires a written disclosure before the transaction (in English and in the language the operator markets in) of amounts, fees and how the kiosk price compares with the exchange price. If the operator offers no way to reverse or refund a transaction, the disclosure must include "a warning that all transactions are final and cannot be undone." The customer also gets a receipt.
• Licensing. Section 3907 requires operators to comply with the state's crypto licensing law starting July 1, 2026. The DFPI says that "By July 1, 2026, kiosk operators must have submitted a completed application to the DFPI if the operator wishes to continue to do business in California." The DFPI also publishes the list of kiosk locations operators report to it (section 3906).

In the kiosk sections we reviewed, we did not find a requirement that an operator refund money a customer was tricked into sending. What the law does is cap the amount and the fees, so a kiosk that took more than $1,000 in a day from you, or charged more than the cap, may have broken the law. Report that to the DFPI; the DFPI has taken enforcement action against kiosk operators for exceeding the daily limit and overcharging. For how crypto ATM scams work, see our tech support and fake invoice scams guide.

A new law on seized crypto (SB 1208)

In 2026 California enacted SB 1208 (Chapter 483, Statutes of 2026), approved by the Governor in September 2026. It amends Penal Code sections 186.9 and 186.10 and adds section 186.13. According to the bill's digest, it extends the state's money laundering law to digital assets, allows warrants to seize digital assets, and provides for victims' verified claims to the seized assets to be decided by a court. A person with a claim must file it, under penalty of perjury, within 30 days after being served with the prosecuting agency's notice. Assets not distributed to victims are held by the agency for a maximum of three years and then go to the state Restitution Fund. The Legislature stated its intent "to return seized cryptocurrency to Californians and victims in other states who are victims of fraud." This helps only where law enforcement actually seizes the crypto. It is not an urgency measure, so under the California Constitution (article IV, section 8(c)) it takes effect January 1, 2027, and its digital-asset provisions are set to last until January 1, 2032.

Phishing: a right to sue

California's Anti-Phishing Act of 2005 (Business and Professions Code sections 22948 to 22948.3) makes it unlawful "by means of a Web page, electronic mail message, or otherwise through use of the Internet, to solicit, request, or take any action to induce another person to provide identifying information by representing itself to be a business without the authority or approval of the business" (section 22948.2).

Section 22948.3(a)(2) gives an individual victim a lawsuit: "An individual who is adversely affected by a violation of Section 22948.2 may bring an action, but only against a person who has directly violated Section 22948.2." The victim may seek an injunction and "the greater of three times the amount of actual damages or five thousand dollars ($5,000) per violation," and the court may award costs and attorney's fees to a winning plaintiff. As with any lawsuit, you need to be able to identify and reach the person who sent the phishing message. See our phishing guide for what to do if you clicked.

Immigration consultants and notario fraud

Only lawyers and people authorized by federal law to represent others before immigration authorities may give legal help on immigration matters. Business and Professions Code section 22440 makes it unlawful for anyone else, for pay, "to engage in the business or act in the capacity of an immigration consultant" except as the chapter allows, and section 22441 limits a consultant to "nonlegal assistance or advice on an immigration matter," such as completing forms, translating answers and securing documents.

California adds protections for clients of immigration consultants:

• A written contract and 72 hours to cancel. Section 22442 requires a written contract before services, in English and the client's native language, which must say complaints can go to the federal immigration court system (EOIR) and the State Bar. "The client shall have the right to rescind the contract within 72 hours of signing the contract."
• Banned conduct. Section 22444 makes it unlawful to make false or misleading statements to a client, to make a guarantee or promise unless it is in writing and has some basis in fact, to claim special favors from or special influence with immigration authorities, or to charge a fee for a referral.
• A lawsuit with a multiplier. Under section 22446.5(a), a client harmed by a violation may sue for an injunction, damages or both, and the court "shall award actual damages, plus an amount equal to treble the amount of actual damages or one thousand dollars ($1,000) per violation, whichever is greater," and shall award reasonable attorney's fees and costs to a prevailing plaintiff.
• Penalties. Section 22445(a)(1) allows a civil penalty of up to $100,000 per violation in a civil action brought by any person injured by the violation or by the Attorney General, a district attorney or a city attorney. A violation is also a misdemeanor punishable by a fine of $2,000 to $10,000 per client, up to a year in county jail, or both, and "payment of restitution to a client shall take precedence over payment of a fine." An action under section 22445 must be brought "within four years after discovery."

Our notario fraud guide explains how these scams work and where to get legitimate help.

Door-to-door and home sales: three days to cancel, five if you are 65 or older

Under Civil Code section 1689.6(a)(1), a buyer who signs a contract for goods or services of $25 or more made somewhere other than the seller's normal place of business may cancel "until midnight of the third business day, or until midnight of the fifth business day if the buyer is a senior citizen." A senior citizen here is "an individual who is 65 years of age or older" (section 1689.5(f)); the five-day right applies to contracts made on or after January 1, 2021. The window is seven business days for a personal emergency response unit and for a contract to repair a home after a disaster (section 1689.6(b) and (c)).

Cancel by written notice to the address or email in the agreement. The notice is effective when mailed, and "however expressed, is effective if it indicates the intention of the buyer not to be bound." The agreement must be "written in the same language, e.g., Spanish, as principally used in the oral sales presentation" with a boldface cancellation notice (section 1689.7(a)(1)). The law excludes some sales, including registered vehicles and services of attorneys, real estate brokers, securities dealers, physicians and banks' financial services not connected with a sale (section 1689.5(c) and (d)). Sundays and listed holidays do not count as business days.

Suing a scammer or a business in California

Small claims. "Generally, you can only sue for up to $12,500 in small claims court (or up to $6,250 if you're a business)," the California courts' self-help page says, reflecting Code of Civil Procedure sections 116.221 and 116.220. There is a frequency limit: under section 116.231(a), "no person may file more than two small claims actions in which the amount demanded exceeds two thousand five hundred dollars ($2,500), anywhere in the state in any calendar year."

Deadlines. A fraud claim must be filed within three years, and under Code of Civil Procedure section 338(d) the claim "is not deemed to have accrued until the discovery, by the aggrieved party, of the facts constituting the fraud or mistake." The CLRA's own deadline is three years from the act (section 1783), and the UCL's is four years (section 17208). Our California statute of limitations guide covers other civil deadlines. If a collector is now chasing a debt the scammer ran up in your name, see California debt collection laws.

Who you can actually reach. Lawsuits work against people and businesses with a name, an address and assets. A scammer who hid behind a fake identity, a spoofed caller ID or an overseas account is usually not reachable through a California court. In those cases, the payment company, a fast report to law enforcement, and protecting your identity are where your effort pays off.

Related guides

• Scams and fraud: your rights and where to start
• How to get money back after a scam
• Where to report a scam
• Zelle and payment app scams
• Phishing, smishing and vishing
• Tech support and fake invoice scams
• Notario fraud
• California identity theft laws
• California debt collection laws
• California statute of limitations

Last updated: October 2, 2026.

This article is general legal information, not legal advice. For your specific situation, contact your payment company, the California office named above, or a lawyer licensed in California.

Frequently Asked Questions

Can I sue a scammer in California?

Possibly, if you can identify and serve them. The CLRA (Civil Code section 1780) lets a consumer, meaning someone who bought or leased goods or services for personal use, sue for damages caused by a practice listed in section 1770, after giving 30 days' written notice; the UCL lets a person who lost money or property as a result of an unfair business practice seek its return. An anonymous or overseas scammer is usually not reachable through a California court.

What is the difference between the CLRA and the UCL?

The CLRA (Civil Code section 1750 and following) gives a consumer harmed by a practice listed in section 1770 actual and punitive damages, restitution and, if the consumer wins, mandatory attorney's fees, with a 3-year deadline. The UCL (Business and Professions Code section 17200) lets a person who lost money or property as a result of an unfair business practice get an injunction and restoration of that money or property, with a 4-year deadline.

Does the CLRA give triple damages?

Only in one situation. Section 1780(c) requires treble actual damages for a violation of section 1770(a)(24); other CLRA violations are not automatically tripled. Seniors and disabled consumers may get up to $5,000 more if the court makes specific findings.

Do I need to send a letter before suing under the CLRA?

Yes, for a damages claim. Section 1782 requires written notice by certified or registered mail, return receipt requested, at least 30 days before suing, demanding that the business correct the problem. An injunction-only suit can be filed without it.

Will the California Attorney General get my money back?

Do not expect it. The Attorney General says complaints help it decide whether to investigate a company and that it cannot provide legal advice or assistance to individuals. Contact your payment company first.

What is the California Attorney General's phone number for consumer complaints?

The Public Inquiry Unit is at (800) 952-5225 toll-free in California, or (916) 210-6276. Complaints are filed online at oag.ca.gov, and a Spanish form is available.

Is there a limit on crypto ATM transactions in California?

Yes. Financial Code section 3902 bars a kiosk operator from accepting or dispensing more than $1,000 a day from or to a customer, and section 3904 caps fees at the greater of $5 or 15 percent. Report violations to the DFPI.

Can a California bank stop a transaction if it suspects elder abuse?

Banks must report suspected financial abuse of an elder or dependent adult under Welfare and Institutions Code section 15630.1, but that section does not itself give a power to hold a transaction. Broker-dealers and investment advisers may temporarily delay a disbursement under section 15630.2(j).

Who do I call if an elderly person in California is being scammed?

Call Adult Protective Services at 1-833-401-0832 and enter your ZIP code to reach your county, 24 hours a day. The DOJ Elder Fraud Hotline (833-372-8311) also helps with fraud against anyone 60 or older.

Can I cancel a contract with a door-to-door salesperson in California?

Generally yes, for contracts of $25 or more signed away from the seller's place of business: until midnight of the third business day, or the fifth if you are 65 or older (Civil Code section 1689.6). Send written notice to the address or email in the agreement.

What is the small claims limit in California?

$12,500 for an individual and $6,250 for a business. No one may file more than two small claims over $2,500 anywhere in the state in a calendar year (Code of Civil Procedure section 116.231).

How long do I have to sue for fraud in California?

Three years, but under Code of Civil Procedure section 338(d) the clock does not start until you discover the facts constituting the fraud. CLRA claims have a 3-year limit from the act, and UCL claims 4 years.