Cash App-owner Block must offer up to $120 million in refunds to consumers who federal regulators say were exposed to potential fraud.

The CFPB ordered Block to update its business practices to comply with the law, pay between $75 and $120 million to users whose unauthorized transfers weren't investigated and send a $55 million penalty to the CFPB's victim relief fund. Block agreed to the settlement but disagreed with the CFPB's characterizations of the company's actions.

Block, based in Oakland, was ordered Thursday to pay out at least $75 million to customers who had bad service experiences with Cash App.