The Consumer Financial Protection Bureau on Thursday ordered payments firm Block to pay a penalty, citing fraud and weak security protocols on its mobile payment service Cash App. The regulator said Block,

Cash App is closing out the week on the hook for $255 million in multiple settlements around its consumer protections. Block, the company that owns Cash App, agreed Wednesday to pay $80 million to 48 states that fined the company for violating laws intended to keep illicit activity off the platform.

Cash App-owner Block must offer up to $120 million in refunds to consumers who federal regulators say were exposed to potential fraud.