CFPB Settles with Online Lender for $15 Million over Allegations of Unauthorized Account Debits

An online lender recently entered into a consent order (2023 Consent Order) with the CFPB to resolve allegations concerning debits of consumer bank accounts without authorization, which the CFPB found violated a previous consent order (2019 Consent Order).  In addition to the remedial measures that lender has already taken, it will have to pay $15 million in civil money penalties.

In the 2019 Consent Order, the CFPB found that the lender had debited certain consumer bank accounts without consumer authorization.  During the relevant period, the lender had purchased loan applications from lead generators, overwritten bank account information for those consumers with existing loans, and debited or attempted to debit those new bank accounts.  The CFPB also found that the lender had also failed to honor loan extensions.  The lender had created two loan files for consumers applying for a certain loan program, one that showed an incorrect balance of $0 and another that showed the correct balance.  Later, during the repayment period when those consumers requested an extension, the extension was applied to the loan file reflecting a $0 balance, and not the correct loan file reflecting the actual loan balance. 

In the 2023 Consent Order, the CFPB again found that the lender had debited certain consumer bank accounts without consumer authorization.  The lender launched a new program to process leads in 2020.  However, the new process continued to overwrite existing consumer bank account information from the leads it had purchased, which the lender debited or attempted to debit.  The lender self-identified this practice and provided remediation to affected consumers.  The CFPB also found that the lender had failed to honor loan extensions to other categories of consumers.  In those instances, the lender would debit or attempt to debit the full payment amount if consumers had made an interim partial payment.  However, the lender had not informed consumers that the extension would be cancelled if such payments were made.  The CFPB found other violations, many of which were attributable to technical systems and processing errors, and that the lender had either self-identified or previously provided remediation. 

Under the 2023 Consent Order, which supersedes the 2019 Consent Order, the lender will have to pay $15 million in civil money penalties.  It is also banned from providing closed-end credit for personal use moving forward, and it is banned from using or selling consumer information.  It must also create and implement a comprehensive compliance plan to address its debiting, billing, and loan extension practices.  Relatedly, its executive compensation agreements and executive compensation policies must consider the executives’ actions taken to ensure compliance with the 2023 Consent Order and applicable federal consumer financial laws.

The lender neither admits nor denies the allegations.