Up to about 689,000 people whose personal information was exposed in a 2024 data breach at FinWise Bank can file a claim against a $2.8 million settlement, and the window to do so closes October 29, 2026. A federal court in Utah granted the deal preliminary approval. Many of those affected never opened an account with FinWise directly; their financial relationship was with a separate company that used FinWise’s bank charter to make a loan possible, which is exactly why a notice bearing an unfamiliar bank’s name can look like a scam rather than a real settlement.
A Bank Most of the 689,000 Never Knowingly Chose
FinWise Bank is a Utah-chartered bank that does not primarily run a retail branch network or market checking accounts to walk-in customers. Instead, it operates what the industry calls embedded banking: originating loans on behalf of financial technology companies that handle the marketing, the mobile app and the day-to-day customer relationship. A borrower who filled out an application through a fintech brand’s website may have had no reason to know that a bank based in Utah, not the brand itself, was the actual lender behind the transaction. For an older reader trying to decide whether a settlement notice is legitimate, that gap between the name on the loan paperwork and the name on the envelope is the whole story.
FinWise Bancorp describes this line of business on its own investor site as helping non-financial companies, mostly fintechs, offer lending products under the bank’s charter and compliance oversight, referring to its partners as “Strategic Platforms.” In the case behind this settlement, the fintech partner was American First Finance, which built the loan application platform and serviced the installment loans while FinWise served as the lender of record, according to reporting on the underlying litigation. That arrangement means a class member could have dealt only with American First Finance’s storefront or app and never seen the name FinWise until a breach letter, and now a settlement notice, showed up in the mail.
Free retirement updates: Keep more of your Social Security and savings with plain-English updates on the changes, deadlines, and costly mistakes retirees miss. Subscribe free.
How the Breach Happened and Why Notice Took So Long
FinWise has said a former employee accessed systems containing customer records on or about May 31, 2024, an incident the bank has characterized in regulatory filings as insider wrongdoing rather than an outside hack. The company has said it took roughly a year to complete the forensic investigation needed to identify the full list of affected people, and it did not begin mailing notification letters to consumers until late July 2025. A bank spokesperson has said the delay largely reflected the time needed to run a forensic IT investigation and coordinate with the bank’s insurance carrier, adding that identifying and finalizing a list of more than 600,000 affected people “takes a while and it’s something that has to be done very carefully.”
Utah law requires a company to report a breach affecting 500 or more state residents to the state attorney general without unreasonable delay, though it sets no fixed number of days. The disclosure that put the 689,000 figure on the public record was a notification FinWise filed with Maine’s attorney general, published September 12, 2025, more than 15 months after the access reportedly occurred. The exposed data included full names, dates of birth, Social Security numbers and account numbers, a combination that is especially useful to identity thieves because it can support opening new credit in a victim’s name rather than just charging an existing card.
What the $2.8 Million Fund Actually Pays
The settlement, reached in the consolidated case known as Minter v. FinWise Bank in the U.S. District Court for the District of Utah, gives eligible class members two ways to be paid. A class member can submit documentation of costs tied to the breach, such as identity-theft-related expenses or fees to freeze and unfreeze a credit file, for reimbursement up to $5,000. Alternatively, a class member can skip the paperwork entirely and request a pro rata cash payment, meaning an equal share of whatever remains in the fund once administrative costs, any court-approved attorneys’ fees and service awards are paid. Eligible documented losses under the settlement’s own instructions include fees to purchase or extend credit monitoring after May 31, 2024, costs to freeze or unfreeze a file with any of the three credit bureaus, and incidental expenses such as notary, postage or long-distance charges tied directly to sorting out the incident.
Either payment can be combined with a separate benefit built into the deal: two years of three-bureau credit monitoring, available regardless of which cash option a class member picks, according to the settlement’s published terms. People who lived in California when the breach occurred can qualify for up to twice the standard cash payment under a provision specific to that state. Because the fund is fixed at $2.8 million and the eligible class runs into the hundreds of thousands, the pro rata cash option in particular is likely to shrink once divided among however many people actually file; the administrator has not published a per-claim estimate.
The October 29 Deadline, and the Dates Around It
Claim forms must be submitted online or postmarked by October 29, 2026. Two earlier dates matter for anyone who disagrees with the deal: a class member who wants to preserve the right to sue FinWise separately has until September 29, 2026, to formally exclude themselves from the settlement, and the same date is the deadline to file a written objection with the court. A federal judge is scheduled to hold a final approval hearing on December 10, 2026, at 10 a.m. in Salt Lake City before deciding whether the settlement and the attorneys’ fee request attached to it will be approved.
Anyone who received a physical or emailed notice carrying a unique claim ID and PIN can file directly through the official settlement site rather than a third-party claims-aggregator page, several of which have already published their own summaries of the same case. Questions about eligibility, lost notices or claim status go to the court-appointed settlement administrator, Epiq, at the toll-free number posted on the official site, not to FinWise Bank or American First Finance directly.
This article was produced with the assistance of AI and reviewed by The Financial Wire editorial team.
More Financial Reading
- What really happens to your joint savings account when you die?
- How many CDs can you park at 1 bank? FDIC rules you must know
Warren Cohen is a finance writer based in Phoenix, Arizona, covering personal finance topics including credit, banking, and beginner investing. He earned his degree in business administration from Arizona State University and began his career working in consumer finance, where he gained direct experience with lending and credit systems. He now writes for personal finance websites and fintech platforms, focusing on clear, practical content that helps readers make informed financial decisions.
