A Breach Letter From a Bank You May Not Recognize: FinWise’s $2.8 Million Settlement Covers Up to 668,000 People, Many of Them American First Finance Customers — $4.19 of Fund per Person Before Fees and Costs; California Cash Claims Paid Double. Claims Close October 29.

If you have the notice: file by October 29, 2026 at FinWiseDataSettlement.com with the Unique ID and PIN printed on your email or postcard, or mail the paper claim form to FinWise Data Incident Settlement Administrator, P.O. Box 4390, Portland, OR 97208-4390. Filing is the only way to get money or the monitoring; people who do nothing are still bound by the release.

If the name FinWise Bank, a Utah-chartered bank in Murray, Utah, means nothing to you, its own breach letter explains why. The letter, as quoted in the plaintiffs’ consolidated complaint, describes its arrangement with American First Finance (AFF): “In this arrangement, FinWise is the lender and AFF is the technology provider.” FinWise originates and funds the loan; AFF runs the application platform and services the loan. The letter told recipients that “you may have had, or applied for, a FinWise installment loan” or “a lease-to-own account, or a retail installment sales agreement account with AFF which was impacted by this security incident.” According to the Massachusetts attorney general, AFF works with brick-and-mortar retailers on point-of-sale lease-to-own contracts for goods such as auto parts, furniture, appliances, electronics and jewelry. If you financed a purchase through AFF, FinWise may have been the lender; if you leased through AFF, FinWise’s letter says AFF lease-to-own accounts were among the data involved.

The settlement papers say FinWise experienced the incident on or about May 31, 2024. FinWise’s public description, quoted in the complaint, was a data security incident “involving a former employee who accessed FinWise data after the end of their employment.” The notice lists the data as some combination of full names, dates of birth, Social Security numbers and customer account numbers. Letters dated July 29, 2025 went out by email and regular mail and, according to the complaint, offered one year of credit monitoring.

Why fourteen months? Trade coverage of FinWise’s filing with the Maine attorney general disagrees on the discovery date: Banking Dive reported the bank did not discover the breach until June 18, 2025; American Banker reported it discovered the access on May 31, 2024, which is also how the plaintiffs’ consolidated complaint reads the breach letter. A FinWise spokesperson told American Banker that much of the time between discovering the incident and treating it as material went to a forensic investigation and coordination with its insurance carrier: “Identifying and finalizing a list of 600k+ impacted takes a while and it's something that has to be done very carefully”.

Six suits were filed in federal court in Utah between July 30 and August 6, 2025. Judge Parrish consolidated them under Minter on October 3, 2025; a consolidated complaint followed on November 17. A March 17, 2026 mediation in Philadelphia before retired judge Diane M. Welsh of JAMS ended without a deal, further negotiation produced this agreement, and the plaintiffs moved for approval on May 8. The defendants deny wrongdoing; the settlement admits no liability.

The class is defined in the notice as “all living, natural persons residing in the United States whose Private Information was affected by the Data Incident, including all individuals who were sent a notice of the Data Incident.” If you received FinWise’s 2025 breach letter and live in the U.S., you are in. Excluded are the defendants and their affiliates, the judges and their staff, anyone who already released these claims, and anyone who opts out.

How big is it? Three numbers circulate, and they do not match. FinWise told investors that “In July 2025, the Company notified approximately 600,000 individuals”. Trade press citing the Maine attorney general filing reported 689,000. The court’s July 1 order says “The Settlement Class may include as many as 668,000 individuals”. We use 668,000, the settlement’s own number. The court papers do not say whether data beyond the AFF partnership was touched; American Banker reported that, while not explicit in filings, the former employee appears to have accessed only data tied to it.

Is the notice real? The court appointed Epiq Class Action & Claims Solutions, Inc. as administrator. Under the agreement, people with an email address on file get the email notice first and people with a postal address get a postcard, which in the court-approved draft is headed “Court-Approved Legal Notice” and carries a tear-off claim form for the no-document options. The approved email template’s subject line reads “FINWISE COURT ORDERED NOTICE OF CLASS ACTION SETTLEMENT”. The official site lists one phone number, 1-877-419-3877, one email, info@FinwiseDataSettlement.com, and one address, P.O. Box 4390, Portland, OR 97208-4390. The official claim form asks for name, address, phone, email and your Unique ID and, only if you want digital payment, the email or phone tied to a Venmo, PayPal or Zelle account. It has no field for a Social Security number. And if the notice’s spelling of the judge — “Parish” — looks off: the court’s own orders spell it Parrish.

No notice, or lost it? Online filing needs the Unique ID and PIN; the site says to call the administrator if you never got a notice or lost yours. The paper form lets you leave the Unique ID blank if you did not receive a notice.

Every class member chooses one of two cash options and can add monitoring on top.

Documented Losses Payment — up to $5,000. The notice covers unreimbursed losses from identity theft or fraud, falsified tax returns or other misuse of your information; costs “incurred on or after May 31, 2024” for credit monitoring, identity protection, or freezing and unfreezing credit reports; and notary, fax, postage, copying, mileage and long-distance charges. You need records not prepared by you; the notice says self-prepared documents such as handwritten receipts are, “by themselves, insufficient to receive reimbursement”. Losses already reimbursed elsewhere, including through the monitoring FinWise offered in its 2025 letter, are excluded. Online uploads must be under 20 MB per file, and an unfinished online claim is not saved.

Cash Fund Payment — pro rata, no proof. An equal share of what is left after everything else is paid. No estimate appears in the notice, the agreement, the order or on the site, which says only that “Your cash payment may decrease depending on the number of claims filed.” The claim form adds: “By checking this box, I give up my right to seek a Documented Losses Payment regardless of whether I submit information to support such payment.”

California residents get double. The notice says California class members “may be entitled to additional relief under the terms of the Settlement, up to two times the Cash Fund Payment”, if they lived in California at the time of the incident. The agreement is more exact: the pool is divided by twice the number of valid California claims plus the non-California claims, and California claimants receive twice the resulting base amount. You tick a box affirming California residency, and the whole form is signed under penalty of perjury.

Credit monitoring — two years, three bureaus. Available to anyone who files, on top of either cash option, with at least $1 million of identity theft insurance under the agreement. The activation code goes to your email after the settlement becomes final.

The order of payment matters. The fund pays administration and taxes, attorneys’ fees and costs, and service awards first; then monitoring; then documented losses; then the cash shares. If approved documented losses exceed the net fund, “there will be no Cash Fund Payments”. Pick one payment method: Venmo, PayPal, Zelle or a mailed check; choose more than one and you get a check, which must be cashed within 90 days. Leftovers are redistributed to cash claimants who cashed their first payment while the average payment stays at $3.00 or more, then go to the Electronic Frontier Foundation. Nothing reverts to FinWise.

Listings for this settlement lead with “up to $5,000”. That is the ceiling for people with paper. For everyone else, the math starts with the class size. By our arithmetic, $2,800,000 spread over the court’s 668,000 people is $4.19 each ($4.06 over the 689,000 in the press, $4.67 over the 600,000 FinWise told investors).

Then come the deductions the papers name. Class counsel may ask for up to one-third of the fund: $933,333. Six class representatives may ask for up to $2,500 each: $15,000. The agreement pegs administration costs through final approval at an amount “roughly estimated to be approximately $225,000.00”. If the court awards the full one-third fee and both caps are used, that leaves about $1,626,667, or $2.44 per class member, before litigation expenses, later administration costs, the credit monitoring claimants choose and every documented-loss claim — none of which the papers quantify. Class counsel’s fee application was due September 15, and the court docket shows a fee-related filing that day; it is not posted on the settlement site and we have not been able to read it, so the amount actually requested is unconfirmed here.

These are scenarios, not ceilings: $1,626,667 divided by the number of cash claims assumes the maximum one-third fee (a smaller award raises every row; at 25%, the 1% row would be about $278) and takes nothing out yet for monitoring, documented losses, expenses or later administration (which lower every row). The California doubling lowers the base further. If one in ten cash claimants lived in California, the divisor grows by 10%, so each non-California share shrinks by about 9% and each California share is twice that smaller number.

None of this argues against filing; a claim is free, and the two years of monitoring come on top of either cash option. It argues for reading “pro rata” literally. FinWise’s side of the deal is fixed at $2.8 million, and FinWise told investors the fund, including fees and expenses, “is expected to be covered in full by the Company’s cyber insurance policy.”

September 29 is only for leaving or objecting. An opt-out is a signed letter mailed to the P.O. Box; “You cannot opt-out (exclude yourself) by telephone or by email.” Per the notice and FAQ, an opt-out must be mailed and postmarked by September 29, and an objection must be postmarked or shipped by private courier by that date; the site’s home page lists objections as “Filed by” that date, and the court’s preliminary approval order (paragraph 18) describes objections as filed with the court and mailed to class counsel and defense counsel, while the notice and the agreement send them to the administrator. An objector can do both by September 29. With four days left, follow the notice’s own advice: get a manual postmark at a post office counter or use Certified Mail. Letting the date pass keeps you in the class. If more than 1,000 people opt out, the defendants may void the deal. For paper claims, the form says postmarked by October 29, while the site’s claim page says received by then; mail early or file online.

When money could move (our arithmetic). Benefits go out no later than 60 days after the Effective Date — the day after a final approval order if nobody objects, or 30 days after it if objections are overruled and no one appeals. If the court rules on December 10 and no one appeals, the 60-day payment deadline would fall around February 9, 2027 (no objections) or March 10, 2027 (objections overruled); a later ruling or an appeal pushes it back. An appeal resets the clock.

Do not confuse it with: the $7.8 million Massachusetts attorney general settlement with American First Finance announced May 13, 2026 over lease-to-own early-buyout practices, where the attorney general said consumers receiving restitution “will be contacted in the coming months”; or the 12 months of monitoring in FinWise’s 2025 letter, which is separate from the two years here.

Contacts: Epiq, FinWiseDataSettlement.com, 1-877-419-3877, info@FinwiseDataSettlement.com. Class counsel are Andrew W. Ferich (Ahdoot & Wolfson, P.C.), Marc H. Edelson (Edelson Lechtzin LLP) and Tyler J. Bean (Siri & Glimstad LLP); the defendants are represented by Cozen O’Connor.