Citizens Bank has been the subject of a long string of lawsuits, federal enforcement actions, and class action settlements, and searches for a Citizens Bank lawsuit typically land on one of a handful: a $137.5 million overdraft fee settlement in 2013, $18.5 million in federal penalties plus roughly $14 million in customer refunds in 2015, a $9 million CFPB penalty in 2023 over credit card dispute handling, and pending class action litigation over a 2026 data breach tied to a third-party vendor and the Russian ransomware group Everest.
The $137.5 Million Overdraft Fee Settlement
The largest payout in the bank’s litigation history came out of a class action alleging that Citizens reordered debit card and ATM transactions from largest to smallest instead of processing them in the order they occurred. Reordering that way pushes an account into the negative sooner, which multiplies the number of overdraft fees the bank can charge. Each fee ran roughly $25 to $35, so a handful of small purchases could turn into a cascade of charges.1WTAE Pittsburgh. Bank Customers Could Be Getting Big Refunds
The claims were folded into a multidistrict litigation captioned In re: Checking Account Overdraft Litigation, Case No. 09-cv-02036, before U.S. District Judge James Lawrence King in Miami. At least 30 banks were named in that MDL.2Grossman Roth. $137.5 Million Settlement Announced in Citizens Bank Overdraft Fee Class Action Citizens agreed to pay $137.5 million without admitting wrongdoing, and payments went out to class members on September 19, 2013.3Top Class Actions. Citizens Bank Reaches $137.5M Overdraft Fee Settlement
The 2015 Deposit Processing Penalties
In August 2015, the Consumer Financial Protection Bureau, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corporation acted jointly against Citizens over how it handled deposit slips. From January 2008 through November 2013, when a customer’s deposit slip listed a higher amount than the cash and checks actually inside the envelope, the bank kept the difference instead of investigating or contacting the customer. For most of that stretch, the bank simply ignored discrepancies under $50; the threshold was lowered to $25 from 2012 to 2013, but the underlying practice continued.4American Banker. Citizens Fine Could Spell Trouble for Other Banks
Regulators found the conduct unfair and deceptive under Section 5 of the FTC Act and the Dodd-Frank Act. A consent order (CFPB Docket No. 2015-CFPB-0020) required Citizens to pay $18.5 million in combined penalties, split between a $7.5 million civil money penalty to the CFPB and a $10 million penalty to the OCC.5Consumer Financial Protection Bureau. Citizens Financial Group Enforcement Action6Office of the Comptroller of the Currency. OCC Takes Enforcement Action Against Citizens Bank The bank was also ordered to pay back roughly $14 million to affected account holders: about $11 million to consumers and $3 million to businesses. It had to overhaul its deposit reconciliation and compliance systems.7Consumer Financial Protection Bureau. Consent Order, CFPB Docket No. 2015-CFPB-0020 The CFPB terminated its consent order in October 2017 after the bank completed its obligations.
The 2023 Credit Card Dispute Order
On January 30, 2020, the CFPB sued Citizens in the District of Rhode Island (Case No. 1:20-cv-00044) over how the bank handled credit card billing disputes and fraud claims. According to the complaint, Citizens auto-denied billing error and unauthorized-use claims if the customer did not return a fraud affidavit, failed to credit accounts for related fees and finance charges even after confirming errors, skipped the acknowledgment and denial letters federal law requires, and left required credit counseling disclosures off its dedicated toll-free line. The CFPB alleged violations of the Truth in Lending Act, Regulation Z, the Fair Credit Billing Act, the CARD Act, and the Consumer Financial Protection Act.8Consumer Financial Protection Bureau. Citizens Bank, N.A. Enforcement Action
On May 23, 2023, the court entered a stipulated final judgment ordering Citizens to pay a $9 million civil money penalty, along with injunctive relief aimed at keeping the conduct from recurring.8Consumer Financial Protection Bureau. Citizens Bank, N.A. Enforcement Action
The 2026 Data Breach Class Actions
The most recent litigation grew out of a cyberattack discovered in April 2026. The Russian cybercriminal group Everest claimed it had reached the bank’s systems through a third-party vendor and taken about 3.4 million records, which it posted on the dark web. The compromised data reportedly included names, home addresses, account numbers, and Social Security numbers.9Top Class Actions. Citizens Bank Class Action Alleges Bank Failed to Protect Sensitive Information in Data Breach
In an April 21, 2026 statement, Citizens described most of what Everest posted as “masked test data” and said only “a limited set of information for a small number of customers” was actually involved. The bank said it had found no evidence of unauthorized access to its own network and was contacting affected individuals directly.10Citizens Financial Group. Citizens Financial Group Statement on Data Security Incident The distance between the bank’s account and the 3.4 million figure claimed by Everest has not been publicly reconciled.11InvestmentNews. Citizens Flags Limited Customer Impact After Vendor Data Incident Amid Ransomware Claims
A class action was filed against Citizens Financial Group in the District of Rhode Island on April 22, 2026 (Hauser v. Citizens Financial Group Inc., et al., Case No. 1:26-cv-00233), alleging the bank did not maintain reasonable security safeguards, adequately train employees on cybersecurity, or provide timely notice. The complaint invoked the Gramm-Leach-Bliley Act and sought compensatory, punitive, and statutory damages, plus injunctive relief.9Top Class Actions. Citizens Bank Class Action Alleges Bank Failed to Protect Sensitive Information in Data Breach The plaintiff voluntarily dismissed that case on May 18, 2026.12CourtListener. Russell Hauser v. Citizens Financial Group, Inc. A separate proposed class action was filed in the District of Massachusetts on May 6, 2026 against the third-party vendor Sefas Innovation Inc., alleging the vendor failed to safeguard client data.13Law360. Citizens Bank Customer Says Software Vendor Leaked Info Reporting indicates Sefas appears to handle statement printing for Citizens.14American Banker. Customers Sue Citizens, Frost Over Third-Party Data Breach The scope of the breach and the future path of the litigation are still developing.
The 2026 attack was not the bank’s only recent data incident. In late 2024, Citizens reported a separate breach to the Maine Attorney General’s Office attributed to “insider wrongdoing,” affecting more than 8,300 people and exposing account numbers, Social Security numbers, and dates of birth. Customer notifications went out beginning December 6, 2024.15ClassAction.org. Citizens Bank Data Breach
Other Resolved Cases
Several smaller matters have closed over the years. In force-placed flood insurance litigation in the District of Rhode Island (Case Nos. 1:11-cv-268 and 1:12-cv-239), borrowers alleged Citizens made them buy flood coverage at inflated prices and in amounts beyond what federal law or their mortgage contracts required; the court approved a $1.5 million settlement.16Berger Montague. Citizens Bank Force-Placed Flood Insurance Litigation
In DiCicco, et al. v. Citizens Financial Group Inc., et al. (Case No. 2:15-cv-00267-TON, E.D. Pa.), borrowers said Citizens calculated minimum payments on home equity lines of credit in a way that front-loaded principal and raised payments during the first seven years of repayment, contrary to their loan agreements. After a final hearing on August 16, 2016, class members received a minimum payout of $20 and the option to have future payments recalculated using a level payment method.17Top Class Actions. Citizens Bank HELOC Minimum Payment Class Action Settlement
In 2019, the EEOC sued Citizens under the Americans with Disabilities Act (EEOC v. Citizens Bank, N.A., Civil Action No. 1:19-cv-00362) on behalf of a Rhode Island call center employee whose anxiety disorder had been triggered by handling escalated calls. His provider recommended reassignment; the EEOC said the bank refused and would only discuss options if he returned to his old role and supervisor, which pushed him to resign, even though hundreds of nearby positions were open.18HR Dive. Customer Service ADA Accommodation: Citizens Bank19Bloomberg Law. Citizens Bank to Pay $100,000 to Settle EEOC Discrimination Suit Citizens paid $100,000 and entered a 30-month consent decree requiring a noncompetitive reassignment policy, employee and HR training, and internal compliance monitoring.20EEOC. Citizens Bank, N.A. to Pay $100,000 to Settle EEOC Disability Discrimination Lawsuit
Cases the Bank Won or That Are Still Open
Not every case has gone against Citizens. In Heinert et al. v. Bank of America NA et al. (Case No. 6:19-cv-06081, W.D.N.Y.), about 637 investors said they lost more than $102 million in a decade-long Ponzi scheme run by Perry Santillo, Christopher Parris, Paul Anthony LaRocco, John Piccarreto, and Thomas Brenner, and argued that Citizens and Bank of America had aided and abetted the fraud by ignoring suspicious activity. U.S. District Judge David G. Larimer dismissed the claims on October 18, 2019, holding that even a “veritable ‘forest of red flags'” does not meet the actual-knowledge standard and that a bank has “no duty, and no right, to explore the source of monies deposited by their accountholders.”21KTT Law. BofA, Citizens Bank Defeat Investors’ $102M Ponzi Suit The Second Circuit affirmed unanimously on November 13, 2020.22FindLaw. Heinert v. Bank of America N.A., Citizens Bank N.A., No. 20-0691
One older case is back in play. In Conti v. Citizens Bank, N.A. (Case No. 1:21-cv-00296, D.R.I.), filed in July 2021, Rhode Island homeowner John Conti alleged the bank breached his mortgage and was unjustly enriched by refusing to pay interest on escrow funds held for taxes and insurance, as Rhode Island law requires.23ClassAction.org. Conti v. Citizens Bank, N.A., Complaint The district court dismissed on National Bank Act preemption grounds, but the First Circuit vacated that ruling after the Supreme Court’s decision in Cantero v. Bank of America, N.A., 602 U.S. 205 (2024), and sent the case back for a fresh preemption analysis.24U.S. Court of Appeals for the First Circuit. Conti v. Citizens Bank, N.A., No. 22-1770 The case is pending on remand.