The Finicity lawsuit is a putative class action filed in May 2023 in the Eastern District of California, Lawrence v. Finicity Corp., accusing the Mastercard-owned data aggregator of using bank-lookalike login screens to capture consumers’ banking credentials through the EveryDollar budgeting app and then selling their account and transaction data without consent. A federal judge dismissed the plaintiff’s civil RICO claim but let state anti-phishing and unjust enrichment claims move forward. In February 2025, the Ninth Circuit reversed the district court on arbitration, sending a threshold question back down that will decide whether the case continues in court at all.
Who Finicity Is and What the Suit Alleges
Finicity Corporation is a financial data aggregator and a wholly owned subsidiary of Mastercard International. It sits between consumer apps and banks, pulling account and transaction data when a user links a bank account through a service like EveryDollar. Finicity describes the model as “consumer-permissioned” and is registered as a Consumer Reporting Agency under the Fair Credit Reporting Act.1Finicity. Terms and Privacy
Kaitlyn Lawrence, represented by Bursor & Fisher, filed suit on May 26, 2023.2GovInfo. Lawrence v. Finicity Corp., Case 2:23-cv-01005 The complaint alleges that Finicity’s login pages misappropriated bank URLs, theme colors, and trademarked logos, causing users to believe they were entering credentials into their own bank’s portal when they were in fact typing them into a Finicity-controlled page.3Bursor & Fisher. Stefan Bogdanovich Finicity then repackaged and sold the resulting bank account and transaction information to lenders and financial institutions without users’ knowledge or consent, according to the complaint.4Bloomberg Law. Mastercard Unit Hit With Lawsuit Over Sharing of Financial Data
What Claims Survived
Lawrence brought the case as a civil RICO action under 18 U.S.C. ยง 1962, together with claims under California and Utah anti-phishing statutes and for unjust enrichment.2GovInfo. Lawrence v. Finicity Corp., Case 2:23-cv-01005 The court dismissed the RICO count but permitted the state-law claims to proceed.5Mealey’s Litigation Report. RICO Claim Tossed From Suit Alleging App Captures Data With Cyberpirated Marks The anti-phishing theories are the substantive engine of what remains.
The Arbitration Ruling and Where the Case Stands
The biggest early question is whether Lawrence can be in court at all. Finicity moved to compel arbitration under the terms it says Lawrence accepted when she linked her bank account through EveryDollar. The district court refused, finding that Finicity had not given “reasonably conspicuous notice” of its terms and conditions.6Bloomberg Law. Consumer Advances Info-Broker Suit Against Mastercard’s Finicity
The Ninth Circuit reversed on February 19, 2025. In a memorandum opinion, the panel found the notice conspicuous enough to form a binding agreement, pointing to an uncluttered page, bright orange hyperlinks against a white background, disclosure language in reasonably sized black font sitting directly above the “Next” button, and a distinct color scheme signaling a new party. Because Lawrence had been “explicitly advised” that clicking “Next” meant agreement, the court held she unambiguously manifested assent.7U.S. Court of Appeals for the Ninth Circuit. Lawrence v. Finicity Corp., No. 24-1737
The appeals court did not end the case. It remanded so the district court could decide Lawrence’s separate argument that the arbitration agreement lacks sufficient consideration, a question the Ninth Circuit left for the lower court to address in the first instance.7U.S. Court of Appeals for the Ninth Circuit. Lawrence v. Finicity Corp., No. 24-1737 That is where the class action currently sits.
The Separate Mass Arbitration Track
A different firm, Labaton Keller Sucharow, pursued the same core theory against Finicity through mass arbitration rather than a class action. The claims track the Lawrence allegations: fake login pages impersonating users’ banks, credentials captured through EveryDollar, and data sold to third parties without consent, in violation of state anti-phishing laws.8Labaton Keller Sucharow. Finicity
Eligibility ran to people who opened an EveryDollar account within three years before October 1, 2025, and the firm advertised recoveries of up to $5,000 per claimant. The campaign is closed to new clients, and no public outcome has been reported.8Labaton Keller Sucharow. Finicity If the Lawrence plaintiff is ultimately pushed into arbitration on remand, mass arbitration is the model her claims would likely follow.
How This Compares to the Plaid Settlement
Finicity’s competitor Plaid faced nearly identical allegations in 2020: login screens mimicking bank-specific portals, credentials captured, and full financial data taken for the aggregator’s own commercial purposes. Plaid settled in 2021 for $58 million, covering roughly 98 million affected users, without admitting wrongdoing.9Federal Reserve Bank of Kansas City. Payments System Research Briefing That precedent is the closest available benchmark for what a Finicity resolution could look like, though nothing in the current record shows Finicity has offered or agreed to any payout.
The Regulatory Backdrop
Financial data aggregators are not subject to direct federal supervision or regular examination, though the CFPB has authority to designate them as “larger participants” under Dodd-Frank.9Federal Reserve Bank of Kansas City. Payments System Research Briefing The CFPB finalized its Section 1033 Personal Financial Data Rights rule on October 22, 2024, aimed at standardizing consumer financial data sharing and moving the industry off screen scraping onto secure APIs.10CFPB. Personal Financial Data Rights
Industry plaintiffs, including Forcht Bank, the Kentucky Bankers Association, and the Bank Policy Institute, sued to block the rule. The CFPB itself moved to stay it on July 29, 2025, and a federal court in Kentucky granted the stay that same day; the Bureau said it would “substantially” revise the rule through new rulemaking to address “defects in the initial Rule.”11Consumer Financial Services Law Monitor. CFPB Section 1033 Open Banking Rule Stayed as CFPB Initiates New Rulemaking With the rule paused and no direct federal examiner in place, private cases like Lawrence and the Labaton arbitration remain the main way consumers can challenge how aggregators collect and use their data.