Attorney General Bonta Announces $10 Million Settlement Over Attempted Unauthorized Withdrawals by Payment Processing Company

OAKLAND – California Attorney General Rob Bonta today joined a coalition of 48 states, the District of Columbia, and Puerto Rico in announcing a $10 million settlement with payment processor ACI Worldwide and its subsidiary, ACI Payments, over a testing error that led to the attempted unauthorized withdrawal of $2.3 billion from the accounts of mortgage-holders. ACI processes mortgage payments for a variety of third-party clients, including mortgage servicer Nationstar Mortgage, which is also known publicly as “Mr. Cooper.”  

On April 23, 2021, during internal testing, ACI erroneously initiated Automated Clearing House (ACH) transactions to withdraw unscheduled mortgage payments from nearly 480,000 Nationstar Mortgage borrowers nationwide — including over 68,000 borrowers in California. In coordination with fellow state attorneys general and state financial regulators, Attorney General Bonta launched an investigation shortly after the attempted unauthorized withdrawals became public. While the vast majority of withdrawals did not ultimately go through or were reversed, and while impacted consumers have received restitution from ACI and through related settlements, the investigation determined that the incident was possible due to significant defects in ACI’s privacy and data security procedures and technical infrastructure.  

“Companies need to conduct internal testing — and to be vigilant when doing so. ACI’s erroneous withdrawals should not have happened. Troublingly, in some cases consumers were not able to access the money at issue and were forced to incur overdraft or insufficient funds fees,” said Attorney General Bonta. “I am pleased that the company moved swiftly to stop the withdrawals and to provide restitution to consumers. With today’s resolution, the state attorneys general and financial regulators are holding the company accountable for its prior failure.” 

As part of the settlement: 

• ACI will pay $10 million in penalties to the states attorneys general, with $1.2 million going to California. 
• ACI must take steps to avoid any future incidents, including using artificially created data rather than real consumer data when testing systems or software. 
• To avoid future incidents, ACI must also segregate any testing or development work from its consumer payment systems.  

As part of the joint multistate investigation and negotiation, state regulators entered into a separate agreement with ACI for an additional $10 million. The California Department of Financial Protection & Innovation — which protects consumers, regulates financial services, and fosters responsible innovation  — entered into that separate agreement along with 43 other state regulators.

On June 27, 2023, the CFPB also issued an administrative order requiring ACI to pay $25 million in civil penalties, adopt reasonable information security practices, and not process payments without obtaining proper authorization. Although not part of the Attorney General’s settlement, there is a separate class action settlement regarding this matter and Californians affected by ACI’s testing error may wish to submit claim forms in connection with that settlement. Claim forms must be submitted by November 13, 2023. More information is available at https://achloanpaymentlitigation.com/.

A copy of the complaint and judgment, which details the aforementioned settlement terms, can be found here and here.