CFPB Reportedly Finds Hello Digit's Automated Savings Algorithm Caused Overdrafts and Orders Redress with $2.7M Penalty

Hello Digit's automated savings product allegedly transferred funds from users' checking accounts via a proprietary algorithm that reportedly caused overdrafts and bank fees despite a "no overdraft" guarantee. The Consumer Financial Protection Bureau (CFPB) reportedly also found the company denied many reimbursement requests and kept interest earned on customer funds. Hello Digit was ordered to provide redress and pay a $2.7M civil penalty.

Risk classification

• Primary risk domain: 7 AI system safety, failures, & limitations
• Primary risk subdomain: 7.3 Lack of capability or robustness

The incident was caused by a faulty algorithm that failed to perform reliably, leading to unintended overdrafts for users.

Causal factors

• Entity: AI
• Intent: Unintentional
• Timing: Post-deployment

The financial harm was caused by a faulty algorithm making incorrect automated transfer decisions after it was deployed to consumers.

EU AI Act risk tier

• Risk tier: 4 Minimal or No Risk

Minimal or No Risk: The system is a personal-finance-management app for automated savings, which does not fall under the high-risk categories defined in the Act.

AI system and alleged parties

• AI system: Hello Digit automated savings algorithm
• AI purpose: Financial Processing; Resource Allocation
• Behaviour type: Autonomous
• Alleged developer: Oportun Financial Corporation, Hello Digit
• Alleged deployer: Oportun Financial Corporation, Hello Digit
• Alleged harmed parties: Hello Digit customers, Consumers whose accrued interest was retained, Consumers denied overdraft reimbursement, Consumers charged overdraft fees due to auto-saves, Bank account holders enrolled in auto-saves

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Substantial, indirect Minor
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Financial

Reported: The report explicitly describes financial losses to consumers due to overdraft fees and pocketed interest, as well as a $2.7 million fine.

Directly caused: The faulty algorithm directly caused consumers to incur bank overdraft fees, resulting in nearly 70,000 reimbursement requests.

Indirectly caused: Consumers suffered indirect financial losses from Hello Digit pocketing interest on their savings and denying legitimate reimbursement requests.

Inferred additional harm: We infer that the total financial loss to consumers from overdraft fees and lost interest likely totals several million dollars, given the 70,000 reimbursement requests.

People affected

• Occurrences reported: 1
• People reportedly harmed: 70000
• People reportedly exposed: 70000

Potential causes

Management

• Prioritizing Profit Over Safety: Kept interest from consumer funds and ignored daily overdraft complaints.
• Deceptive Business Promises: Management falsely guaranteed no overdrafts and refused to reimburse users.

Technology

• Faulty Auto-Save Algorithm: The proprietary algorithm incorrectly calculated affordable transfer amounts.
• Inadequate Edge-Case Handling: Algorithm failed to prevent transfers that resulted in bank overdrafts.

Data Inputs

• Checking Account Data Volatility: Fluctuations in consumer checking data led to incorrect savings decisions.

Human Factors

• Overreliance on Automated Tool: Users trusted the 'never transfers more than you can afford' guarantee.

Process and Methods

• Flawed Reimbursement Process: The company denied valid customer requests for overdraft reimbursement.
• Inadequate Algorithmic Testing: Testing failed to identify scenarios where auto-saves caused overdrafts.

Regulatory Environment

• Deceptive Marketing Practices: Falsely guaranteed no overdrafts in violation of consumer protection laws.

Information quality

• Classification confidence: High
• Reason for confidence: The report is an official press release from the Consumer Financial Protection Bureau (CFPB), providing highly credible, clear, and specific details about the algorithm's failure, user complaints, and regulatory actions.
• Ambiguities identified: The exact technical flaw in the algorithm is not detailed, and the total dollar amount of overdraft fees incurred by users is not specified.
• Alternative interpretations: None, the facts of the algorithm's failure and the resulting regulatory action are clear and undisputed.

A consumer finance application's automated savings algorithm caused routine bank overdrafts for users, leading to a CFPB enforcement action and a $2.7 million penalty. The incident is strictly a consumer protection and regulatory compliance issue with negligible national security implications.

• Overall national security impact: Negligible
• Scope: Single nation
• Primary target: No clear primary
• Alleged perpetrator: Hello Digit, LLC

Threat characteristics

• Imminence: Long-term. The incident has been resolved through regulatory enforcement action by the CFPB and poses no ongoing national security threat.
• Autonomy: Full autonomy. The automated savings algorithm executed transfers independently without requiring manual user approval for each transaction.
• Novelty: Established threat. Algorithmic errors in financial technology and automated banking software are well-established issues with existing regulatory frameworks.

Impact by dimension

• Physical security: Negligible. The incident involves a consumer personal finance application and has no physical security or critical infrastructure implications.
• Information security: Negligible. No information warfare, intelligence compromise, or systematic information manipulation occurred in this consumer-focused incident.
• Sovereignty: Negligible. No impact on government functions, sovereign decision-making, or national borders. The incident is a domestic regulatory enforcement action.
• Economic security: Negligible. While consumers suffered financial losses from overdraft fees, the incident poses no threat to national economic stability, critical financial infrastructure, or strategic technology.
• Societal stability: Negligible. The algorithm's failure caused financial inconvenience to individuals but did not threaten social cohesion, civil liberties, or societal stability.