Affirm Sued Over Hidden Fees, Data Breach, and Investor Fraud

Affirm Holdings, Inc., the San Francisco-based buy now pay later company founded by Max Levchin, is fighting three separate class action lawsuits in federal courts across the United States. One case accuses Affirm of deceiving consumers with hidden fees and no dispute rights. A second case, now settled, arose from a 2024 data breach at Affirm’s banking partner Evolve Bank and Trust. A third case alleges Affirm and its executives misled investors about the company’s regulatory exposure and financial risks.

The data breach settlement of $3.78 million received final court approval on December 15, 2025, in the U.S. District Court for the Western District of Tennessee. The consumer protection case, Shepard v. Affirm Holdings, Inc., remains active in the Southern District of New York under Case No. 7:21-cv-05241. The securities fraud case, Kusnier v. Affirm Holdings, Inc., continues in the Northern District of California after surviving a 2024 dismissal attempt.

Affirm Lawsuit Timeline and Updates

December 2021 — CFPB Investigation Triggers Stock Crash

The Consumer Financial Protection Bureau orders Affirm and four BNPL competitors to provide data on debt accumulation, regulatory arbitrage, and consumer data harvesting practices. The announcement hits Affirm’s stock price immediately. Shares drop 10.6%, from $110.98 to $99.24 in a single session on December 16, 2021.

That inquiry plants the first regulatory flag over Affirm’s business model and becomes a central reference point in the securities fraud litigation that follows.

June 14, 2021 — Consumer Protection Lawsuit Filed

Lead plaintiff Judith Shepard files a class action against Affirm Holdings, Inc. in the U.S. District Court for the Southern District of New York, Case No. 7:21-cv-05241. Shepard says she relied on Affirm’s marketing to choose its BNPL payment plan over a traditional credit card. She claims the company’s promotional materials obscured real costs, she was charged fees she did not expect, and when she disputed a transaction with a merchant, Affirm provided no meaningful support.

The lawsuit seeks to represent all New York residents who used Affirm BNPL plans and experienced similar harms. It asserts violations of New York General Business Law prohibiting deceptive trade practices.

February 2022 — Securities Fraud Filed After Earnings Tweet

On February 10, 2022, Affirm published a tweet from its official account disclosing certain second-quarter 2022 earnings metrics. The tweet was premature and caused AFRM stock to spike approximately 10% before the company corrected the record. Investors allege the incident was part of a broader pattern of misleading communications about Affirm’s financial performance and regulatory standing.

On December 8, 2022, plaintiff Mark Kusnier files a putative class action in the U.S. District Court for the Northern District of California against Affirm, CEO Max Levchin, and CFO Michael Linford. The class period covers investors who purchased AFRM stock between February 12, 2021, and December 15, 2021.

May 2023 — First Amended Complaint Expands Securities Claims

Plaintiffs Kusnier and co-plaintiff Chris Meinsen file their first amended complaint. The expanded filing adds three categories of alleged misconduct: misleading statements about Affirm’s BNPL service facilitating excessive consumer debt including with for-profit educational institutions, misleading statements about specific regulatory actions, and misleading statements about Affirm’s vulnerability to interest rate changes.

The interest rate argument becomes the most legally durable. As rates rise sharply through 2022 and 2023, investors argue Affirm concealed how exposed its lending model actually was.

December 2023 — Court Dismisses First Amended Complaint

Judge Araceli Martinez-Olguin grants Affirm’s motion to dismiss the first amended complaint. The court finds the plaintiffs have not adequately alleged that Affirm’s executives acted with intentional deception. The dismissal comes with leave to amend, keeping the case alive.

January 2024 — Second Amended Complaint Filed

Plaintiffs file a second amended complaint on January 19, 2024, narrowing their claims to the interest rate vulnerability allegations. The tightened focus strips out the broader allegations that the court found insufficient, but the core argument remains: Affirm told investors its business model was resilient to interest rate changes when internal data showed otherwise. Affirm moves to dismiss this second complaint on February 2, 2024. The case remains active through 2025 and into 2026.

February to May 2024 — Evolve Bank Ransomware Attack Exposes Affirm Customer Data

The cybercriminal group LockBit executes a ransomware attack on Evolve Bank and Trust, a third-party banking partner that processes and stores data for multiple fintech companies including Affirm. The breach is confirmed by Evolve around June 25, 2024. Stolen data is released on the dark web.

The exposed information includes names, dates of birth, Social Security numbers, driver’s license numbers, bank account numbers, and contact information. Affirm customers are among those affected. Multiple fintech companies with Evolve partnerships are implicated, including Branch, EarnIn, Marqeta, Melio, Mercury, Yieldstreet, and Wise.

September 2024 — Data Breach Class Action Filed

Lead plaintiff Douglas Clemmerson, a Texas resident, files a class action in federal court against Affirm over the Evolve Bank breach. The complaint alleges Affirm was negligent in entrusting sensitive customer data to Evolve, a banking partner with inadequate security practices. It also alleges Affirm failed to provide timely notice of the breach, leaving affected customers “in the dark” about what data was taken and what risks they faced.

The case is consolidated into MDL proceedings in the U.S. District Court for the Western District of Tennessee, MDL No. 2:24-md-03127-SHL-cgc.

May 2024 — CFPB Issues Interpretive Rule on BNPL

The Consumer Financial Protection Bureau issues an interpretive rule clarifying that BNPL lenders must comply with the same consumer protection requirements as credit card companies under the Truth in Lending Act. The rule requires BNPL providers to offer dispute resolution rights, issue refunds for returned merchandise, and halt billing during active investigations. The rule strengthens the legal foundation for the Shepard consumer lawsuit still moving through the Southern District of New York.

August 2024 — Securities Case Dismissed, Then Revived

Judge Martinez-Olguin dismisses the Kusnier securities action again in August 2024, finding plaintiffs have still not sufficiently pleaded intent to deceive. The case is dismissed, but the court allows plaintiffs to seek reconsideration. Plaintiffs file a motion for leave to reconsider. As of early 2026, the securities case is listed as ongoing in the Stanford Securities Class Action Clearinghouse. No settlement exists.

October 30, 2025 — Data Breach Claim Deadline Passes

The deadline for filing claims in the Evolve Bank data breach settlement is October 30, 2025. Eligible class members who submitted by this date can receive up to $3,000 for documented identity theft losses, or a flat $20 payment without documentation. One year of credit monitoring valued at $110, with identity theft insurance up to $1,000,000, is also included for those who filed timely claims.

December 15, 2025 — Data Breach Settlement Receives Final Approval

The U.S. District Court for the Western District of Tennessee grants final approval to the $3.78 million Evolve Bank data breach settlement. Settlement payments are issued on March 30, 2026. The claim deadline has passed, but affected individuals can contact the settlement administrator at (833) 421-7300 about the possibility of late claims or appeals. The settlement website is www.evolvesettlement.com.

2026 — Consumer and Securities Cases Continue

Both the Shepard consumer protection case and the Kusnier securities fraud case remain active in federal court as of 2026. Discovery in the Shepard case has advanced, and Affirm has filed motions to compel arbitration for individual plaintiffs, a common defense tactic to fragment class actions. No settlement dates have been announced in either case.

What the Shepard Consumer Lawsuit Alleges

The consumer case targets how Affirm markets and structures its BNPL installment products. The lawsuit’s central claim is simple: Affirm tells consumers there are no hidden fees, then delivers something different in practice.

Here is how the complaint breaks it down. First, Affirm markets BNPL as a transparent, interest-free alternative to credit cards. For many users, that is not what they get. Some plans carry interest rates not clearly disclosed at checkout. Others carry penalties for missed or failed automatic payments. The fees exist, but they are buried in terms presented too late in the checkout process to meaningfully affect the consumer’s decision.

Second, Affirm offers no real dispute mechanism. Credit card users can dispute a charge with their bank while the investigation proceeds. Affirm users cannot. If a consumer receives defective merchandise, returns it to the retailer, and expects their Affirm payment obligation to pause, they are wrong. The payments continue. The obligation runs to Affirm, not the merchant, and Affirm does not bear the risk of the merchant’s conduct.

Third, the complaint argues that the BNPL model is structurally designed to encourage purchases consumers could not otherwise afford, then traps them in payment schedules with no exit options. Shepard frames this as a violation of New York General Business Law prohibitions on deceptive and misleading trade practices.

What the Kusnier Securities Lawsuit Alleges

The securities case is narrower. After the second amended complaint, it focuses on one core allegation: Affirm’s executives made materially misleading statements about how rising interest rates would affect the company.

Affirm’s BNPL model depends on lending money at fixed or promotional rates and then selling those loan portfolios to investors. When interest rates rise, the cost of funding those loans increases. The spread between what Affirm earns on its loans and what it pays for capital compresses. Plaintiffs allege Affirm executives publicly described the company’s interest rate exposure as manageable when internal metrics showed a different picture.

The premature February 2022 earnings tweet is cited as evidence of careless or deliberate information management. Investors who bought AFRM stock between February 12, 2021, and December 15, 2021, and suffered losses when the stock corrected are the defined class. No settlement has been reached. The case is ongoing.

What Data Was Exposed in the Evolve Bank Breach

The Evolve Bank breach is a third-party vendor incident. Affirm did not suffer the breach directly. Affirm transferred and stored customer data with Evolve as part of their banking partnership. When LockBit ransomware actors attacked Evolve’s systems, that data was among the material exfiltrated and released.

The categories of exposed data include full names, Social Security numbers, dates of birth, driver’s license numbers, bank account numbers, and contact information. This is identity theft territory. Social Security numbers and bank account numbers together give bad actors enough to open fraudulent credit lines, drain accounts, or commit tax fraud in a victim’s name.

The complaint by lead plaintiff Douglas Clemmerson argues Affirm should have conducted better due diligence on Evolve’s security posture before transferring this volume of sensitive data. It also argues Affirm delayed notifying affected customers after learning of the breach, a violation of state data breach notification laws that require timely disclosure.

Who Qualifies for Each Case

The three cases cover different populations. You may qualify for one, two, or all three, depending on your history with Affirm and its stock.

What Compensation Is Possible

The data breach settlement is the only case with confirmed payouts. Eligible class members who filed by October 30, 2025, could receive up to $3,000 for documented identity theft losses, or a flat $20 without documentation. Credit monitoring and identity theft insurance were also included. Payments were issued on March 30, 2026.

The consumer and securities cases have no settlement amounts to report. If the Shepard case settles or goes to verdict, potential relief includes refunds for undisclosed fees, compensation for credit score damage, and statutory damages under New York law ranging from $50 to $1,000 per violation. If the Kusnier case produces a recovery, investors could see partial reimbursement for stock losses during the class period, typically 10 to 30 cents on the dollar in securities settlements of this type. Neither outcome is guaranteed.

Affirm’s Legal Defenses

Affirm has consistently denied wrongdoing across all three cases. In the consumer suit, Affirm filed motions to compel individual arbitration, arguing that users agreed to binding arbitration clauses when they accepted the company’s terms of service. If the court grants those motions, the class action framework collapses into thousands of individual arbitrations, each far more difficult and expensive for individual plaintiffs to pursue.

In the securities case, Affirm argued successfully twice that plaintiffs failed to plead the specific intent required for securities fraud. That is a high bar under the Private Securities Litigation Reform Act of 1995, which Congress passed specifically to limit strike suits by requiring plaintiffs to plead with particularity. The case surviving that standard twice is a sign the plaintiffs found a more defensible claim in the interest rate vulnerability allegations.

In the data breach case, Affirm’s position is that the breach occurred at Evolve Bank’s systems, not Affirm’s. The settlement resolves the case without Affirm admitting liability.

The Broader BNPL Regulatory Picture

What matters here is that these lawsuits do not exist in isolation. The CFPB’s December 2021 investigation, its May 2024 interpretive rule extending credit card protections to BNPL lenders, and the parallel lawsuits against Afterpay, Klarna, and Zip collectively signal a legal and regulatory environment that is catching up with an industry that grew extremely fast.

BNPL companies like Affirm were able to operate for years in a zone between credit cards (regulated under the Truth in Lending Act) and installment loans (regulated at the state level). The May 2024 CFPB rule collapses that zone. BNPL lenders must now provide billing statements, investigate disputed charges, and pause billing during dispute resolution, the same obligations that credit card issuers have carried for decades.

The Shepard case is a direct product of that regulatory gap. Consumers who used Affirm during the years before the CFPB rule had no enforceable right to dispute a charge or stop payments during a merchant dispute. The lawsuit argues those consumers were deceived into thinking they had rights they did not.

What This Lawsuit Teaches Consumers

The Affirm litigation exposes a structural problem that every BNPL user should understand. When you pay with a credit card, the card network and your issuing bank stand between you and the merchant. You can dispute a charge. You can initiate a chargeback. The system has checks built in. When you use BNPL, your payment obligation runs directly to the lender, and the lender does not care what happens with the merchant afterward.

Affirm markets itself as a more transparent alternative to credit cards. The lawsuits say the transparency claim does not survive contact with real consumer experiences: fees that appear only in fine print, no dispute rights, payments that continue after a return. That gap between the marketing and the lived experience is what three separate courts are now examining.

The data breach case adds a different layer. Consumers who hand over their Social Security numbers and bank details to a fintech company often have no idea how many third-party partners receive and store that data. Affirm did not expose your data; Evolve Bank did. But Affirm sent your data to Evolve. The liability question runs back through that chain.

The combined lesson is straightforward: read the terms before you use BNPL products, document everything about your purchases and payment plans, and do not assume you have dispute rights unless you verify them. The law is only now catching up to what BNPL companies have been doing for years.