A data breach doesn't automatically entitle you to a refund. For U.S. consumers, money may be available through a court-approved settlement, a bank or card dispute, an insurance policy, or a separate legal claim. Each route has its own eligibility rules, evidence requirements, and deadlines.
Start with the document that controls the specific remedy: the settlement notice, account agreement, payment-network rules, insurance policy, or applicable state law. A payout chart from another breach or an old social media post doesn't prove that you qualify.
What a data breach refund may include
| Possible recovery | What usually has to be true | What you may receive |
|---|---|---|
| Settlement payment | You meet the class definition and submit a valid claim on time | A fixed payment, a pro rata share, or reimbursement for approved losses |
| Bank or card reimbursement | An unauthorized transaction occurred and you reported it through the correct payment channel | A credit or reversal, subject to the applicable rules and investigation |
| Identity-theft expense reimbursement | The settlement or policy covers the expense and you can document it | Reimbursement for eligible monitoring, restoration, or related costs |
| Credit monitoring or reports | You meet the program's eligibility requirements | A service or credit-report benefit rather than cash |
| Individual privacy or injury claim | Your facts and state law support a separate claim | Damages determined through negotiation or litigation, not an automatic payment |
If your information was exposed but you have no unauthorized transaction, documented expense, or qualifying settlement, the only available benefit may be credit monitoring, identity restoration, or additional credit reports.
Check whether you qualify
Find the breach notification sent by the company, employer, bank, or government agency. Save the complete letter or email, including the case name, claim number, affected information, and filing deadline.
Then verify:
- The covered group: The settlement may apply only to certain customers, employees, account holders, or residents.
- The covered period: Your account or relationship may need to have existed during specific dates.
- The information involved: Coverage may depend on whether Social Security numbers, account credentials, or another defined type of data was exposed.
- The deadline: An otherwise valid claim may be rejected if it arrives late.
- The proof requirement: A standard payment may require an eligibility statement, while reimbursement for losses may require statements, receipts, or other records.
- The release and opt-out terms: Filing a settlement claim can affect related legal claims. Read the notice before deciding whether to file, object, or opt out.
Use the claim website identified in an official notice, court record, regulator page, or company announcement. A third-party breach scanner can alert you to a possible exposure, but it doesn't establish settlement eligibility.
Don't pay anyone to file a routine claim unless you have independently decided to hire professional help. Requests for gift cards, cryptocurrency, passwords, or one-time login codes are warning signs. Verify the settlement administrator through an official source before disclosing personal information.
Gather evidence before filing
Create one folder for the incident and keep copies of:
- The breach notice and follow-up messages
- Your claim number and submission confirmation
- Statements showing unauthorized transactions
- Credit reports showing unfamiliar accounts or inquiries
- Fraud alerts, account-closure letters, and bank correspondence
- An FTC identity theft report or police report, if you made one
- Receipts for monitoring, credit repair, replacement documents, postage, or other claimed expenses
- A dated log of calls, messages, missed work, and time spent responding to the incident
Submit only what the claim form requests. Redact unrelated account details and other sensitive information. Don't mail original records unless the administrator specifically requires them.
How to file a settlement claim
1. Read the official notice
Identify the class definition, available benefits, exclusions, proof rules, payment options, and final filing date. Some notices offer a basic payment without proof of loss and a separate reimbursement option for documented expenses.
2. Choose the benefit that matches your records
A claim may still be worthwhile without direct financial loss if the settlement offers a standard cash benefit, monitoring, or credit reports. Don't claim expenses you can't support. False or inconsistent information can cause a denial.
3. Use the verified filing channel
Enter names, dates, and claim numbers carefully. Save the confirmation page or email. If filing by mail or phone is allowed, use the address or number in the official notice rather than contact information from an advertisement.
4. Monitor the claim
Keep your claim number and watch for requests for more information. Court approval, appeals, processing delays, and the number of approved claims can affect both payment timing and the final amount. A stated maximum isn't a promise that every claimant will receive that amount.
5. Answer a deficiency or denial
Read the explanation and response deadline. If proof is missing, provide the requested records in the format the administrator accepts. Ask for the review or appeal procedure in writing, and retain evidence showing when you responded.
A settlement claim is separate from a bank fraud claim. A settlement administrator's decision doesn't automatically determine your rights against a bank, card issuer, or payment service.
If money was stolen, contact the financial provider now
Don't wait for a settlement if an unauthorized transaction has already occurred. Contact the fraud department of the bank, card issuer, or payment service as soon as possible.
The correct process depends on how the money moved:
- Credit card: Ask the issuer how to dispute each unauthorized charge and whether it needs written documentation.
- Debit card or electronic bank transfer: Notify the bank promptly and request its error-resolution procedure.
- Peer-to-peer payment, wire, or remittance: Contact the provider immediately and request a recall or fraud review. Recovery may be limited after a transfer is completed.
- Purchase made through a compromised account: A dispute over a legitimate purchase may follow different rules from a claim that the transaction itself was unauthorized.
Record the date, representative's name, case number, and requested documents. Continue checking later statements for additional activity. The financial provider, not the breached company, determines whether reimbursement or a credit is available under the rules for that payment type.
The FTC's identity theft recovery guidance recommends contacting the companies where fraud occurred, asking them to close or freeze affected accounts, and reviewing your credit reports.
Protect your credit while a claim is pending
A credit freeze is free. According to the FTC's guidance on credit freezes and fraud alerts, you must contact Equifax, Experian, and TransUnion separately to freeze your files. A freeze remains in place until you ask the bureaus to remove it.
You may instead place a free one-year fraud alert by contacting one of the three bureaus. Review your credit reports for unfamiliar accounts, inquiries, and addresses.
A freeze or fraud alert can reduce the risk of further misuse, but neither one reverses an existing charge or produces a settlement payment. You should also change reused passwords, enable multi-factor authentication, and contact the affected company through its official support channel. Avoid links in unexpected breach emails.
Equifax settlement status in 2026
Equifax disclosed in 2017 that information connected to approximately 147 million people had been unlawfully accessed. The resulting settlement included up to $425 million to help affected consumers.
The FTC's Equifax Data Breach Settlement page lists January 22, 2024, as the claim deadline. The ordinary cash-claim period is therefore closed. Posts or advertisements suggesting that anyone can now submit a new Equifax cash claim aren't reliable.
An eligible consumer may still receive seven free Equifax credit reports per year through 2026 using the authorized AnnualCreditReport.com service. Follow the FTC settlement page's lookup instructions to confirm whether you were affected. This credit-report benefit doesn't reopen the expired cash-claim deadline.
Why payout tables can mislead you
Equifax, Capital One, Marriott, Yahoo, and AT&T involved different incidents and legal proceedings. They don't share a claim portal, payment formula, or deadline.
The amount paid in any settlement may depend on:
- The number of approved claims
- Whether payments are fixed or pro rata
- The type of information exposed
- The claimant's documented financial loss
- Court-approved fees, costs, and deductions
- Whether the claim was timely and complete
- The selected payment option
A maximum reimbursement figure for one case doesn't apply to another. Use the notice for your specific case and the court-approved administrator named in it. If the cash deadline has passed, check the official case page for any remaining monitoring, restoration, or credit-report benefits.
California and other state-law claims
State breach-notification laws generally govern when and how affected consumers must be notified. Receiving a notice doesn't by itself guarantee compensation.
California's CCPA gives consumers rights over certain personal information, but its private damages route is limited and doesn't cover every privacy violation or breach. The California Attorney General's CCPA guidance says that a consumer pursuing a qualifying claim must first provide written notice identifying the alleged violations and allow the business 30 days to respond and cure.
That notice procedure isn't a general refund application. Consumers outside California should check the law in their own state or seek advice from a licensed attorney. UK and EU data-protection remedies are separate and don't create a U.S.-wide payout schedule.
What to do when there is no settlement
A missing or closed settlement doesn't prevent you from taking other steps:
- Ask the company what information was exposed and whether it offers monitoring or identity-restoration services.
- Dispute unauthorized transactions with the relevant bank, card issuer, or payment provider.
- Place a credit freeze or fraud alert.
- Follow the FTC identity theft recovery process and save the resulting records.
- Review any identity-theft or cyber insurance policy for covered expenses.
- Consult a licensed attorney if you have substantial documented losses, serious identity theft, or a complicated deadline or opt-out decision.
Before hiring an attorney, ask how fees and costs will be calculated and how they could affect any recovery.
Taxes, timing, and avoidable errors
Settlement payments don't all receive the same tax treatment. Keep the settlement notice, payment record, and expense documentation. A qualified tax professional can address how a particular payment should be reported. Don't assume every settlement is tax-free or that every breach-related loss is deductible.
Common errors include:
- Waiting to report unauthorized transactions
- Missing the settlement deadline
- Claiming expenses without supporting records
- Using an unverified claim website
- Filing duplicate claims
- Confusing free monitoring with cash compensation
- Assuming a breach notice requires a bank to reimburse every loss
- Giving a caller a password, verification code, or full account credentials
Frequently asked questions
Does a breach notice automatically qualify me for money?
No. It may indicate that you are part of a potentially covered group, but payment still depends on the settlement terms, filing deadline, and proof requirements.
Can I file after the deadline?
Usually not through the ordinary claim process. Check the official case page for its current status and any remaining non-cash benefits. Don't trust anyone who offers to reopen a closed cash claim for a fee.
Is credit monitoring a refund?
No. Monitoring may alert you to new activity, but it doesn't reimburse unauthorized transactions or provide automatic compensation for exposed information.
Should I wait for a settlement before disputing fraud?
No. Contact the bank, card issuer, or payment provider immediately. The financial dispute and settlement processes have separate rules and deadlines.
Find your original breach notice now. Write down the administrator, official claim website, and deadline, then contact your financial provider promptly if you see unauthorized activity.