Hess, Bridget v. Affirm, Inc., Case No. 3:26-cv-00203

Primary Source: Complaint — Hess v. Affirm, Inc., Case No. 3:26-cv-00203 (W.D. Wis.) (PDF)

Facts as Alleged in the Complaint

The following facts are taken directly from the complaint filed by the plaintiff. These are allegations that have not yet been proven in court. The defendant is presumed innocent until proven otherwise.

1. This is an action to recover damages for violations of the Fair Credit Reporting Act, 15 U.S.C. §§ 1681, et seq. (the “FCRA”).
2. This Court has jurisdiction of this action under 28 U.S.C. § 1331.
3. Venue is proper in this District under 28 U.S.C. § 1391(b).
4. Plaintiff Bridget Marie Hess (“Plaintiff”) is a “consumer” as that term is defined in 15 U.S.C. § 1681a(c), and resides in Baraboo, Wisconsin.
5. Defendant Affirm, Inc. (“Affirm”) is a “furnisher” as defined in 12 CFR 1022.41 and maintains its principal place of business at 650 California Street, 12th Floor, San Francisco, CA 94108.
6. Defendant Citibank, N.A. (“Citibank”) is a financial institution and “furnisher” as defined in 12 CFR 1022.41 and maintains its principal place of business at 5800 S. Corporate Pl. Sioux Falls, SD 57108.
7. In 2023, Plaintiff’s personal identifying information was compromised as a result of a data breach at the Saint Clare Hospital and Clinic in Baraboo, Wisconsin.
8. At some point, a fraudster used Plaintiff’s personal identifying information to apply for credit and open accounts in Plaintiff’s name without her knowledge or authorization.
9. Plaintiff learned about the fraudulent activity on her credit file in or about November of 2024 when she received a call from her bank suggesting there appeared to be fraudulent activity on her credit file.
10. Concerned, Plaintiff immediately requested copies of her consumer reports and discovered information and accounts that she did not recognize and had not opened.
11. Specifically, there were four (4) accounts (the “Fraudulent Accounts”) published in consumer reports about Plaintiff that did not belong to Plaintiff. Three Affirm accounts and one Citibank account:

    Fraudulent Accounts:
    • Affirm Inc. (Partial Account #: F1C3) — reported by Experian
    • Affirm Inc. (Partial Account #: RYT4) — reported by Experian
    • Affirm Inc. (Partial Account #: XP0N) — reported by Experian
    • Citicards/Citibank (Partial Account #: 542418161895) — reported by Experian and TransUnion

12. Based on the false reporting, Plaintiff realized that she had become a victim of identity theft from the data breach at the Saint Clare Hospital and Clinic.
13. Plaintiff was extremely concerned that her information was jeopardized and contacted the national credit bureaus to place a security alert on her credit reports.
14. Throughout this process, Plaintiff also filed identity theft reports with local and federal law enforcement agencies.
15. Specifically, on December 12, 2024 Plaintiff filed a police report with the Sauk County Sheriff’s Office regarding the theft of her identity (Case SC24-13594).
16. Around the same time, she also filed an initial Federal Trade Commission (“FTC”) Affidavit which is no longer accessible to Plaintiff.
17. On August 1, 2025, Plaintiff filed another Identity Theft Report through the Federal Trade Commission.
18. In a letter dated August 04, 2025, Plaintiff disputed the fraudulent Affirm accounts, with non-party Experian Information Solutions, Inc. (“Experian”).
19. Specifically, Plaintiff disputed that the Fraudulent Accounts were not hers, but rather, the product of fraud and identity theft.
20. Plaintiff provided copies of her driver’s license, social security card, and the Identity Theft Report submitted to the FTC.
21. Plaintiff requested that the identity theft information be blocked from her credit file immediately.
22. In or about August 2025, Defendant Experian received Plaintiff’s dispute and her request that identity theft information be blocked from her credit file.
23. Experian notified Defendant Affirm of Plaintiff’s dispute as required by federal law.
24. Experian sent Defendant Affirm an automated credit dispute verification (“ACDV”) related to each disputed account pursuant to Plaintiff’s August 2025 dispute to Experian.
25. Defendant Affirm received Experian’s ACDVs in or about August 2025.
26. Defendant Affirm violated 15 U.S.C. § 1681s-2b by failing to conduct a reasonable investigation with respect to the disputed information, failing to review all relevant information available to it, and failing to modify, delete, or permanently block the disputed information that was inaccurate, incomplete or unverifiable.
27. Defendant Affirm knew that Plaintiff had reported to Experian that her identity had been stolen.
28. Defendant Affirm’s ACDV responses show that the address associated with the disputed accounts was entirely different from the address provided to Affirm by Experian.
29. Affirm was aware that the addresses were widely different.
30. Plaintiff did not live, nor had she ever lived, at the address associated with the Affirm accounts.
31. The address associated with the disputed accounts was in a different state (California) and all the way across the country from Plaintiff’s residence in Wisconsin.
32. Affirm’s ACDV responses also show that the name on the disputed accounts did not perfectly match the name provided to Affirm by Experian.
33. Nevertheless, and despite these glaring differences, Defendant Affirm verified the disputed accounts as accurate to Experian.
34. On September 8, 2025, Experian sent the dispute results to Plaintiff, stating that if Plaintiff believes the three Affirm accounts were opened as a result of identity theft, Affirm requests that Plaintiff contact them directly. It also stated that Affirm had certified the disputed information as accurate.
35. After contacting Affirm directly, by phone and by mail, the only steps taken by Defendant Affirm were to confirm Plaintiff’s email address.
36. Defendant Affirm failed to notify Experian that the Fraudulent Accounts disputed by Plaintiff did not belong to Plaintiff.
37. Defendant Affirm failed to adequately review all of the information provided to it by Plaintiff in connection with the dispute.
38. Affirm also failed to review other relevant information it already had on file.
39. As of September 22, 2025, the fraudulent Affirm accounts were still being reported on Plaintiff’s Experian credit report.
40. In or about December 2024, Plaintiff disputed the fraudulent Citibank account with Experian.
41. In or about January 2025, Defendant Experian received Plaintiff’s dispute.
42. In January 2025, Experian sent Defendant Citibank an ACDV pursuant to Plaintiff’s dispute to Experian.
43. Defendant Citibank received Experian’s ACDV and did not adequately investigate Plaintiff’s dispute.
44. Defendant Citibank violated 15 U.S.C. § 1681s-2b by failing to conduct a reasonable investigation with respect to the disputed information, failing to review all relevant information available to it, and failing to modify, delete, or permanently block the disputed information that was inaccurate, incomplete or unverifiable.
45. Defendant Citibank knew that Plaintiff reported to Experian that her identity was stolen.
46. Defendant Citibank’s ACDV response shows that the address associated with the disputed account was entirely different than Plaintiff’s address which Defendant had on file and was flagged as such.
47. The address associated with the disputed account was in a different state (California) and all the way across the country from Plaintiff’s residence in Wisconsin.
48. Citibank’s ACDV response also show that the name on the disputed accounts did not perfectly match the name provided to Affirm by Experian.
49. Nevertheless, and despite these glaring differences and the information provided to Defendant, Defendant verified the disputed account as accurate to Experian.
50. On January 23, 2025, Experian sent the dispute results to Plaintiff, stating that if Plaintiff believes the Citibank account was opened as a result of identity theft, Citibank requests that Plaintiff contact them directly. It also stated that Citibank had certified the disputed information as accurate.
51. Citibank also sent Plaintiff a letter confirming receipt of the dispute but stated that they did not have sufficient information to investigate the dispute because they “cannot determine the exact information” being disputed.
52. Defendant Citibank verified the account as accurate.
53. Defendant Citibank failed to adequately review all of the information provided to it by Plaintiff in connection with the dispute.
54. Citibank also failed to review other relevant information it already had on file.
55. As of May 30, 2025, the fraudulent Citibank account was still being reported on Plaintiff’s Experian credit report. It was subsequently removed.
56. In a letter dated August 04, 2025, Plaintiff disputed the fraudulent Citibank account with non-party Trans Union. (“Trans Union”).
57. Specifically, Plaintiff disputed that the Fraudulent Account was not hers, but rather, the product of fraud and identity theft.
58. Plaintiff provided sufficient information to identify her credit file and sufficient information to support her dispute.
59. Plaintiff requested that the identity theft information be blocked from her credit file immediately.
60. In or about August 2025, Trans Union received Plaintiff’s dispute letter. Along with Plaintiff’s dispute letter, Plaintiff provided Trans Union a copy of the Identity Theft Report submitted to the FTC.
61. Upon information and belief, Trans Union notified Defendant Citibank of Plaintiff’s dispute to Trans Union.
62. Upon information and belief, Defendant Citibank violated 15 U.S.C. § 1681s-2b by failing to conduct a reasonable investigation with respect to the disputed information, failing to review all relevant information available to it, and failing to modify, delete, or permanently block the disputed information that was inaccurate, incomplete or unverifiable.
63. On August 16, 2025, Trans Union sent Trans Union’s investigation results to Plaintiff and informed her that the Citibank account had been deleted from her credit report.
64. However, on August 27, 2025, Trans Union sent another letter to Plaintiff stating that the previously deleted Citibank account had now been verified and added back to her credit report.
65. Upon information and belief, Defendant Citibank received Trans Union’s ACDV and did not conduct a reasonable investigation of Plaintiff’s dispute.
66. Upon information and belief, Defendant Citibank instructed Trans Union that the account was verified as accurate and to reinstate the Citibank account, which Trans Union did.
67. Therefore, Defendant Citibank failed to notify Trans Union that the disputed account did not belong to Plaintiff.
68. Upon information and belief, Defendant Citibank failed to adequately review all of the information provided to it by Plaintiff in connection with the dispute.
69. Citibank also failed to review other relevant information it already had on file.
70. As of September 22, 2025, the fraudulent Citibank account was still being reported on Plaintiff’s Trans Union credit report.
71. Due to Defendants’ ardent refusal to comply with their statutory obligations, Plaintiff was forced to take the time and expense of filing repeated disputes, going so far as to obtain legal advice and counsel.
72. Defendants’ conduct disrupted Plaintiff’s life. Dealing with the consequences of Defendants’ conduct has taken Plaintiff away from tending to her daily responsibilities and from time spent with friends and family. This has taken a toll on Plaintiff.
73. The harm caused by the continued reporting of the fraudulent accounts includes severe emotional distress, loss of credit opportunities, out-of-pocket financial losses, significant time, money, labor, and effort spent trying to resolve the issues, and an ongoing sense of vulnerability of her financial identity. Plaintiff has also developed a lack of trust in others as a result of these issues — including trust in those closest to her. Additionally, Plaintiff has developed a fear of others wanting to do her financial harm. Plaintiff also feels a significant lack of privacy resulting from the seemingly never ending stream of disclosing her social security number on forms and phone calls in an attempt to better her situation. This situation has greatly affected her emotional well-being, financial stability, and overall quality of life.
74. Plaintiff sought medical attention to cope with the emotional distress and was prescribed medication.
75. Further, the Fraudulent Accounts have negatively impacted and depressed Plaintiff’s credit score by over 200 points.
76. In or about August 2025, Plaintiff applied for and was denied a personal loan from Summit Credit Union. This denial was for funds sought for Plaintiff’s daily necessities throughout the winter months. This denial was caused by Defendants’ inaccurate reporting.
77. Plaintiff is increasingly reluctant to apply for new credit and fears further fraudulent activity or additional harm to her credit.
78. At all times pertinent hereto, Defendants were acting by and through their agents, servants, and/or employees who were acting within the course and scope of their agency or employment, and under the direct supervision and control of the Defendants herein.
79. At all times pertinent hereto, the conduct of Defendants, as well as that of their representative agents, servants, and/or employees, was intentional, willful, reckless, grossly negligent and in utter disregard for federal law and the rights of Plaintiff herein.
80. Defendants have had years of notice in the form of federal lawsuits like this one, but despite it all, Defendants have not taken any better steps to protect the Plaintiff here.
81. Defendants are aware of the shortcomings of their procedures and intentionally choose not to comply with the FCRA to lower their costs. Accordingly, the Defendants’ violations of the FCRA are willful.
82. As a result of the Defendants’ conduct, action, and inaction, Plaintiff suffered damage by loss of ability to benefit from her credit rating; measurable detriment to her credit rating; reduced overall creditworthiness; and the expenditure of time, money, labor, and effort disputing and trying to remove fraudulent accounts and information that were the product of identity theft.
83. Additionally, Plaintiff suffers from increased difficulty conducting daily activities, as well as emotional distress, including, without limitation, emotional and mental anguish and pain, sleep loss, reputational damage, humiliation, stress, anger, frustration, shock, violation of Plaintiff’s right to privacy, fear, worry, anxiety, and embarrassment associated with being a victim of identity theft whose honesty is doubted and questioned and disbelieved by the Defendants.

Claims for Relief

Count I — 15 U.S.C. § 1681s-2b: Failure to Conduct an Investigation of the Disputed Information and Review of all Relevant Information Provided by the Consumer (Against All Defendants)

84. Plaintiff incorporates by reference all the above paragraphs of this Complaint as though fully set forth herein at length.
85. Defendants Affirm and Citibank caused the Fraudulent Accounts to be added to Plaintiff’s Experian and TransUnion credit reports.
86. Defendants received notice of Plaintiff’s disputes from Experian and Trans Union pursuant to 15 U.S.C. § 1681i(a)(2).
87. The receipt of such notice triggered Defendants’ statutory obligation to investigate and delete the Fraudulent Accounts from Plaintiff’s credit reports.
88. Defendants Affirm and Citibank violated 15 U.S.C. § 1681s-2(b) by failing to investigate Plaintiff’s dispute(s), or otherwise by failing to fully and properly investigate Plaintiff’s dispute(s), including but not limited to failing to review all relevant information; by failing to permanently and lawfully correct their own internal records to prevent the re-reporting of the inaccurate information relating to Plaintiff to the national credit bureaus, and by failing to cease furnishing inaccurate information relating to Plaintiff to the national credit bureaus.
89. As a result of Defendants’ conduct, action, and inaction, Plaintiff suffered damage by loss of ability to purchase and benefit from her good credit rating; detriment to her credit rating; reduced overall creditworthiness; the expenditure of time, money, labor and effort disputing and trying to remove the Fraudulent Accounts.
90. Defendants’ conduct, actions, and inactions were willful, or at least negligent, rendering them liable for actual damages, statutory damages, punitive damages and attorneys’ fees and costs, in an amount to be determined by the Court pursuant to 15 U.S.C. §§ 1681n and 1681o.

Remedies Sought

• Actual damages
• Statutory damages
• Punitive damages
• Reasonable attorneys’ fees and costs
• Such other and further relief as the Court may deem appropriate and proper

Plaintiff demands a jury trial on all issues so triable.

Frequently Asked Questions

What is the Fair Credit Reporting Act (FCRA)?

The Fair Credit Reporting Act, 15 U.S.C. §§ 1681 et seq., is a federal law that regulates how consumer credit information is collected, shared, and used. It gives consumers the right to dispute inaccurate information on their credit reports and requires furnishers of credit information to conduct reasonable investigations when disputes are reported.

What is an ACDV?

An ACDV, or Automated Credit Dispute Verification, is the electronic form that credit bureaus send to furnishers (such as banks and lenders) when a consumer disputes information on their credit report. The furnisher is required by law to investigate the dispute and respond with its findings.

What does 15 U.S.C. § 1681s-2(b) require?

Section 1681s-2(b) of the FCRA requires furnishers of credit information, upon receiving notice of a consumer dispute from a credit reporting agency, to conduct a reasonable investigation of the disputed information, review all relevant information provided by the credit bureau, and report the results back to the bureau. If the information is found to be inaccurate, the furnisher must modify, delete, or permanently block the reporting of that information.

What is a “furnisher” under the FCRA?

A furnisher is any entity that provides information about consumers to credit reporting agencies. This includes banks, credit card companies, lenders, and buy-now-pay-later services. Furnishers have legal obligations under the FCRA to report accurate information and to investigate consumer disputes.

What damages can a consumer recover for FCRA violations?

Under the FCRA, consumers can recover actual damages (such as emotional distress, lost credit opportunities, and out-of-pocket costs), statutory damages of $100 to $1,000 per violation for willful noncompliance under 15 U.S.C. § 1681n, punitive damages for willful violations, and reasonable attorneys’ fees and court costs. For negligent violations under 15 U.S.C. § 1681o, consumers can recover actual damages and attorneys’ fees.

What should consumers do if they are victims of identity theft?

Consumers who discover fraudulent accounts should file a police report with local law enforcement, submit an Identity Theft Report through the Federal Trade Commission at IdentityTheft.gov, place fraud alerts or credit freezes with all three credit bureaus (Experian, TransUnion, and Equifax), dispute all fraudulent accounts in writing with supporting documentation, and keep copies of all correspondence. Under the FCRA, credit bureaus and furnishers have specific obligations when notified of identity theft.

Source: Public court filing via CourtListener/RECAP. Case No. 3:26-cv-00203 (W.D. Wis.). Filed March 12, 2026.