Current status and historical findings
The CFPB issued its second Enova International consent order on November 15, 2023, following a 2019 action involving unauthorized debits and unhonored loan extensions. The 2023 matter concerned Enova’s online consumer lending, including CashNetUSA and NetCredit. The agency required a $15 million penalty and consumer redress. [1] The findings belong to that historical administrative record; they are not evidence that the same conduct is occurring today.
The CFPB terminated the 2023 order on September 2, 2025 and waived alleged noncompliance with it. The termination document describes fulfillment of certain obligations, including the penalty, retention of a redress consultant and steps involving additional redress and injunctive relief. [2] Its wording should not be expanded into a blanket certification of every business practice or portrayed as a reversal of the historical findings.
The data problem behind an unauthorized debit
The original order describes, among other failures, bank-account information from lead generators overwriting information associated with existing loans, with resulting debits lacking the necessary authorization. It also addresses payment-authorization copies and failures to implement promised loan extensions. Enova consented without admitting or denying the findings except as specified for jurisdiction. [3]
Analysis: a routing and account number identifies where money may be moved. It does not establish who permitted a debit, for which obligation, on what terms or for how long. When systems collapse those questions into one customer-profile field, a valid account update for one purpose can incorrectly change another product’s payment instructions.
A permission model should therefore distinguish identity, account ownership, payment instrument, authorization scope and scheduled transaction. Those objects are related, but they are not interchangeable. A fresh application, marketing lead or verification response should not automatically become authority to alter a preexisting loan’s repayment source.
Regulation E §1005.10 separately addresses authorization of preauthorized electronic transfers, including the writing or similarly authenticated requirement and provision of a copy to the consumer. [4] The applicable permission must be assessed for the particular transfer arrangement, not inferred merely from possession of bank-account information.
A hypothetical permission migration
Assume a customer authorizes monthly debits from Account A for Loan 1. Months later, an application for Loan 2 contains Account B. An integration replaces the customer’s global account field with B, and the next Loan 1 debit uses B. Even if both accounts belong to the same person, that fact alone does not establish permission for the changed debit.
The recommended design stores a versioned authorization tied to Loan 1 and Account A. A proposed change generates a separate workflow with the required authorization evidence, effective date and consumer copy. The payment scheduler reads the applicable authorization version, not merely the newest account value in the customer master. This example is a proposed control pattern, not a representation of Enova’s current system.
Account verification and debit authorization should have separate tests. A microdeposit, account-ownership check or successful prior payment may help confirm a connection to an account, but the legal permission question still needs its own evidence. Conversely, a valid authorization does not guarantee sufficient funds or eliminate the need to process revocation and stop-payment information correctly.
A promised extension must reach every downstream process
The case also illustrates the gap between a service promise and executable servicing changes. [3] A customer can receive confirmation of an extension while a debit scheduler, delinquency engine or collection queue continues using the old due date. Measuring completed agent interactions would miss this failure because the interaction itself appears successful.
Recommended controls treat an extension as a coordinated state change. The servicing ledger, payment schedule, fee calculation, collection eligibility and any relevant reporting process should receive the approved terms. Reconcile exceptions where one subsystem acknowledges the change and another does not. Provide a clear recovery path rather than leaving the customer to discover the error when funds leave the account.
For a hypothetical test, move a $200 payment from the tenth to the twenty-fourth of a month. Verify the next debit file, customer confirmation, delinquency aging and fee treatment before and after both dates. Then reverse the test with a failed update and confirm that the exception is detected before collection activity proceeds. These are functional outcomes, not tests that merely check whether a database flag was written.
Redress requires the right denominator
An institution reviewing unauthorized payments should identify all potentially affected transactions, not just complaints already received. Reconstruct the population using authorization versions, account changes, debit files, returns and service records. Preserve the inclusion and exclusion logic so an independent reviewer can reproduce it. Missing logs create uncertainty that must be addressed explicitly rather than interpreted as proof of no harm.
Separate principal returned, fees reversed, interest adjustments and additional compensation where applicable. A refund issued is not necessarily a refund received. Returned checks, closed accounts and unsuccessful electronic credits require follow-up. These recommendations follow from the operational problem; they do not add obligations to the now-terminated order.
Costs, tradeoffs and residual risk
More granular authorization records increase storage, integration and review costs. They may slow account changes that previously happened automatically. The benefit is a defensible connection between a consumer’s instruction and the money movement executed in response. A faster payment process can be economically worse if it creates return fees, disputes and repeated servicing work.
Useful evidence for a revised assessment would include independent testing of authorization lineage, extension execution, revocation handling and redress completeness. A new public order or judicial decision could alter the legal picture. As of this review, the verified status is termination of the 2023 CFPB order; the continuing relevance is the control lesson that consent must survive data migration, product changes and servicing handoffs.
Sources
- CFPB, Enova 2023 enforcement action and status; November 15, 2023, updated September 2, 2025Official sourceBack to text: ↑
- CFPB, order terminating Enova consent order, filed September 2, 2025Official source · PDFBack to text: ↑
- CFPB, Enova consent order 2023-CFPB-0014, November 15, 2023Official source · PDFBack to text: ↑1↑2
- CFPB, Regulation E §1005.10, preauthorized transfers; reviewed September 27, 2026Official textBack to text: ↑