Is the Bank of America settlement legit? How to tell

Is the Bank of America settlement real?

Yes. It's a real, court-supervised class action tied to the data security incident Bank of America announced in February 2025, in which names, Social Security numbers and addresses were exposed. The total settlement fund is $425 million, administered by Kroll Settlement Administration, with a claims deadline of November 20, 2026 and a final approval hearing set for December 17, 2026.

Three markers tell you any class action settlement is real: a court-appointed administrator, a public docket, and no fee to file. This one has all three. The case is In re: Bank of America Data Security Incident Litigation, MDL 3:25-md-03140, in the U.S. District Court for the Western District of North Carolina. You can pull up the current status on the Bank of America settlement page or browse everything else that's open in the Owed settlements directory. If you don't recognize any of those markers on a page claiming to be the settlement, treat it as suspect until you can verify them.

What the official notice looks like

If you're in the class, Bank of America or Kroll should have sent you a notice — usually a postcard, letter, or email — with a unique Claim ID and Confirmation Code. Those two codes are the fastest way to file: enter them on the administrator's site and most of the form is pre-filled from the class list, so you don't have to type your identity details in yourself.

A real notice reads plain and formal. It names the case, states the total settlement amount, tells you the claim deadline and the final approval hearing date, and lays out three options: file a claim, do nothing (and get nothing), or object or opt out by the earlier opt-out date of October 21, 2026. Real notices never ask for your full Social Security number by return email, never ask for your online banking password, and never demand a fee to "release" your payment.

If your notice is missing or lost, don't panic — you can request your Claim ID from Kroll by phone or through the contact form on the administrator's site.

How to find the real claim site

Scammers buy Google ads and copycat domains within days of any large settlement being announced. The safest path is to go through the administrator directly rather than clicking the first search result — a sponsored ad at the top of the page is not proof of legitimacy. Slow down for one minute before you type in a Claim ID or an address.

Follow these steps to reach the official claim form:

1. Start from a trusted source: the notice you received, the administrator's homepage (krollsettlements.com), ClassAction.org's settlements list, or the Owed settlement page.
2. Look at the domain. Real claim sites live on the administrator's own domain or a case-specific subdomain hosted by Kroll. Odd top-level domains like .info, .xyz, or misspellings of "Bank of America" are a bad sign.
3. Check for HTTPS and a valid certificate — but remember HTTPS alone doesn't prove legitimacy; scam sites use it too.
4. Confirm the claim form is free. If any step in the flow asks for a credit card or a "processing fee," close the tab.
5. Cross-check the case number, court, and administrator name against your notice or the Owed Bank of America settlement page before submitting.

Red flags that mean it's a scam

Copycat settlement sites tend to follow a small set of patterns. If you see any of the signals below, stop and verify through the administrator before you enter another keystroke. When in doubt, close the tab and reach the official site from a source you trust — your notice, the administrator, ClassAction.org, or Owed.

What the real settlement actually pays

"Legit" isn't just about the case being real — the payout numbers you see should also match the settlement agreement. Here's the actual structure: a $50 flat payment with no documentation, or reimbursement of documented out-of-pocket losses (fraud, credit-freeze fees, time spent responding to the breach) up to $600, plus two years of free credit monitoring. Anyone in the class can pick the flat payment; the documented-loss track is optional and requires receipts, statements, or a short sworn statement.

Anything promising you "$5,000 guaranteed" or "immediate wire transfer" is a scam. Real class action payouts are almost always sent months after the final approval hearing, which in this case is scheduled for December 17, 2026. Payments arrive by check, ACH, or a prepaid card issued by the administrator — not by gift card, cryptocurrency, or Zelle. For a full breakdown of the tiers, see our post on how much the Bank of America settlement pays, or check the expected timing in our payout date explainer.

How Owed verifies settlements before listing them

Every settlement listed on Owed goes through a short verification before it appears in the app. We start with the source: a filed court order, the administrator's own website, or the official notice of proposed settlement. If we can't tie a case to a real docket and a named administrator, it doesn't get listed. If it looks like a marketing landing page dressed up as a class action, it doesn't get listed.

From there we record the fund amount, the eligibility rules, the payout tiers, the claim deadline, and the opt-out and hearing dates directly from the primary documents — not from summary blogs. We link back to the administrator's claim page so you can file there yourself, and we never ask you for a Social Security number, a banking password, or a fee to submit. If a case gets delayed on appeal or the administrator changes, the listing gets updated.

Browse everything we've verified in the settlements directory, or jump straight to the Bank of America page if that's why you're here.

What to do if you already fell for a scam

If you already handed information to a copycat site, act quickly — the sooner you lock things down, the smaller the damage. This is general information, not legal advice; if real money moved or your identity was misused, talk to your bank and consider a consumer-protection attorney.

Start with a fraud alert or credit freeze at all three bureaus (Equifax, Experian, TransUnion). Freezes are free and stop most new-account fraud cold. Then report the incident at IdentityTheft.gov, the FTC's official recovery tool, which walks you through a step-by-step plan and generates the affidavits you'll need. If you gave out banking credentials, call the number on the back of your card immediately and ask for a card replacement plus a note on the account.

Then file the real claim. Being scammed by a fake site does not disqualify you from the actual settlement — you can still submit through Kroll before the November 20, 2026 deadline, and you should.

Glossary

Class action

A single lawsuit filed on behalf of many people who share the same claim against a defendant.

Settlement administrator

The third-party firm (here, Kroll) hired by the court to send notices, process claims, and pay class members.

Claim ID

A unique code printed on your notice that pre-fills your identity on the official claim form.

MDL

Multidistrict litigation — related federal cases consolidated in one court for pretrial matters.

Final approval hearing

The court hearing where a judge decides whether to approve the settlement as fair, reasonable, and adequate.

Credit freeze

A free lock you place at each credit bureau that blocks new accounts from being opened in your name.

FAQ