Consumer complaint received 2025-12-09 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Privacy issues
Company: Bilt Technologies, Inc.
State: NJ

Complaint narrative:
I am filing this complaint against Bilt Rewards for their refusal to compensate me for damages resulting from their third-party vendor 's ( XXXX XXXX XXXX XXXXXXXX ) data breach. Bilt chose XXXX as its banking partner, shared my personal data with XXXX, and when XXXX suffered a massive breach affecting XXXX XXXX people, Bilt refused to take responsibility. I have suffered {$3300.00} in documented damages due to Bilt 's failures. 

WHAT HAPPENED The Data Breach In XX/XX/XXXX, XXXX XXXX XXXX XXXX, Bilt 's banking services provider, suffered a ransomware attack by the XXXX XXXX XXXX. The breach compromised my : Social Security number Bank account information Full name and date of birth Contact information Financial transaction records I am a Bilt customer. I have no direct relationship with XXXX. Bilt chose to use XXXX as its backend banking infrastructure and shared my data with it without my knowledge or explicit consent. 
Timeline of Failures XX/XX/XXXX : Breach occurs at XXXX XXXX XXXX XXXXXXXX XX/XX/XXXX : Bilt sends me an email stating : My information " may have '' been compromised There was " no definitive proof '' of impact This was " out of an abundance of caution. '' I should take protective measures at my own expense Critically, Bilt OMITTED : That XXXX  would contact me directly with remediation offers That free credit monitoring would be available That a class action settlement would provide up to {$3000.00} in compensation That I should watch for communications from XXXX  XX/XX/XXXX : According to Bilt ( disclosed XX/XX/XXXX ), XXXX  allegedly began sending direct notifications offering 24 months of FREE credit monitoring through XXXX. 
I NEVER RECEIVED ANY NOTIFICATION FROM XXXX. Not by mail, email, phone, or any other method. 
XXXX XXXX : XXXX  class action settlement notice period. The settlement offered : Up to {$3000.00} for documented losses OR {$20.00} flat payment PLUS one year of credit monitoring I NEVER RECEIVED ANY SETTLEMENT NOTICE. Not by mail, email, or any method. 
XX/XX/XXXX : Settlement claim deadline passes without my knowledge. 
XX/XX/XXXX : I contact Bilt requesting reimbursement for credit monitoring costs ( {$350.00} ). 
XXXX XXXX XXXX : Bilt repeatedly tells me to " contact XXXX  directly '' despite : I am a Bilt customer, not an XXXX  customer I have no relationship with XXXX  Bilt chose XXXX  and shared my data with them XX/XX/XXXX : Bilt finally discloses ( 18 MONTHS LATE ) that : XXXX  offered 24 months of free credit monitoring The enrollment period has expired A settlement existed with an XX/XX/XXXX deadline I missed everything due to notification failure XX/XX/XXXX : Bilt Legal sends formal rejection stating : " Bilt is not liable for the incident at XXXX. '' " There is no legal basis for your request. '' " Contact XXXX directly. '' " We consider this matter closed. '' WHY THIS VIOLATES CONSUMER PROTECTION LAW 1. UNFAIR PRACTICES Under 12 U.S.C. 5531, the CFPB prohibits unfair practices. Bilt 's conduct is unjust because : A. Inadequate Vendor Oversight Bilt failed to : Properly vet XXXXXXXX XXXX cybersecurity before selecting them as a vendor Monitor XXXX XXXX ongoing security compliance Ensure XXXX can properly notify affected customers Verify that customers received remediation offers Take corrective action when notification systems fail Bilt admits it has " no visibility '' into XXXXXXXX XXXX notification processesthis confession reveals inadequate vendor oversight. 
B. Notification Failure Bilt 's XX/XX/XXXX, notification was inadequate because it : Downplayed severity ( " no definitive proof, '' " abundance of caution '' ) Omitted critical information about free remediation Omitted information about the settlement Failed to direct customers to watch for XXXX  communications Misled customers into believing they should pay for protection themselves C. 18-Month Delay in Disclosure Bilt waited 18 months to inform me that free remediation had been available. By then : Free monitoring enrollment had expired The settlement claim deadline had passed ( by 38 days ) I had lost all opportunity for the XXXX XXXXXXXX in benefits I was entitled to This delay was not inadvertentI contacted Bilt in XX/XX/XXXX, specifically asking about reimbursement, and they still deflected me to XXXX  rather than immediately disclosing the expired remediation. 
D. Deflection Creating Liability Gap Bilt 's position creates an unfair liability gap : Bilt says, " Contact XXXX, they're responsible. '' XXXX would say : " Contact Bilt, they're our customer. '' Consumer gets trapped in the middle with no remediation This is precisely the scenario consumer protection law is designed to prevent.

2. DECEPTIVE PRACTICES Bilt engaged in materially misleading conduct : A. Misleading Breach Notification A reasonable consumer reading Bilt 's XX/XX/XXXX notification would conclude : They probably weren't affected ( " no definitive proof '' ) No free remediation would be available They should take protective measures at their own cost This is materially misleading because free remediation WAS availableBilt didn't tell customers about it.

B. False Impression of No Liability Bilt 's repeated statements that they're " not liable '' and that customers should " contact XXXX directly '' create a false impression that Bilt bears no responsibility for vendor failures.

This contradicts established legal precedent where customer-facing companies are held liable for vendor breaches : XXXX  : {$18.00} XXXX settlement ( HVAC vendor breach ) XXXX  XXXX : {$190.00} XXXX settlement ( XXXX XXXX XXXX  ) XXXX  : {$350.00} XXXX settlement ( vendor vulnerability breaches ) XXXX XXXX : {$19.00} XXXX settlement ( vendor credential breach ) XXXX  : {$52.00} XXXX settlement ( subsidiary vendor breach ) XXXX  : {$380.00} XXXX settlement ( third-party software vulnerability ) C. Premature " Matter Closed '' Declaration Bilt declared " we consider this matter closed '' despite : Unresolved consumer harm ( {$3300.00} in damages ) Available administrative remedies ( this complaint ) Available judicial remedies No agreement from me to close the matter This creates a false impression that the

consumer has no recourse. 3. INADEQUATE DATA SECURITY Under the CFPB 's authority over data security practices, Bilt failed to : Maintain adequate vendor management procedures
Ensure vendors have appropriate cybersecurity safeguards Protect customer data shared with vendors Respond appropriately when a vendor breach occurs The Gramm-Leach-Bliley Act ( GLBA ) Safeguards Rule, 16 C.F.R. 314.4 ( d ), requires financial institutions to : " Oversee service providers, by : ( 1 ) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for customer information ; and ( 2 ) Requiring your service providers by contract to implement and maintain such safeguards. '' Bilt violated these requirements by : Selecting XXXX  ( which suffered an 18-million-person breach ) Failing to monitor XXXX XXXX  security adequately Having " no visibility '' into critical vendor processes Failing to ensure proper breach notification THE FINANCIAL HARM I SUFFERED Total Damages : {$3300.00} Breakdown : 1. Lost Settlement Opportunity : {$3000.00} The XXXX class action settlement ( XXXX XXXX. XXXX ) allowed claims up to {$3000.00} for documented losses. 
I would have claimed the maximum based on : Credit monitoring costs : XXXX XXXX 2 years = {$700.00} Time spent addressing breach : 20+ hours XXXX XXXXXXXX = XXXX XXXX  Identity theft protection services : XXXX XXXXXXXX Administrative costs for protective measures Lost productivity My documented losses easily exceeded {$3000.00}, making me eligible for the maximum settlement amount.

But for the notification failure, I would have filed a timely claim and received this compensation.

2. Credit Monitoring Costs : {$350.00} Because I never received the 24 months of free credit monitoring XXXX offered, I must purchase services independently at XXXX XXXXXXXX. 
This includes : Three-bureau credit monitoring Real-time fraud alerts Identity theft insurance ( XXXX XXXX coverage ) Dark web monitoring Credit score tracking Fraud resolution assistance This is a necessary expense because : My Social Security number was compromised My bank account information was exposed I face a permanent elevated risk of identity theft Industry standard is 1-2 years of monitoring post-breach 3. Ongoing Future Damages Beyond the {$3300.00} I'm claiming now : XXXX XXXXXXXX for continued monitoring ( indefinite ) Hundreds of hours over lifetime monitoring accounts Permanent privacy loss ( SSN can not be changed ) Lifetime elevated identity theft risk Psychological costs and stress I am limiting this complaint to concrete, immediately quantifiable damages ( {$3300.00} ) to facilitate a resolution. 

WHAT I'VE DONE TO RESOLVE THIS Timeline of My Attempts : XX/XX/XXXX : Sent a formal email to Bilt requesting {$350.00} reimbursement for credit monitoring. 
XX/XX/XXXX : Bilt customer service ( XXXX ) responds : " We recommend reaching out to the XXXXXXXX XXXX XXXX XXXXXXXX team directly. '' XX/XX/XXXX : I respond, explaining I am a Bilt customer, not an XXXX  customer, and that Bilt should take responsibility for vendor failures. 
XX/XX/XXXX : Bilt customer service responds, stating that XXXX offered free monitoring and that I should have received a notification. This is the FIRST TIME I learned remediation existed18 months after it was available. 
XX/XX/XXXX : I have not received any notification from XXXX and would appreciate an escalation request. 
XX/XX/XXXX : Bilt Legal sends a formal rejection stating : " Bilt is not liable for the incident at XXXX. '' " No legal basis for your request. '' " Contact XXXX directly. '' " We consider this matter closed. '' XX/XX/XXXX : I send a comprehensive legal response citing precedent cases and offering a settlement of {$3300.00} by XX/XX/XXXX. 
XX/XX/XXXX ( same day ) : Filing this CFPB complaint because Bilt refuses to take responsibility.

WHY BILT 'S POSITION IS WRONG " We're Not Liable for Our Vendor '' This argument has been rejected in every major data breach case : XXXX  tried to blame HVAC vendor Held liable, paid XXXX XXXX XXXX XXXX tried to blame XXXX  Held liable, paid XXXX XXXX XXXX XXXX XXXXXXXX regulatory penalties XXXX tried to blame vendors Held liable, paid XXXX XXXX XXXX XXXXXXXX tried to blame vendor credentials Held liable, paid XXXX XXXX XXXXXXXX tried to blame subsidiary vendors Held liable, paid XXXX XXXXXXXX XXXX  tried to blame third-party software Held liable, paid XXXX XXXXXXXX Total : Over {$1.00} XXXX in settlements proving customer-facing companies are liable for vendor breaches. 
" Contact XXXX  Directly '' This is impractical and unfair because : I have no relationship with XXXX  All remediation deadlines have already expired Bilt provided my contact information to XXXX  If the information was wrong, Bilt is responsible Creates an endless deflection loop between companies " No Visibility Into Vendor Processes '' This admission proves negligence, not a defense : Under GLBA and industry standards, companies must have visibility into vendor processes that affect customer data. Bilt 's admission that they have " no visibility '' into whether customers received notifications proves inadequate vendor oversight.

Company response to consumer: Closed with explanation