The financial institution fraud exemption has been on the books now since 2015.

It permits financial entities to send fraud notifications to cell phones without consent under certain limited circumstances.

For the interested, in order to take advantage of the exemption the caller must assure the following:

• Voice calls and text messages must be sent only to the wireless telephone number provided by the customer of the financial institution;
• Voice calls and text messages must state the name and contact information of the financial institution (for voice calls, these disclosures must be made at the beginning of the call);
• Voice calls and text messages are strictly limited to transactions and events that suggest a risk of fraud or identity theft or possible breaches of the security of customers’ personal information;
• Voice calls and text messages must not include any telemarketing, cross-marketing, solicitation, debt collection, or advertising content;
• Voice calls and text messages must be concise, generally one minute or less in length for voice calls (unless more time is needed to obtain customer responses or answer customer questions) or 160 characters or less in length for text messages;
• A financial institution may initiate no more than three messages (whether by voice call or text message) per event over a three-day period for an affected account;
• A financial institution must offer recipients within each message an easy means to opt out of future such messages; voice calls that could be answered by a live person must include an automated, interactive voice- and/or key press-activated opt out mechanism that enables the call recipient to make an opt-out request prior to terminating the call; voice calls that could be answered by an answering machine or voice mail service must include a toll-free number that the consumer can call to opt out of future calls; text messages must inform recipients of the ability to opt out by replying “STOP,” which will be the exclusive means by which consumers may opt out of such messages; and
• A financial institution must honor opt-out requests immediately. 47 C.F.R. § 64.1200(a)(9)(iii)

Cool.

So in Brooks v. Lone Star Credit Union 2025 WL 1654697 (M.D. Fl. June 11, 2025) the court issued a rare ruling testing the scope of this exemption.

In Brooks the Plaintiff received a prerecorded voicemail that stated:

This is the fraud detection department for Lonestar credit union calling for Rena Sharzer[ ]. We need to verify some recent activity on your card ending…7 0 8 0[.] In order to prevent possible difficulties using your card it is important that you call us back at your earliest convenience toll-free at [phone number]. Verify this activity[.] Please reference case number 3 5 7 8 1[.] [R]eturning our call give me a call us back [24] hours a day seven days a week.

Plaintiff argued the call was made without consent and that she did not know anyone named Reza Sharzer. In other words, this is a wrong number prerecorded call case– the most dangerous TCPA class action flavor.

Lone Star responded arguing that the message was completely legal and exempted under the fraud exemption rules and moved to dismiss on that basis.

The Court DENIED the motion, but found most the factor weighed in favor of the credit union. However the court determined whether or not plaintiff was charged for the call and whether the LSCU offered an automatic opt out feature were facts that were not alleged in the complaint. Therefore the case could not be dismissed.

Recognizing the limited issues at stake, however, the court issued limited and bifurcated discovery on these two factual issues. The Court also required a more definite statement of the case to assure the factual allegations related to any other phone calls at issue were spelled out.

Really interesting case here. Very few decisions address the fraud exemption and, to my knowledge, this is the first one to do so at the pleadings stage.

The limited discovery is a good news bad news situation for the credit union in my view. The Court has essentially front-loaded the ESSENTIAL substantive issue– did the CU properly deploy its fraud messages? If so the case is gone. But if not this case seems destined to class certification given the similarities among class member experiences.

So very high stakes.