The TCPA Financial Institution Exemption for Fraud Alert Texts

Three messages per event over three days, per affected account. That’s the cap the FCC set for financial institutions sending fraud alerts, data breach notices, and money-transfer messages to cell phones without prior express consent. The cap is one of nine conditions, and the exemption covers only a message that meets all of them. A message that misses one isn’t automatically unlawful, and I think a company facing a fraud-alert claim often has more defenses than the demand letter admits.

What does the financial institution exemption actually allow?

It lets a financial institution make autodialed or prerecorded calls and texts to a cell phone number the customer provided, for four narrow purposes without first getting consent. An autodialer is equipment that can store or produce numbers using a random or sequential number generator and dial them. A prerecorded call plays a recorded or synthetic voice instead of a live person. Prior express consent is permission the person gave before the call, often by giving you the number.

The TCPA bars autodialed and prerecorded calls to cell phones unless the caller has that consent or the call is for emergency purposes, but Congress let the FCC carve out exceptions. Under 47 U.S.C. § 227(b)(2)(C), the FCC “may, by rule or order, exempt from the requirements of paragraph (1)(A)(iii) of this subsection calls to a telephone number assigned to a cellular telephone service that are not charged to the called party,” subject to conditions it sets to protect privacy.

The FCC used that power for financial institutions in its 2015 TCPA Declaratory Ruling and Order, FCC 15-72, released July 10, 2015, granting a petition from the American Bankers Association subject to conditions the FCC added. A December 2020 order, FCC 20-186, wrote the exemption into the rules effective March 29, 2021, according to its Federal Register notice. It now sits at 47 C.F.R. § 64.1200(a)(9)(iii), which limits exempt messages to “transactions and events that suggest a risk of fraud or identity theft; possible breaches of the security of customers’ personal information; steps consumers can take to prevent or remedy harm caused by data security breaches; and actions needed to arrange for receipt of pending money transfers.”

Who counts? The rule borrows the Gramm-Leach-Bliley definition in 15 U.S.C. § 6809(3)(A): “any institution the business of which is engaging in financial activities as described in section 1843(k) of title 12.” It generally doesn’t reach a retailer or a software company warning its own customers about its own breach. The FCC’s order describes the breach category as alerts about “data breaches at retailers and other businesses, which pose a security threat to the customer’s financial account information,” per FCC 15-72. So a card issuer can text about a merchant’s breach, but the merchant generally can’t use the exemption unless it is itself a financial institution.

Nine conditions, every message

The exemption works only when each message satisfies all of them. The first is in the lead-in to § 64.1200(a)(9), which applies “provided that the call is not charged to the called person or counted against the called person’s plan limits on minutes or texts.” The other eight are in paragraph (a)(9)(iii), unchanged since the 2021 codification.

The order says a customer with more than one affected account may receive “three calls per event per affected account per three-day period,” according to FCC 15-72 at footnote 458.

The opt-out can also be narrower than you’d assume. The FCC wrote that “financial institutions may tailor the opt-out notice so that a consumer is aware that a choice to opt out of future calls is specific to one of the four categories of financial calls we address,” in FCC 15-72. For texts, the rule makes STOP “the exclusive means by which consumers may opt out of such messages,” per § 64.1200(a)(9)(iii)(G). For program design going forward, I wouldn’t lean on either point, for reasons I explain below. In defending a message already sent, both are worth raising.

What happens if a fraud alert misses one condition?

It loses the exemption, and that’s all that happens automatically. The FCC said so directly about the frequency cap: “Any message beyond this limited number of three calls per event, over a three-day period, is not exempt and requires the consent of the called party,” in FCC 15-72. A non-exempt message is judged under the ordinary rule, which asks two questions.

First, did the person who received the message consent? Giving you the number to open or service an account is usually the starting point for consent to informational calls about that account. I covered how far that consent reaches in our post on the scope of TCPA consent.

Second, how was the message sent? For texts, I think the answer can decide the case. In Facebook, Inc. v. Duguid, the Supreme Court held that “a necessary feature of an autodialer under §227(a)(1)(A) is the capacity to use a random or sequential number generator to either store or produce phone numbers to be called.” The messages in Duguid were Facebook’s login-notification security texts, and the Court said the definition “excludes equipment like Facebook’s login notification system, which does not use such technology.” A platform that texts a stored list of customer numbers isn’t an autodialer under that test unless it has the capacity to use a random or sequential number generator, for example to pick or order numbers from the list.

Voice calls are different. A recorded or synthetic voice triggers the statute no matter what dialed the number, so an interactive voice fraud call is where the exemption does its real work. That’s the program I’d audit first.

Under 47 U.S.C. § 227(b)(3), a plaintiff may recover actual monetary loss or $500 for each violation, whichever is greater. If the court finds the violation willful or knowing, it may increase the award to up to three times that amount.

Can a fraud alert mention a product or a balance due?

Not if you want the exemption. The rule says exempt messages “must not include any telemarketing, cross-marketing, solicitation, debt collection, or advertising content,” under § 64.1200(a)(9)(iii)(D). The FCC drew the line this way in FCC 15-72: “Informing a consumer of an instance of identity theft or even measures he or she may take to address that instance of identity theft is distinct from marketing products.”

So a text that flags a suspicious charge and asks the customer to reply YES or NO stays inside the line. The same order lists subscribing to credit monitoring among the steps a remediation message can mention, but pitching a monitoring product, yours or a partner’s, is marketing. A fraud call that also mentions a past-due minimum payment invites the argument that it carries debt collection content, and I wouldn’t send one.

Marketing content costs more than the exemption. A call that “includes or introduces an advertisement or constitutes telemarketing” with an autodialer or prerecorded voice needs prior express written consent, a signed written agreement to receive marketing calls, under § 64.1200(a)(2). For a non-customer, such as a money-transfer recipient, a marketing line can also bring in the National Do Not Call Registry, the federal list of numbers whose owners have opted out of telemarketing. Its private claim belongs to someone who received “more than one telephone call within any 12-month period by or on behalf of the same entity in violation of the regulations prescribed under this subsection,” under § 227(c)(5), subject to an affirmative defense for a company that implemented reasonable practices and procedures, with due care, to prevent violations.

In my view, the cleanest programs keep fraud and breach templates in a locked library that marketing can’t edit. I think a well-meant edit to a template nobody thought of as regulated is one of the easier ways to lose the exemption.

How should STOP replies to alerts be handled now, and what changes in April?

Today, the exemption still requires immediate honoring of opt-outs and names STOP as the exclusive opt-out for exempt texts. The FCC adopted new consent-revocation rules in FCC 24-24 in February 2024. Its October 11, 2024 notice set April 11, 2025 as the effective date for the revocation rules in § 64.1200(a)(10) and (11).

The February 2024 order also addresses fraud alerts directly. It says that “If the revocation request is made directly in response to an exempted informational call or text, however, this constitutes an opt-out request from the consumer and all further non-emergency robocalls and robotexts must stop,” per FCC 24-24 at paragraph 30. That reads more broadly than the category-by-category opt-out the 2015 order allowed. The new rule text also says callers covered by the consent rules “may not designate an exclusive means to request revocation of consent,” according to the Federal Register version of the rules.

How those pieces fit together for a bank sending both consent-based and exempt messages isn’t settled. My advice is to build for the broader reading now. Treat any clear reply to a fraud alert, not only STOP, as an opt-out, and have the system suppress every non-emergency automated message to that number until the customer opts back in.

How do you defend a lawsuit over a fraud alert?

Pull the exact template and the send log for that number. If the content fits one of the four purposes and the count stayed at three or fewer, the exemption is in play. If not, the case comes down to consent and equipment.

Be ready to document each condition. In my view, the free-to-the-recipient condition is the hardest to document from your own systems. The American Bankers Association told the FCC that “financial institutions will work with wireless carriers and third-party service providers” to keep these messages free to recipients, as FCC 15-72 recounts. If your aggregator contract doesn’t confirm that arrangement in writing, get it now, before a plaintiff asks for it in discovery.

I’d give recycled numbers a hard look. In a footnote in Duguid, the Court relayed Facebook’s explanation that “it is possible that Duguid was assigned a recycled cell phone number that previously belonged to a Facebook user who opted to receive login notifications.” When a customer’s number passes to a stranger, a plaintiff will argue the new holder never consented. The exemption asks whether the number was “provided by the customer of the financial institution,” under § 64.1200(a)(9)(iii)(A), and I’d expect a plaintiff to argue that condition fails once the customer no longer holds the number. The rule’s text asks only whether the customer provided the number, and that’s the answer I’d give. For calls made with consent, § 64.1200(m) offers a safe harbor to a caller that, “bearing the burden of proof and persuasion,” shows it queried the reassigned numbers database, got a “no” answer, and placed the call because that answer was wrong.

Finally, I think the exemption’s legal footing is strong. It rests on an express grant of rulemaking power in § 227(b)(2)(C). The Supreme Court ended Chevron deference in Loper Bright Enterprises v. Raimondo on June 28, 2024, but it also said that “the statute’s meaning may well be that the agency is authorized to exercise a degree of discretion.” The Court has also agreed to hear McLaughlin Chiropractic Associates v. McKesson Corp., with argument set for January 21, 2025, per its docket. The question presented is “Whether the Hobbs Act required the district court in this case to accept the FCC’s legal interpretation of the Telephone Consumer Protection Act.” Whatever the Court decides there, I think a condition written into a rule under an express delegation stands on firmer ground than an FCC reading of an undefined statutory term.

What to gather when an alert claim lands

1. Put a litigation hold on the alert platform’s send logs and delivery records, along with the account-opening records showing where each number came from and any reassigned-numbers database queries.
2. Export opt-out records with timestamps, including STOP replies, key-press opt-outs, and the internal do-not-call list.
3. Pull the National Do Not Call Registry scrub records and their version dates for any number that also received marketing.
4. Collect the carrier or aggregator agreements on free delivery, the vendor contracts, and every alert template and recorded message in use.
5. Speak with a lawyer before you answer a demand letter, contact the person, or offer to settle.

The firm’s page for TCPA defense attorneys in California covers how claims involving fraud-alert texts and prerecorded account-security calls are evaluated, from the records to the first response.

Common questions about the exemption

Does a customer’s STOP reply to a marketing text also stop fraud alerts?

Not necessarily. In FCC 24-24, the FCC said that “when a consumer revokes consent with regard to telemarketing robocalls or robotexts, the caller can continue to reach the consumer pursuant to an exempted informational call.” The alerts can continue unless the customer’s reply makes clear it also covers informational messages, or the customer opts out of the alerts.

Can a fintech or money-transfer company use the exemption?

It can if it qualifies as a financial institution under the Gramm-Leach-Bliley definition, which asks whether its business is engaging in financial activities, and each message meets all nine conditions. The FCC’s order recounts the bankers’ point that money transfers “often must be delivered to persons who do not have an ongoing relationship with the sending institution,” per FCC 15-72. I’d confirm that status with counsel before relying on it.

Do calls and texts count separately toward the three-message cap?

No. The rule caps messages “whether by voice call or text message,” so a text followed by two voice calls about the same event uses up all three. A fourth message about the same event to the same affected account within three days isn’t exempt, and it’s judged under the ordinary rules for equipment and consent.

If a fraud-alert program is the target of a claim

If your company is defending a claim over fraud alerts or breach notices, the message templates and the per-event send counts usually decide whether the exemption holds. Rosenberger + Kawabata represents businesses defending TCPA lawsuits and class actions through its business litigation practice, including claims involving fraud-alert texts and prerecorded account-security calls. Contact Rosenberger + Kawabata online for a free and confidential consultation, or call (310) 894-6921.

Sources

The statute is the Telephone Consumer Protection Act at 47 U.S.C. § 227. The FCC’s rules are at 47 C.F.R. § 64.1200, as published in the eCFR on January 7, 2025. The definition of financial institution is at 15 U.S.C. § 6809.

The FCC orders are the 2015 TCPA Declaratory Ruling and Order, FCC 15-72 (released July 10, 2015), and the codification order, FCC 20-186, at 86 Fed. Reg. 11443 (Feb. 25, 2021). The revocation rules come from the consent-revocation order, FCC 24-24 (adopted Feb. 15, 2024), published at 89 Fed. Reg. 15756 (Mar. 5, 2024), with its effective date announced at 89 Fed. Reg. 82518 (Oct. 11, 2024).

The court decisions are Facebook, Inc. v. Duguid, 592 U.S. 395 (2021), and Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024). The pending case is McLaughlin Chiropractic Associates, Inc. v. McKesson Corp., No. 23-1226 (U.S. cert. granted Oct. 4, 2024) (docket, question presented).

This post is general information about the Telephone Consumer Protection Act and related laws as of January 7, 2025. It is not legal advice, and reading it does not create an attorney-client relationship. Courts and the FCC change the rules in this area often, and the outcome of any claim depends on its facts. Past results do not guarantee future outcomes.