Chime (named in the complaint, not a defendant) · Governance finding · severity 2 of 5
A proposed class action filed in Grundy County, Illinois, alleged that identity-verification vendor Incode Technologies used facial recognition software to extract biometric identifiers from the ID photos and selfies that Chime applicants uploaded. The suit claimed Incode did this without the written notice, written release and public retention policy required by Illinois' Biometric Information Privacy Act (BIPA). The amended complaint, filed on 21 November 2023, proposed a class of Illinois users who uploaded photos and an ID to Chime "and subsequently to Incode". Incode removed the case to federal court, but it was sent back to state court in July 2024 during settlement talks. According to the court notice reported by Biometric Update, Incode agreed to fund a $4,000,000 settlement for Illinois users of any Incode customer. Chime was not a defendant, and the court made no finding that Incode violated BIPA.
Record last reviewed Oct 21, 2026 · Markdown
Date
Country
United States
AI system
Facial recognition that matches a selfie to the photo on a government ID during sign-up identity verification ("biometric facial recognition software", per the removal notice summarising the complaint) · vendor: Incode Technologies
AI?
Machine-learning system (inferred from the record)
The sources describe a machine-learning model; nobody on the record labelled it AI.
Category
Status
Settled
Severity
2 of 5
Impact
$4,000,000 settlement fund (estimated $65 to $240 per valid claim) · ≈ $4 million · People in Illinois who uploaded a selfie and a photo ID for identity verification performed by Incode between 11 November 2018 and 5 August 2024, including Chime applicants. · No data breach or customer loss was alleged. The case concerned notice and consent under BIPA.
What happened?
According to Incode's notice of removal, the plaintiff filed a first amended putative class action complaint against Incode Technologies, Inc. in the Circuit Court of Grundy County, Illinois (No. 2023LA59), on 21 November 2023. The complaint alleged that Incode "used biometric identification technology to extract Plaintiff's biometric identifiers and compare the two photographs". It also alleged that Incode had no public retention and destruction schedule and did not inform users in writing or obtain written releases, as BIPA requires.[1]
The proposed class was defined by reference to Chime. It covered "all persons who, while within the State of Illinois, uploaded their photograph(s) and an ID to any application, software, or website operated by Chime, and subsequently to Incode, from November 21, 2018 to the present." Chime itself was not sued.[1]
Incode removed the case to the US District Court for the Northern District of Illinois on 27 December 2023 (No. 1:23-cv-17093). In February 2024 the court stayed the case while the parties discussed settlement. On 3 July 2024 it remanded the case to Grundy County on the parties' stipulation, with each side bearing its own costs.[2]
The settlement covered more than Chime users. Biometric Update reported a court notice saying that anyone in Illinois who uploaded a selfie and a photo ID to an app or website for identity verification performed by Incode between 11 November 2018 and 5 August 2024 could claim from "the $4,000,000 fund that Defendant agreed to create". It estimated individual payments at $65 to $240. The notice said the court had not decided whether Incode violated BIPA.[3]
When did it happen?
- Nov 21, 2023
First amended class action complaint filed against Incode in Grundy County, Illinois, defining the class by reference to Chime.[1]
- Dec 27, 2023
Incode removes the case to the Northern District of Illinois.[1][2]
- Feb 5, 2024
Federal court stays the case while the parties discuss settlement.[2]
- Jul 3, 2024
Case remanded to the Circuit Court of Grundy County on the parties' stipulation.[2]
- Feb 2025
Biometric Update reports the court notice of a $4 million Incode settlement fund for Illinois users of Incode identity checks.[3]
What was the impact?
- Financial: $4,000,000 settlement fund (estimated $65 to $240 per valid claim) · ≈ $4 million[1][3]
- Customers: People in Illinois who uploaded a selfie and a photo ID for identity verification performed by Incode between 11 November 2018 and 5 August 2024, including Chime applicants.[1][3]
- Other: No data breach or customer loss was alleged. The case concerned notice and consent under BIPA.[1][3]
Severity 2 of 5: A $4 million class settlement fund paid by the vendor, covering people in Illinois whose ID photos and selfies were checked by Incode. It resolved allegations only, with no liability finding, no data exposure and no regulatory action.
How did Chime (named in the complaint, not a defendant) respond?
No public statement by Chime or Incode about the case was found as of 2026-10-21 (we searched news and legal-press coverage and the federal docket). Incode agreed to the settlement without any court finding that it violated BIPA. Chime was not a party.[2][3]
What was the outcome, and did regulators act?
Incode agreed to a $4 million class settlement in the Grundy County court, according to the court notice reported by Biometric Update. Final approval and distribution are not recorded in the sources we could read. No court found that Incode or Chime broke the law, and no regulator acted.[2][3]
Did Chime pay to settle the Incode biometric lawsuit?
No. The suit was filed against Incode Technologies, the identity-verification vendor, and Incode agreed to create the $4 million settlement fund. Chime was named only in the proposed class definition, which covered Illinois users who uploaded photos and an ID to Chime and then to Incode. The final settlement class covered Illinois users of any Incode customer.
What did the Incode lawsuit claim happened to Chime applicants' data?
The complaint, as summarised in Incode's removal notice, said Incode's facial recognition extracted biometric identifiers from applicants' selfies and ID photos to compare them. It also said Incode had no public retention policy and did not give written notice or obtain written releases, as Illinois' Biometric Information Privacy Act requires. No data breach was alleged.
Was the identity check an AI system?
The record describes facial recognition software that compares a selfie with an ID photo. It is a machine-learning technique, but neither the court filings nor the settlement notice we read used the word AI. Incode and Chime did not describe the system in the case.
When AI goes wrong at a bank, the next morning's brief says so.
when one of these regulators moves, the next morning's brief says so · six sourced stories · 7 am PT · free
plus every regulation, bank and agent page update, the morning after · leave any morning