A customer types “I didn’t make this charge” into a bank’s chat window. Whether that sentence starts a legally timed investigation or disappears into a loop of FAQ links is the problem the Consumer Financial Protection Bureau put at the center of its June 6, 2023 report, Chatbots in consumer finance. The report is still posted on the CFPB’s site, and its core point applies to any assistant built on a large language model: a chatbot has to meet the same consumer finance obligations as the process it replaces.
This explainer covers what the report found, where it says the legal risk sits, and how its findings translate into design requirements for a fintech team building a support assistant.
What the CFPB looked at
The report is an issue spotlight drawn from consumer complaints and a review of the market. It found that each of the 10 largest US commercial banks used chatbots in customer service, and it cited an industry estimate that about 37% of the US population interacted with a bank’s chatbot in 2022.
It separates rule-based chatbots, which use decision trees or keyword lists to trigger preset answers, from more complex systems that use machine learning or LLMs to generate replies. It notes that banks were moving from the first kind toward the second. The CFPB’s concern covers both: rule-based bots that cannot handle anything outside a menu, and generative bots that can produce fluent but wrong answers.
The report says plainly that it does not create new obligations. A footnote states that it is not intended to impose obligations, define rights or interpret any regulation, while adding that companies may be liable under federal consumer financial law when chatbots fail to meet existing requirements.
The four problems the report describes
Disputes that are never recognized. The CFPB says chatbots and scripted agents can be inflexible, so that only certain words or phrasing trigger a dispute. Even when a bot does recognize one, it may only repeat back the same account data the customer says is wrong. One complaint quoted in the report describes three separate chat sessions promising a dispute and provisional credit that never appeared.
Inaccurate answers. The report says LLM-based chatbots are not well positioned to distinguish correct from incorrect information and can repeat misinformation from their training data. Where a company relies on a bot to give information that the law requires to be accurate, the CFPB says a wrong answer may violate those obligations.
No way to reach a person. The CFPB describes “doom loops,” where a customer’s question falls outside what the bot can do and every path leads back to the same menu or a login prompt. Complaints in the report describe late fees and credit reporting that followed when a customer could not reach anyone to pay a bill or fix an error.
Security and privacy. The report says chat logs that contain personal and financial information should be treated as sensitive consumer information. It also flags impersonation bots used for phishing, and it calls for rigorous security testing and auditing of third-party chatbot providers.
Where federal rules meet the chat window
The report does not walk through regulations one by one, but the dispute problem lines up closely with the error resolution rules for electronic fund transfers. Under Regulation E, 12 CFR 1005.11, a financial institution must follow the error procedures for any oral or written notice of error that arrives within 60 days of the statement showing the error, lets the institution identify the consumer’s name and account, and says why the consumer believes there is an error.
The clock then starts. The institution generally has 10 business days to determine whether an error occurred, or up to 45 days if it provisionally credits the account. It may ask for written confirmation of an oral notice within 10 business days, but the CFPB’s official interpretation says the institution must begin investigating on receipt of an oral notice and may not wait for the written version.
The same interpretation allows an institution to require notice at a specific telephone number or address, but only if it keeps reasonable procedures to refer a consumer who tries another channel. For a chatbot, that is the practical test. If a customer describes an unauthorized transfer in chat and the bot neither opens a case nor routes the customer to the designated channel, the institution has a gap between its process and its rules.
Credit cards work differently. Under Regulation Z, 12 CFR 1026.13(b), a billing error notice must be written, although the commentary treats an electronic submission as written when the creditor’s billing rights statement says it accepts notices that way and explains how. A chat assistant for a card product therefore has to know whether chat is one of those channels, and if not, where to send the customer.
Turning the report into requirements
The CFPB’s findings translate into a short list of requirements a product team can test before launch. The list below is our application of the report and the rules cited above, not a CFPB checklist.
| CFPB finding | Design requirement |
|---|---|
| Bots miss disputes phrased in unexpected ways | Detect dispute and error language broadly; when in doubt, open a case or hand off |
| Bots repeat the data being disputed | Route disputes to a workflow that can investigate, not to a balance lookup |
| Generative answers can be wrong | Answer fee, rate and rights questions from approved text, with links to the account agreement |
| Customers get stuck in loops | Offer a visible path to a person at every step, including for users who cannot log in |
| Chat logs hold sensitive data | Treat transcripts as protected customer information, with access controls and retention limits |
Logging matters for a second reason. If a chat message can count as a notice of error, the timestamp of that message may start a regulatory clock, so the transcript is evidence the institution needs to keep and be able to find.
These requirements sit alongside the model-level controls covered in our explainers on LLM sensitive information disclosure and prompt injection defenses. For broker-dealers, FINRA has its own view of chatbot communications, covered in our guide to FINRA generative AI guidance. A customer whose dispute goes nowhere can still escalate through the CFPB complaint process.
