Retail & Fintech · Fintech (cash advance) · Regulatory action + Private litigation + Data breach
Dave
Headline
The July 2020 Dave breach came through Waydev, a third-party analytics vendor - the same vendor-chain structure documented in the AMCA, SITA and Salesloft findings across this tracker.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
The July 2020 Dave breach came through Waydev, a third-party analytics vendor - the same vendor-chain structure documented in the AMCA, SITA and Salesloft findings across this tracker. What makes it land harder here is the customer base: cash advance apps serve people managing short-term liquidity problems, so the user list is itself a financial-distress signal, and the transaction data describes exactly how close to the edge each person is. That dataset has obvious value to lenders, debt collectors and advertisers targeting financial products at vulnerable consumers.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
CONFIRMED HISTORICAL BREACH (July 2020, via third-party vendor Waydev): exposed personal information of approximately 7.5 MILLION Dave users — names, emails, phone numbers, birthdates, addresses, HASHED passwords and, per Dave's notice, ENCRYPTED Social Security numbers. Dave's California AG notice states the unauthorized access ran June 23-July 1, 2020, that Dave learned of it July 1, 2020, and its customer notice letters are dated August 21, 2020; no lawsuit over notification timing was verified.
Fees and billing
SEPARATE GOVERNMENT FEE-DECEPTION LAWSUIT: the FTC sued Dave in November 2024 and, after referral, the DOJ filed an amended complaint in December 2024 naming Dave and CEO Jason Wilk under the FTC Act and ROSCA; no settlement reported as of mid-2026 (status not re-verified Oct 2026). It alleges Dave's marketing as 'no interest, no hidden costs' cash advances was misleading given its actual fee structure — a $100 advance with a $5 'express' transfer fee can carry an effective annualized cost above 200% on a short advance (this tracker's illustrative calculation, not a figure from the complaint); the complaint alleges 'instant' transfers took two to three business days unless consumers paid an Express Fee of $3 to $25. The complaint also alleges Dave presented OPTIONAL 'tips' in a way that functioned more like MANDATORY charges, and pushed users toward paid 'express' transfers while making the free standard-transfer option less obvious. The amended complaint alleges an internal Dave presentation warned about express-fee practices and was not acted on. Dave dropped optional tips and express fees for ExtraCash for members onboarded from Dec. 4, 2024.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy dave.com/privacy | Not fetched yet | NO (HTML only) |
| Terms of service dave.com/terms | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.