The Consumer Financial Protection Bureau is ordering U.S. Bank, chartered in Ohio, to refund more than $48 million to 420,115 customers it says were charged for add-on products, including identity protection and credit monitoring services that were either unauthorized or never received. That bank was also required to pay $9 million in penalties, according to an administrative proceeding order issued on Thursday.

The add-ons in question were offered to customers from at least 2003 to approximately January 2012, according to the CFPB. Although written authorization was needed to obtain credit data, โ€œin many cases some time passed before a customerโ€™s authorization was obtained, or a Customerโ€™s authorization was never obtained.โ€ In other instances, customers provided their authorization, but one or more credit reporting agencies could not process the authorization if they were unable to match identification information with the agencyโ€™s own records. In these circumstances, customers were billed the full fee for additional services despite the inability to make good on their promises.