The Consumer Financial Protection Bureau has filed a lawsuit against Sprint, alleging that the wireless communications provider illegally billed its customers tens of millions of dollars in unauthorized third-party charges.

The Bureau’s complaint alleges that Sprint operated a billing system that allowed third parties to “cram” unauthorized charges on customers’ mobile-phone accounts and ignored complaints about the practice. The suit seeks refunds for affected consumers and penalties to deter unauthorized third-party charges in the future.

Consumers use mobile phones to purchase an array of digital products, such as apps, games, books, movies, and music. Wireless carriers collect and process payments for these purchases and control the networks connecting merchants and customers. From approximately 2004 through 2013, nearly all wireless third-party billing involved products called “premium text messages” or “premium short messaging services” (PSMS) because they were frequently delivered by text messages. Sprint outsourced payment processing for these digital purchases to vendors,“billing aggregators,” without properly monitoring them the CFPB alleges.

“The lack of oversight gave aggregators near unfettered access to consumers’ wireless accounts,” the Bureau said in a statement. “Sprint’s system attracted and enabled unscrupulous merchants who, in some cases, only needed consumers’ phone numbers to cram illegitimate charges onto wireless bills.” The charges included one-time fees and monthly subscriptions. Sprint received a 30-40 percent cut of the gross revenue from these charges.

Many of Sprint’s customers were targeted online after clicking on ads that brought them to websites asking them to enter their cell phone number. Some merchants tricked consumers into providing their cell phone numbers to receive “free” digital content and then charged for it. Many others simply placed fabricated charges on bills without delivering any goods or communicating with consumers, the CFPB alleges.

The CFPB says Sprint, as a payment processor for third parties, violated the Dodd-Frank Act’s prohibition on unfair practices by:

Allowing third-parties to illegally charge consumers and automatically billing consumers for illegitimate charges without their consent. Sprint did not let customers opt in to third-party billing. Instead, the company automatically enrolled customers without their consent. Many customers did not spot unauthorized charges, as they were unaware that third parties could place charges on their bills.

Disregarding red flags about third parties. Sprint continued to outsource to billing aggregators despite lawsuits about cramming against the very same aggregators that it used. In addition, the company had already been subject to a law enforcement action related to the issue.

Ignoring consumer complaints about unauthorized charges. Sprint failed to track customer complaints about unauthorized charges, and as a result, “lacked the most basic alert mechanism that could have revealed flaws in its monitoring systems.” Sprint also failed to provide full and prompt remediation to consumers subjected to these charges. In some instances, Sprint refused to provide refunds and only offered instructions on how to block future third-party charges.

The CFPB worked with the Federal Communications Commission in developing its case. Media reports have indicated that the FCC is considering upwards of $105 million in fines against Sprint.