The unauthorized account scandal that rocked Wells Fargo just became a whole lot worse. A third-party review commissioned by the banking giant has found that the number of falsified accounts is nearly 1.5 million higher than the 2.1 million initially uncovered and disclosed.

In September 2016, the Consumer Financial Protection Bureau fined Wells Fargo Bank, a subsidiary of Wells Fargo & Company, $100 million for what it called “the widespread illegal practice of secretly opening unauthorized deposit and credit card accounts.” The infractions date back to 2011.

The crux of the allegation: spurred by sales targets and compensation incentives, employees boosted sales figures by covertly opening accounts and funding them by transferring funds from consumers’ authorized accounts without their knowledge or consent, often racking up fees or other charges.

According to the bank’s initial analysis, employees opened more than two million deposit and credit card accounts that may not have been authorized by consumers. As part of a settlement, Wells Fargo will pay full restitution to all victims, a $100 million fine to the CFPB’s Civil Penalty Fund, $35 million penalty to the Office of the Comptroller of the Currency, and $50 million to the City and County of Los Angeles.

The latest development comes from an Aug. 31 statement by the bank. It announced the completion of its previously announced expanded third-party review of retail banking accounts dating back to the beginning of 2009.

“Combined with a recent class action settlement and ongoing broad customer outreach and complaint resolution, the completion of the analysis further paves the way for making things right for Wells Fargo customers who may have been harmed by unacceptable retail sales practices,” the statement says.

“We apologize to everyone who was harmed by unacceptable sales practices that occurred in our retail bank,” added CEO Tim Sloan. “Through this expanded review, as well as the class action settlement, free mediation services, and ongoing outreach and complaint resolution, we’ve cast a wide net to reach customers and address their remaining concerns.”

To conduct the review of retail bank accounts, Wells Fargo engaged a third-party firm that developed a data analysis methodology that it says “errs on the side of customers.” The account review analyzed consumer and small business checking, savings, and unsecured credit card and line of credit account data to identify potentially unauthorized accounts.

The analysis, Wells Fargo says was data-driven and looked at account usage patterns. Since usage patterns of some authorized accounts opened with a customer’s consent can be similar to some unauthorized accounts, it is likely that some properly authorized accounts were included in the population identified as unauthorized accounts.

The original account analysis reviewed 93.5 million current and former customer accounts opened in an approximately four and half year time period (from May 2011 through mid-2015) and identified approximately 2.1 million potentially unauthorized accounts. The expanded analysis reviewed more than 165 million retail banking accounts opened over a nearly eight-year period (from January 2009 through September 2016) and identified a new total of approximately 3.5 million potentially unauthorized consumer and small business accounts.

In connection with the 3.5 million potentially unauthorized accounts, approximately 190,000 incurred fees and charges, up from 130,000 previously identified accounts that incurred fees and charges. Wells Fargo will provide a total of $2.8 million in additional refunds and credits on top of the $3.3 million previously refunded following the original account review.

The expanded analysis included a review of online bill pay services, as required by regulatory consent orders. During the almost eight-year review period, the analysis identified approximately 528,000 potentially unauthorized online bill pay enrollments and Wells Fargo will refund $910,000 to customers who incurred fees or charges.

The analysis identified, as potentially unauthorized, accounts with only one minimal payment and no further use of the service. Some customers may have made an authorized introductory payment and then elected not to use the service. Therefore, the analysis did not definitively identify whether an enrollment was authorized by a customer or not, and properly authorized enrollments are likely part of this total. Wells Fargo will issue refunds for all enrollments the review identified as potentially unauthorized.

In addition to the refunds resulting from the third-party account review, Wells Fargo has provided more than $3.7 million in refunds and credits to customers for complaints and mediation claims from Sept. 8, 2016, through July 31, 2017.

Customers also may receive compensation under the recent $142 million class-action settlement for claims dating back to 2002. After plaintiffs’ attorneys’ fees and costs of administration, the class-action settlement will provide reimbursement of fees not already paid and compensation for increased borrowing costs due to credit-score impact associated with a potentially unauthorized account. Remaining funds will be distributed to the participants in the class on a per-account basis.

In the coming weeks, Wells Fargo says it will be taking significant steps to compensate its retail and small business customers who may have been harmed or impacted by unacceptable retail sales practices within the company’s retail bank.

These steps include communications associated with the company’s $142 million class action settlement agreement (Jabbari v. Wells Fargo) covering all persons who claim that Wells Fargo opened, without their consent, a consumer or small business checking or savings account or an unsecured credit card or line of credit, and customers who enrolled in certain identity theft protection services, between May 1, 2002 and April 20, 2017.

Over the next two months, both Wells Fargo and the court-appointed claims administrator will be sending communications about how to join the class to current and former Wells Fargo customers.

Wells Fargo will also be compiling a list of customers who complained about an unauthorized account that was opened without their consent. Those customers will be notified by both Wells Fargo and the court-appointed claims administrator and automatically enrolled in a portion of the class-action settlement.

The bank will also continue to offer free mediation services to customers if it is unable to resolve an issue related to an unauthorized account directly with the customer.

For customers who believe they had an unauthorized account or service opened in their name, regardless of when the issue occurred, Wells Fargo has a dedicated hotline: 1-877-924-8697.