Pega Hires a Bank Security Chief as a Wiretapping Suit Threatens Its Voice AI Line

Four people called U.S. Bank's▼−0.91% — U.S. Bank, down 0.91 percent today customer service line from home, gave up their addresses, account numbers and dates of birth to a human agent, and now say a software company was listening the whole time. On October 2, 2026, they sued Pegasystems▼−2.97% — Pegasystems, down 2.97 percent today in the U.S. District Court for the District of Massachusetts, a proposed class action filed by the firm Bursor & Fisher↗, and today, October 13, Pega answered with a hire: Sean Croston, most recently chief information security officer at USAA and formerly in the same seat at Truist, BNP Paribas/Bank of the West and Santander US, takes the CISO job with privacy and compliance inside his remit↗. ¹²

The charge: an outside party on every call

Pega sells Voice AI, a service that converts both sides of a live customer-service call into text, suggests next steps to the agent and writes the call summary. U.S. Bank runs it in its contact centers and Pega names the bank as a customer on its own website. ³ The complaint says the audio streams to Pega's cloud servers, not the bank's, which makes Pega an outside party to each call, one able to use the conversations to train and improve its own AI models. ⁴

The evidence admitted

The plaintiffs plead three wiretapping statutes: California's Invasion of Privacy Act, which bars learning the contents of a communication in transit without all parties' consent, and the Massachusetts and Pennsylvania wiretapping acts. They seek $5,000 per violation in California and at least $1,000 in the other two states, for everyone who called the bank from those three states↗. ⁴

The company's exhibit: a print in seven days

Pega reports Q3 results after the close on October 20↗. The consensus expects $0.4861 per share on $422.56 million of revenue, but last quarter the company missed, earning $0.35 against $0.43 expected on $420.72 million. Quarterly net income has slid from $234.57 million in Q4 2025 to $13.33 million in Q2 2026, and the stock sits at $34.91 against a 52-week high of $68.10. ⁵⁶ Over the same stretch, insiders sold 53,672 shares for $1.92 million in three months, including chief financial officer Kenneth Stillwell's sale of 39,627 shares for $1.42 million on September 11. ⁵

The cross-examination and the verdict watch

The company's defense writes itself in its own press release: Pega's work is "mission-critical" and "governed," and the hire of a 30-year bank-security veteran signals the trust conversation is being met with staff, not silence. ¹ But the plaintiffs' theory, that a vendor's servers are a party to the call, is aimed at the buyers, not the courts: if each monitored call is a statutory violation, the cost lands on the bank compliance departments that approve these purchases, and Pega's price for AI on live calls has to cover it. ⁴ Watch October 20, and the first motion to dismiss.

What to watch next

The tell is whether Pega discloses the litigation's scale on the October 21 earnings call: how many U.S. Bank calls touched Pega servers, and whether any other bank customer is re-papering its consent notices. The Street holds at a consensus price target of $47.40, with Loop Capital at $25 and Rosenblatt at $47. ⁵ A class worth $5,000 a call, settled at scale, would reprice every vendor that listens to bank calls on its own servers. ⁴