M&T Bank
Financials
55
out of 100. Number 170 of 512, counting from the worst.
Where M&T Bank does well
- Renewals 4 of 20. Few problems found.
- M&T's credit card arbitration provision includes a real opt-out: you can reject arbitration with a signed, mailed notice within 30 days of the agreement date — many banks offer no opt-out at all.
- The GLBA privacy notice is explicit that M&T does NOT share customer data with nonaffiliates for those companies' marketing ('For nonaffiliates to market to you: No — We don't share'), which is better than many peers.
- The California Consumer Privacy Notice states 'M&T Bank Corporation does not sell or share California residents' Personal Information as defined by the CCPA' and does not knowingly sell/share minors' data.
- The Digital Privacy Notice promises that 'Data obtained through text messaging programs will not be shared with any third parties for their marketing purposes.'
- Vermont residents get automatic opt-outs from affiliate sharing of creditworthiness info and affiliate marketing.
- Unauthorized-transfer liability for personal accounts follows Reg E protections ($50/$500 tiered caps stated outright).
Simply browsing mtb.com means you give up your right to sue in court over anything site-related; you must arbitrate in Erie County, NY — and if you lose, you pay ALL arbitration costs, which can make even a small claim financially risky to pursue.
The fine print
7 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
Simply browsing mtb.com means you give up your right to sue in court over anything site-related; you must arbitrate in Erie County, NY — and if you lose, you pay ALL arbitration costs, which can make even a small claim financially risky to pursue.
All disputes relating to this Agreement, use of the Sites or the Content shall be subject to final and binding arbitration, with the losing party paying all costs of arbitration. Any arbitration relating to this Agreement shall be held in Erie County New York, under the rules of the American Arbitration Association.
-
Cardholders are forced into individual arbitration with a total ban on class actions or joining claims together. The only escape is a written rejection mailed within 30 days to Regulatory Support, P.O. Box 1468, Buffalo, NY 14240-1468 — a narrow opt-out window almost nobody uses.
IF YOU OR WE ELECT TO ARBITRATE A CLAIM: (1) NEITHER YOU NOR WE MAY PARTICIPATE IN A CLASS ACTION IN COURT OR IN CLASS-WIDE ARBITRATION; (2) YOU MAY NOT ACT AS A PRIVATE ATTORNEY GENERAL IN COURT OR IN ARBITRATION; (3) CLAIMS BROUGHT BY OR AGAINST YOU MAY NOT BE JOINED OR CONSOLIDATED WITH CLAIMS BROUGHT BY OR AGAINST ANY OTHER PERSON; AND (4) THE ARBITRATOR SHALL HAVE NO POWER OR AUTHORITY TO CONDUCT A CLASS-WIDE ARBITRATION, PRIVATE ATTORNEY GENERAL ARBITRATION OR MULTIPLE-PARTY ARBITRATION.
M&T Bank Visa Credit Card Agreement (CFPB database copy, 8/10/2017)
-
M&T shares your data for its own marketing and for joint marketing with outside financial companies, and federal law gives you no right to stop it. Affiliates get your transaction history with no opt-out. And when you close your accounts, the sharing keeps going anyway.
For our marketing purposes – to offer our products and services to you: Yes [share] / No [you cannot limit]. For joint marketing with other financial companies: Yes / No. For our affiliates' everyday business purposes – information about your transactions and experiences: Yes / No. ... When you are no longer our customer, we continue to share your information as described in this Notice.
-
M&T's site and app can record how you type, move your mouse, tap your phone — and even replay screenshots of your banking sessions in real time. This info can go to service providers 'including for marketing purposes,' and the notice admits it ignores 'Do Not Track' browser signals.
We may collect certain behavioral biometrics such as mouse movements and patterns, touch screen interactions and movements, keyboard interactions, typing cadence, and navigation patterns. ... We may also use other technologies, such as the real time capture of screenshots, commonly known as session replay, while you are using our Online Services, to understand how you navigate and use the Services.
-
M&T can rewrite its online banking contract — including fees — whenever it wants, and if you just log in after a change, that counts as you agreeing to it. Your only real choice is to stop using digital banking.
Except as otherwise required by law, rule, regulation, or this Agreement, M&T may change the terms of this Agreement (including fees) at any time. ... You may choose to accept or decline changes by continuing or discontinuing the use of the M&T Digital Services. Your continued use of the M&T Digital Services shall constitute your acceptance of the amended Agreement.
M&T Digital Services Agreement (Revised 11/30/21), §M6 Amendment
-
Anything you type into mtb.com — messages, forms, feedback — legally becomes M&T's property, and they can use it for literally any purpose. It's an unusually broad ownership grab for a bank's website.
All information you submit to M&T via the Sites will be considered to be the property of M&T, and M&T is free to utilize any information you submit for any purpose.
-
Cancel digital banking and you forfeit the fees you already paid for that billing cycle. Meanwhile M&T can cut off your access at any time, for no reason at all.
If you cancel, we will not refund any fee you have paid for any Digital Service during the cycle in which you cancel. ... We reserve the right in our sole discretion to refuse to honor an Instruction or suspend, cancel or terminate your access to the Digital Services, in whole or in part, at any time, with or without cause.
M&T Digital Services Agreement (Revised 11/30/21), §M9 Cancellation
How these were found
Documents actually read (all on mtb.com unless noted): (1) M&T Digital Services Agreement, Revised 11/30/21 (https://www.mtb.com/content/dam/mtb-web/pdfs/digital_services_agreement_v_2_22.pdf) — read via browser_open. (2) Terms of Use Policy (https://www.mtb.com/help-center/bank-policies/terms-of-use) — read via browser_open, search cache 1 day old. (3) Digital Privacy Notice, Last Updated April 27, 2026 (https://www.mtb.com/help-center/bank-policies/privacy/digital) — read via browser_open. (4) US Consumer Privacy Notice, Rev. 09/25 (http://www.mtb.com/content/dam/mtb-web/pdfs/us-consumer-privacy-notice.pdf) — read via browser_open. (5) M&T Bank Visa Credit Card Agreement from the CFPB credit-card agreement database (files.consumerfinance.gov), dated 8/10/2017 — verbatim copy M&T filed with regulators, but 9 years old; the current card agreement may differ, especially the arbitration opt-out mechanics. (6) Court filings in the checking-account overdraft litigation (cases.justia.com) confirm M&T's deposit account agreement historically contains an arbitration clause with a rejection provision, but the current consumer deposit account agreement PDF was not located on mtb.com, so the deposit-account arbitration terms are not quoted directly. No OpenTermsArchive/PrivacyTracker/Difficode mirrors used. All quotes are verbatim from these sources.
These notes come from the original draft and are not independent verification.