Millions of credit card holders who bought add-on services from Bank of America may be in line for substantial payments from the company thanks to the Consumer Financial Protection Bureau.

The CFPB determined that the bank used deceptive marketing tactics to sell services such as “credit protection deluxe” and then unfairly billed consumers for services they weren’t actually receiving.

According to documents released by the CFPB on Wednesday, up to 2.9 million consumers will split some $727 million in refunds as a result of the consent order the bank negotiated with CFPB.

Related: Colleges Trick Parents on Financial Aid Rewards

“We have consistently warned companies about illegal practices related to credit card add-on products,” said CFPB Director Richard Cordray. “Bank of America both deceived consumers and unfairly billed consumers for services not performed. We will not tolerate such practices and will continue to be vigilant in our pursuit of companies who wrong consumers in this market.”

The agency says the problems began with the telemarketers who were charged with selling the credit protection programs. Customers were told that if they purchased the product, Bank of America would cancel a portion of their debt in the event of certain adverse events, such as involuntary unemployment or disability.

The problem is that the telemarketers misstated the details of the program in the scripts read to consumers and that in some cases, the telemarketers didn’t bother with the script at all. That failure resulted in misleading sales pitches and leaving out important information.

The agency contends that the bank’s representatives misled customers about a number of things, including whether or not the first month of coverage was free, and exactly what protection was being provided. Other customers were signed up for the product despite being given the impression that they had only agreed to receive more information about it.

Related: Rough Week for an Agency Targeted by the GOP

With regard to other “credit protection” products, the CFPB found that Bank of America had billed customers for services that they did not receive, sometimes causing them to exceed their credit limits and incur fees and increased interest charges.

On top of reimbursing customers $727 million, the agreement requires the bank to pay a $20 million civil penalty to the CFPB. The bank will also face a $25 million civil penalty payable to its primary regulator, the Office of the Comptroller of the Currency.

The bank acknowledged the agreement in a press release Wednesday, noting, “Bank of America stopped marketing identity theft protection products in December 2011 and credit card debt cancellation products in August of 2012.” The bank’s release reported a slightly higher amount of money that will be repaid to customers, putting the figure at $738 million.

Top Reads from The Fiscal Times