(Bloomberg) --Wells Fargo & Co.’s disclosure that it mayhave pushed thousands of car buyers into loan defaults andrepossessions by charging them for unwanted insurance is raisingdoubts about the lender’s ability to put proper controls inplace.

Related: Wells Fargo is your last warning: Checkyour 401(k)

“The steady drip of revelations is concerning as it makesquantifying and qualifying the extent of the internal controlfailures difficult,” Isaac Boltansky, an analyst at Compass PointResearch & Trading, said Friday in an email. “Which isworrisome for both Washington and Wall Street."

An internal review of the bank’s auto lending found more than500,000 clients may have unwittingly paid for protection againstvehicle loss or damage while making monthly loan payments, eventhough many drivers already had their own policies, Wells Fargo said in a statement lateThursday.

The firm said it may pay as much as $80 million to affectedclients -- with extra money for as many as 20,000 who lost cars,“as an expression of our regret.”

The revelation threatens to undermine the bank’s10-month effort to restore its image after authorities announcedlast year that branch workers may have opened millions ofunauthorized accounts for customers.

For shareholders, Thursday’s disclosure also landed without anywarning, even after that earlier debacle sent the stock tumblingand prompted congressional hearings and a leadership shakeup.

‘Clearly insufficient’

“What has been shown is that the bank was run for superiorrevenue growth, and the controls around managing that were clearlyinsufficient,” Atlantic Equities analyst Christopher Wheeler saidin an email. “Management changes may have to be more extensive totry and shake off the new and lower quality reputation.”

Wells Fargo said it began reviewing the insurance issue about 12months ago after hearing from clients.

“Upon our discovery, we acted swiftly to discontinue the programand immediately develop a plan to make impacted customerswhole,” Franklin Codel, the bank’s head of consumer lending,said in the statement. The bank’s leaders “are extremely sorry forany harm this caused our customers, who expect and deserve betterfrom us,” he said.

An examination of the program, which was scrapped in September,found that an external vendor didn’t adequately ensure customersweren’t charged for the coverage -- known as collateral protectioninsurance -- if they already had their own policies, according tothe bank’s statement.

About 490,000 customers unnecessarily paid for CPI for at leastsome period of time, the bank said. Collectively, they will receiveabout $25 million in refunds.

Other victims

Wells Fargo also described two smaller groups of victims wherethe impact on individuals may have been more severe:

About 60,000 clients lived in five states that don’t allow CPIto be imposed on borrowers without a specific notification, whichthe bank said they didn’t receive. That group will get $39million.

An estimated 20,000 customers may have had cars repossessedbecause the additional costs from CPI, the bank said. It expects tospend $16 million on that group, compensating them for theirvehicles.

The amounts “will depend on each customer’s situation and alsowill include payment above and beyond the actual financial harm asan expression of our regret for the situation,” Wells Fargosaid.

The bank announced the measures a few hours after New York Timescolumnist and editor Gretchen Morgenson said she had obtained a60-page report by consulting firm Oliver Wyman examining how CPIwas imposed on customers of the bank’s Dealer Services unit.

The document shows Wells Fargo stopped sharing in commissionsfrom the insurance sales in February 2013, she wrote.

Catherine Pulley, a Wells Fargo spokeswoman, declined to providea copy of the consultant’s report. The report, commissioned to helpthe lender decide how to respond to its customers, was completed inFebruary, according to a person with knowledge of the matter, whoasked not to be identified discussing internal affairs.

Refunds coming

Wells Fargo reviewed policies placed from 2012 to 2017,according to its statement. The company will start sending lettersand refund checks to customers next month, and expects the processwill be complete by the end of the year. The lender also promisedto work with credit bureaus to amend customers’ credit records.

Unnecessary or undisclosed insurance attached to loans hascaused scandals at other major banks.

British lenders for years sold payment protection insurance ontheir consumer loans that customers didn’t want or need, and since2011 have set aside more than $40 billion for the cost ofreimbursing them.

The San Francisco-based bank has been trying to move past theaccount scandal that erupted publicly in September when it paid$185 million in fines.

In that case, Wells Fargo initially faulted low-level staff,saying it had fired more than 5,300 employees over five years as itsought to stamp out their abuses. That backfired as workers cameforward, saying they faced intense pressure to meet unrealisticquotas.

The bank struck a different tone Thursday.

“We take full responsibility for our failure to appropriatelymanage the CPI program,” Codel said in the statement. The bank haspublicly promised that it will do better, he said. “Our actionsover the past year show we are acting on this commitment.”

Copyright 2018 Bloomberg. All rightsreserved. This material may not be published, broadcast, rewritten,or redistributed.