Don't just tell them you did, but actually create two accounts and only access your own data. Don't try to access others' data. When changing IDs try to stick t

Don't just tell them you did, but actually create two accounts and only access your own data. Don't try to access others' data. When changing IDs try to stick to ones you know you own on other accounts. If you're lazily trying the ID "1" and it works, or for example you find a /list endpoint which outputs everyone's data, then stop there and report immediately before doing any further testing. Financial companies are unlikely to be receptive to unsolicited penetration testing and more likely to come down hard because of a need to demonstrate compliance, the same goes for any healthcare related sites. There's a reason you rarely see them popping up on lists of bug bounty programmes.