Product: Money transfer, virtual currency, or money service

Some time in the late night of XX/XX/XXXX someone gained unauthorized access to my CashApp account. They changed the information on my account like my recovery email and phone number, PIN, and my XXXX, so I could not access the account. While this suspicious activity was happening on my account, CashApp never alerted me that the info was being changed or sent any alerts so I could confirm/deny if I made the changes. So, I woke up on the morning of XX/XX/XXXX and realized I did not have access to my account. I called CashApp support immediately. After speaking with multiple agents, they opened a claim for my concerns and an agent let me know that they could see the suspicious activity happening on my account, but they could not recover the account for me at that time. At this point, CashApp could have locked or froze my account while my concerns were being investigated, but they did not. I was expecting a direct deposit to the account, so I worked with my employer to reverse my direct deposit before the person who hacked my account could access my money. The CashApp support agent also told me I should work with my employer to reverse the direct deposit. My employer was unsuccessful with the reversal. My employer contacted CashApp to work with them on the issue. CashApp reps told my employer they would send my direct deposit back to the account because the account had insufficient balance. This means that CashApp was already aware that unauthorized activity was happening on my account. They did not follow up with me to further address this and they did not disclose this to me when I contacted them on XX/XX/XXXX, I had to follow up with them. I reached out to CashApp support daily for support and updates. Rather than address my initial complaint, their agents insist on opening a new claim/investigation each time I reached out, making it impossible to keep up with these investigations and giving them an excuse to say " this is being investigated currently ''. On XX/XX/XXXX a CashApp support agent helped me regain access to my account. Once I got access back to my account, I saw the plethora of suspicious, unauthorized activity that happened on my account while I did not have access to it. The main transaction for this complaint involves a withdrawal of {$1100.00} from my CashApp account to a XXXX bank account. I have had my CashApp account since XXXX and it has been my main form of banking since. So, in this time, I have never had any external bank accounts or debit cards connected to my CashApp account ( because I do not own any other bank accounts/cards ). Whoever fraudulently accessed my account connected their external bank account to my Cash App and withdrew my entire direct deposit. CashApp and its systems had no protections in place for me as a customer, so I was, again, not sent any alerts that an external account was being connected to my account. And, the withdrawal was made instantly, meaning CashApp took no steps to verify in any way that the account belonged to me. I have remained in constant contact with CashApp support. Each time I reach out, they open a new investigation, even if I only call for updates on current or previous investigations into the same issue. The issue arises with the way they are investigating my claims. They are not transparent about their investigations, they do not furnish legitimate proof or findings of these investigations when requested, and the structure of their support team makes it nearly impossible to get information about the claims. At the time of this email, I have had at least XXXX claims/investigations opened with CashApp and still have not been given a reasonable explanation about why they can not return the money that was taken from my account due to their lack of protection. The CashApp support team has sent me many emails, some of which directly state and acknowledge that my account was hacked and not in my control from XX/XX/XXXX to XX/XX/XXXX. Speaking with their agents is unhelpful and I've been given alot of conflicting information. On XX/XX/XXXX, nearly XXXX months after the initial incident, a CashApp agent provided me with the email address that was connected to my account when I was hacked. I have no association with and I am not the owner of that email address. The email seems to be comprised of random characters and uses an iCloud domain. Knowing this, CashApp has claimed that the withdrawal of {$1100.00} from my account was authorized by myself or someone I know. I do not think they have took the time to look into my claim at all. Had they properly investigated the issue when I first reached out to them, they would have been able to prevent other fraudulent, unauthorized activity on my account. Whoever accessed my account continued to use my account until XX/XX/XXXX, right before I regained access. At the least, CashApp could have XXXX froze my account when I first reached out to them. 

My concern is, CashApp has been held responsible for this type of activity by the CFPB and the recent class action lawsuit against them. Unfortunately, my situation shows that CashApp continues to allow fraud to go unaddressed on their platform and attempt to escape responsibility. 

In the CFPB report put out on XX/XX/XXXX, it is said that Cash App " created conditions for fraud to proliferate '' and " employed weak security protocol ''. In my situation, CashApp 's weak security made it possible for someone to access my CashApp account and change all my pertinent information without ever being blocked or stopped. Someone would rarely change all their information on a CashApp account ( bear in mind, none of the information that was added to my account can be connected to me in anyway ), withdraw a large sum of money using an account that has never been associated with the CashApp account, and continue to make a series of transactions that are out of the norm of their usual purchases/transactions. But, this did not set off any alarm bells within CashApp 's systems for the entire weak that my account wasn't in my possession. After the first string of changes to my account ( email, phone, PIN, XXXX ), they could have locked the account until they were able to verify that the changes were being made by me. Even if those changes did not set off alarm bells, there was a second opportunity to freeze my account when someone tried connecting an external account that is not associated with me, then there was a third opportunity for them to freeze the account when I called personally to them to let them know my account had been hacked. They never blocked, restricted, or froze my account, allowing the scammer/hacker to use it and my money for an entire week. 

The CFPB report also states, " The companys investigations were woefully incomplete... XXXX also XXXX a range of tactics to suppress Cash App users from seeking help, reducing its own costs ''. In my situation, each time I reach out to CashApp support, they open a new claim/investigation into the same issue, despite my wishes. This allows them to skirt responsibility by always being able to say that my issue is being investigated. I filed a previous complaint with CFPB that was closed with an explanation from CashApp. Their explanation was that they were " still investigating '' my claim. This has also been a way to suppress my efforts of getting my money back. Even though they have admitted my account was not under my control from XX/XX/XXXX to XX/XX/XXXX, due to their negligence, they have not taken steps to return the funds that were lost, at no fault of my own, during that time. Also, these claims are not even being investigated properly. I have attached documentation that CashApp provided to support their claim that the {$1100.00} was authorized by myself or someone I knew. The document they provided is insufficient, confusing, and unclear. I will also attach a few examples of the many conflicting, repetitive, and inadequate responses I have received from them while trying to figure out how they think the transaction was authorized by me. Had they been investigating my claim properly, they would easily be able to provide solid evidence of their decisions. But, they have not provided solid evidence this whole time. 

My situation shows that CashApp has not taken any steps to address the security issues that plague their platform and they continue to use tactics to suppress and complicate the support process rather than actually resolving consumer concerns.