Product: Credit card

In XX/XX/year> my Chase online banking was compromised. I learned that the identity thief answered my security questions over the phone and gained access to my online banking. This includes 2 business credit cards, 1 personal credit card, and 1 business checking account. 

I first noticed strange activity with my account when I received a couple letters in the mail explaining that payments made to my credit card account were returned. They were for very large amounts from a checking account that I did not recognize. I thought maybe it was a misunderstanding. My credit card account has auto pay set up and is paid in full every month. Once I logged into my online banking I noticed that my thousands of dollars in rewards were gone. That was the first thing that caught my attention. I reviewed my transactions and saw that there were very large overpayments made to my account from checking accounts that were not mine, shortly followed by " XXXX XXXX XXXX '' charges ( yes, they are charges to my credit card bill. Do not let the term " refund '' fool you ). After calling Chase Bank and they explained that my account was compromised and they replaced my stolen rewards points I have been unable to be refunded for the " XXXX XXXX Refunds ''. Please let me explain below what the scheme is that they ran and how I am the one on the hook for these. 

The scheme worked like this : If my credit card account had a balance of {$5000.00} that I currently owed, the identity thief would make a payment of {$8000.00} from XXXX of the checking accounts that they linked to my online banking account. This would result in a {$3000.00} over payment and would make my account balance - {$3000.00}. They would then contact Chase Bank requesting a credit balance refund to be sent to their account ( which Chase would do ). Then within a few days that {$8000.00} payment they made would be returned to my account due to insufficient funds and now my account balance would be {$8000.00} instead of {$5000.00} it originally was and should have been. Because Chase Bank sent the money to the Identity Thief and not me, I had to pay for the credit balance refund sent to the scammer on my credit card statement. If I had received the credit balance refunds like how it is supposed to be, then it would even/zero out. That is however not the case. 

I am currently out a total of {$10000.00} due to this scam, and have been unable to get the money back from Chase. Every time I call I am on the phone for 1-3 hours getting transferred to multiple agents. I usually have to talk to 5-6 agents before I get one who understands the situation. I had a local branch XXXX spend hours trying to help me get my money back on this issue. Every single time we thought we were getting somewhere it would hit a dead end. There were 2-3 occasions someone said that they would be mailing me a check or send an electronic transfer to me for the amounts taken from me by the identity thief, and each time nothing would happen. On one occasion I got a letter from Chase saying they already paid the credit balance refund. They are correct, they paid the identity thief NOT me. I am a victim of identity theft and Chase has failed to protect me or make me whole again. Myself, the local Chase Bank branch XXXX, and countless Chase phone representatives have now spent probably close to 40 hours or more on this case and it is still unresolved.

This whole situation makes me question the security and integrity at Chase Bank. The fact that someone could so easily gain access to my online banking, and could have had me on the hook for an infinite amount of money and there is NOTHING that I can do about it is scary. It doe not matter how much money you have, this could happen to ANYONE that simply has a credit card. It is a simple yet sophisticated scam because the thief didn't simply transfer money from one account to another. They created money by abusing a glitch in the system that allows them to request a credit balance refund for an illegitimate credit card payment that they know will be returned due to insufficient funds and the victim will be left paying for that credit balance refund that Chase sends them. This scheme could bankrupt someone and Chase has done nothing about it. The scammer could have taken {$100000.00} as easily as they took {$10000.00}. All they have to do is make larger overpayments on someones account as frequently as they want if they have access and request a credit balance refund to be sent to them before the payment is returned for insufficient funds. It is truly an infinite money hack that leaves the consumer/victim on the hook for these large credit balance refunds that Chase is sending to the identity thief. If these credit balance refunds were sent to the consumer/victim as INTENDED there would be no issue. It would all balance out. However, Chase sends the money to the scammer and the consumer/victim is left paying for it on their credit card statement. I hope Chase Bank addresses this issue and makes changes to their security regarding how/where/who they send credit balance refunds to so that it isn't so easy for a scammer to take advantage of this and leave Chase 's consumers/victims with a HUGE bill. 

Here are a list of each event of the credit balance refunds that Chase sent to the scammer and left me liable for. 

Card Ending in XXXX : XX/XX/year> {$3500.00} XX/XX/year> {$4700.00} Card Ending XXXX : XX/XX/year> {$1500.00} XX/XX/year> {$1000.00} Grand total : {$10000.00} I would include a couple documents that I have regarding the case, but there is probably too much personal information on them to submit on here at this time. 

Thank you.