Consumer complaint received 2023-01-24
Company: TRUIST FINANCIAL CORPORATION
State: MD
Product: Money transfer, virtual currency, or money service
Sub-product: International money transfer
Issue: Fraud or scam

Complaint:
Consumer Financial Protection Bureau
P.O. Box 2900
Clinton, 
IA 52733-2900 TRUIST BANK  BREACH OF DUTY OF CARE
 	 	 	 
Dear Sir/Madam of the Consumer Financial Protection Bureau,  

Please take the time to read this information pack as it will explain the reason for my complaint to the Consumer Financial Protection Bureau. 

On XXXX XXXX XXXX, I fell victim to a multilayered scam operation orchestrated
by XXXX XXXX (the Scammer) and innocently lost XXXX  USD of my hard-earned life-savings.  I advised Truist Bank of this fact on XXXX XXXX XXXX and I havent received any satisfactory response so far.

Truist Bank had a duty to exercise reasonable professionalism, care, pay due to regards to the interest of their customers and follow good industry practices (GIP) to keep customers accounts safe. This includes identifying vulnerable consumers who may be particularly susceptible to scams and looking out for payments which might indicate the consumer is at risk of financial harm.   
 
Since XXXX XXXX, I have been attempting to resolve this matter with Truist Bank, but they have failed to settle this matter satisfactorily. I have been dealing with Truist Bank in good faith and am deeply disappointed in how they have handled this matter thus far.  
   
I find it baffling and reprehensible that my money has been so egregiously misused in a fashion that violates their principles, which call me to defend my rights. This is poorly thought out and vaguely defined nonsense. I doubt they care however since nonsense is what renders unscrupulous businesses financially successful. 
Accordingly, I respectfully insist that Truist Bank covers all overdrafts (560,000.00 USD) on the account. This is fair and reasonable given I was given no appropriate warning about the possibility of a scam. I have been a loyal customer of Truist Bank and have never had any difficulties of this kind before.

FURTHER POINTS FOR CONSIDERATION 

The examples of good and bad practices around investment fraud. Good practice included but was not limited to:
	A bank regularly assesses the risk to itself and its customers of losses from fraud, including investment fraud, in accordance with their established risk management framework. The risk assessment does not only cover situations where the bank could cover losses, but also where customers could lose and not be reimbursed by the bank. Resource allocation and mitigation measures are informed by this assessment.
	A bank contacts customers if it suspects a payment is being made to an investment fraudster.
	A bank has transaction monitoring rules designed to detect specific types of investment fraud. Investment fraud subject matter experts help set these rules.
	Real-time payment screening against a well-formulated watch list; transaction monitoring rules designed to detect specific types of investment fraud
	Banks actively contacting customers if suspect payments are identified
	Banks placing material on investment fraud on its website
	Work to detect and prevent investment fraud from being integrated with a banks vulnerable customers initiative

Taking into account the law, regulatory rules and guidance, relevant codes of practice and what should consider having been good industry practice at the time, Truist Bank should reasonably and reasonably consider:
	Have been monitoring accountsand any payments made or receivedto counter various risks, including anti-money-laundering, countering the financing of terrorism, and preventing fraud and scams;
	Have had systems in place to look out for unusual transactions or other signs that might indicate its customers were at risk of fraud (amongst other things). This is particularly so given the increase in sophisticated fraud and scams in recent years, which banks are generally more familiar with than the average customer; and
	In some circumstances, irrespective of the payment channel used, have taken additional steps, or made additional checks, before processed a payment, or in some cases declined to make a payment altogether, to help protect customers from the possibility of financial harm from fraud.

Despite the regulatory and statutory requirements Truist Bank shall abide by as a licensed and regulated financial institution, instead of detecting patterns, drawing certain conclusions, and taking actions accordingly, Truist Bank may have insufficiently performed some hasty and haphazard review of the transaction(s) regarding the suspicious activities, but it seems that rather than being careful, methodical, and vigilant, they took no notice of what was happening.

Please be noted that I will not in any way quietly tolerate the consequences of Truist Bank actions (or more precisely, the lack thereof). It is perfectly obvious that they could have, and should have, utilized various risk-based examination procedures and techniques, all of which are within their purview and could have entirely prevented this disastrous outcome.
As previously advised, they should have known, suspected, or had reason to suspect that the transactions (or pattern of transactions):
	involve funds the ultimate purpose of which was to fuel an illegal enterprise;
	is intended to disguise funds the ultimate purpose of which was to fuel an illegal enterprise, in an attempt to avoid and thus violate regulations;
	is intentionally designed to defraud your customer;
	serves no legitimate or lawful purpose; and
	involve the use of your services to facilitate criminal activity.

There are so many other ways in which measures related to fraud prevention and mitigation could have been useful. Further factors that should have been taken into consideration include, but are not limited to, the following:
	The timing, volume, frequency, and nature of the transactions in question;
	The abnormality of such transactions against the background of your experience with me as a customer and other entities associated with the transactions (if any);
	The suspicious nature of such transactions based on my overall risk profile including vulnerability and identification and research of high-risk services/products;
	Systemic filtering mechanisms, whether manual or automatic, for the identification of unusual activities; and
	Periodic evaluation of the usefulness, appropriateness and effectiveness of anti-fraud programs, and other associated policies and procedures.

Relevant industry practices at the time of the victimization:
Truist Bank is obliged to take some action if it is sufficiently aware of a real possibility that a fraud may be being perpetuated. If you don't question its customers instructions or raise the possibility of a scam with the customer in these circumstances, it may be liable if the red flags indicate the customer is:
	particularly vulnerable, or
	if the possibility of fraud was serious or real, not just suspected.

There are some recommendations to organizations for protecting customers from financial harm that might occur as a result of fraud or financial abuse; and gives guidance on how to recognize customers who might be at risk, how to assess the potential risks to the individual and how to take the necessary actions to prevent or minimize financial harm.
These recommendations are established as a general principle, the organization should deliver a service that:

1)	Takes a proactive approach to minimizing risks, impact and incidences of financial harm and it sets out systems and tools for the prevention and detection of fraud and financial abuse. As a general point, it says organizations should ensure that all systems are developed using technologies and methodologies that are effective in the prevention of fraud and financial abuse, through authorized and unauthorized payments, thereby minimizing the risk of financial harm to customers. As regards to the detection of fraud and financial abuse, it says the organization:

A) should have measures in place across all payment channels and products to detect suspicious transactions or activities that might indicate fraud or financial abuse. It then lists the following examples of suspicious activity on customer accounts:
a. multiple cheque books;
b. sudden increased spending;
c. transfers to other accounts;
d. multiple password attempts;
e. logins from new devices, multiple geographical locations;
f. sudden changes to the operation of the account; Unusual transactions are transactions whose amount, characteristics and frequency bear no relation to the economic activity of the customer, exceed normal market parameters or have no apparent legal justification.
g. a withdrawal or payment for a large amount;
h. a payment or series of payments to a new payee;
i. financial activity that matches a known method of fraud or financial abuse.

B) organizations should have a process in place to ensure that staff make contact with the customer to verify the financial activity, challenge its authenticity, explain the nature of the suspected or detected fraud and discuss an appropriate plan of action.

My true issue with the bank is their limited understanding of the kind of recall I was requesting to raise. The most common reason for a recall is where the account holder says the transaction was not authorised; a recall can also be claimed if the goods were not received or if the cardholder paid in another way (eg., with cash).

Whilst I am not denying the demand for the reason code, I am emphasizing to the bank that my case falls under a different reason code. Despite providing the bank with the required explanations of my case, Truist Bank preferred to stick with the authorisation issue which has never been raised by me which already shows the banks lack of understanding of how to treat my case.

Truist Bank could have done more at the time of the payment to warn me of the risks of scams
	Taking steps to educate their customers about scams.
	Taking steps to identify higher risk payments and customers who have a higher risk of becoming a victim of scams.
	Providing effective warnings to customers if the bank identifies a scam risk.
	Taking extra steps to protect customers who might be vulnerable to scams.
	Talking to customers about payments and even delaying or stopping payments where there are scam concerns.
	Acting quickly when a scam is reported to it.
	Taking steps to stop fraudsters from opening bank accounts.
Banks and other Payment Services Providers (PSPs) do have a duty to protect customers against the risk of financial loss due to fraud and/or to undertake due diligence on large transactions to guard against money laundering. In broad terms, the starting position at law is that a firm is expected to process payments and withdrawals that a customer authorises it to make, in accordance with the Payment Services Regulations and the terms and conditions of the customers account.
But, where the consumer made the payment as a consequence of the actions of a fraudster, it may sometimes be fair and reasonable for the bank to reimburse the consumer even though they authorised the payment.  
I think Truist Bank shouldve had enough knowledge of this type of scam at the time. Truist Bank could have protected me from this; unlike me, the bank knows about the existence of such scams and how you prey on vulnerable victims like myself, taking advantage of lack of knowledge, awareness, and circumstance. Despite the irregularities in my spending and such untypical patterns, not a single contact was made me question what I was doing. The treatment from Truist Bank is compounded by trauma and anxiety and has left me in the awful situation I now find myself in.
Although it was not Truist Bank that scammed me, they had many obligations to protect my Financial Interest - which they did not uphold if you take a quick look at the bank statements you will realise how the transactions were absolutely out of the usual pattern, there was suddenly increased spending, payments for considerably large amounts, series of payments to a new payee and of course financial activity that matched a known method of fraud or financial abuse.
All of the above points were not considered by Truist Bank when I was victimised, and no actions were taken to prevent that victimisation. Of course, I appreciate that they might want to act in good faith and uphold my requests to transfer these payments but the code sets out that organisations should have a process in place, to ensure that (i) staff make contact with the customer to verify the financial activity, (ii) challenge its authenticity, (iii) explain the nature of the suspected or detected fraud and (iv) discuss an appropriate plan of action. 
 
To further simplify the situation with respect to the nature of the transactions, there are circumstances, irrespective of the payment channel used, where a bank should take additional steps, or make additional checks, before processing a payment, or in some cases decline to make a payment altogether, to help protect customers from the possibility of financial harm. This is particularly so in light of the environment created by the increase in sophisticated fraud and scams in recent years - which banks are generally more familiar with than the average customer.
 
Kindly take into account that this case against Truist Bank is not primarily about the scam that happened. My main issue with Truist Bank is its unwillingness to raise a recall under the relevant reason code. It is obvious that they did not take any of my reasonings into account and blatantly focused on the authorisation argument that does not match my case and the issue of whether the transactions were fraudulent according to what is written on the paper. 

Anti-Money Laundering Requirements for Financial Institutions and Other Designated Businesses 

3.1 What financial institutions and other businesses are subject to anti-money laundering requirements? Describe which professional activities are subject to such requirements and the obligations of the financial institutions and other businesses. The following are subject to the requirement to maintain risk-based AML Programs: 

	Banks, including savings associations, trust companies, credit unions, branches and subsidiaries of foreign banks in the United States, and Edge corporations.
	Broker-dealers in securities.
	Mutual funds. Futures Commission Merchants and Introducing Brokers in Commodities. Money Services Businesses 3.4 What are the requirements for recordkeeping or reporting large currency transactions? When must reports be filed and at what thresholds?

Currency Transaction Reporting

Financial institutions (defined as financial institutions under the BSA regulations) must file CTRs with FinCEN on all transactions in (physical) currency in excess of XXXX  (or the foreign equivalent) conducted by, though, or to the financial institution, by or on behalf of the same person, on the same day. 31C.F.R.  1010.310315.
It is prohibited to structure transactions to cause a financial institution not to file a CTR or to file an inaccurate CTR by breaking down transactions into smaller amounts at one or more financial institutions over one or more days. 31 C.F.R.  1010.314.

Customer Due Diligence
Pursuant to regulatory requirements, which became effective May 11, 2018, as part of their AML Programs, certain financial institutions (banks, broker-dealers, mutual funds, FCMs and IB-Cs) must implement formal risk-based CDD programs that include certain minimum elements, including customer identification and verification (under a Customer Identification Program), obtaining information about the nature and purpose of a customers account, ongoing monitoring of customer accounts, obtaining beneficial ownership information at a 25% threshold
for legal entity customers and identifying a control person for legal entity customers (with certain exceptions).

There also is a specific BSA requirement to maintain CDD programs for non-U.S. persons private banking accounts and foreign correspondent accounts. The same covered financial institutions as for CDD programs (banks, broker-dealers, mutual funds, FCMs and IB-Cs) must maintain a CDD program for non-U.S. private banking accounts established on behalf of, or for the benefit of, a non-U.S. person and foreign correspondent customers and an enhanced due diligence (EDD) program for those relationships posing a higher risk. These programs must be designed to detect and report suspicious activity with certain minimum standards. These requirements are based on Section 312 of the PATRIOT Act and are often referred to as Section 312 requirements. 31 C.F.R.  1010.610 (due diligence for foreign correspondent accounts), 1010.620 (due diligence for private banking for non-U.S. persons).
3.9 What is the criteria for reporting suspicious activity?

Financial institutions and other businesses subject to the AML Program requirement (except Check Cashers, Operators of Credit Card Systems, and Dealers in Precious Metals, Precious Stones, or Jewels) are required to file SARs with FinCEN under the BSA (and for banks, under parallel requirements of their federal functional regulators). SARs are required where the filer knows, suspects, or has reason to suspect a transaction conducted or attempted by, at
or through the financial institution: 

	involves money laundering;
	is designed to evade any BSA regulation or requirement;
	has no business or apparent lawful purpose or is not the sort in which a particular customer would engage; or 
	involves the use of the financial institution to facilitate criminal activity or involves any known or suspected violation of federal criminal law. 
	See, e.g., 31 C.F.R.  1023.320(c) (SAR requirements for broker-dealers). Generally, the reporting threshold is XXXX or more. For banks, if the suspect is unknown, it is XXXX or more. For MSBs, generally, it is XXXX or more.

In XXXX XXXX the office of the Senator XXXX XXXX  issued a report called: Facilitating Fraud: How Consumers Defrauded on XXXX are Left High and Dry by the Banks that Created It. These are some of the most important statements mentioned in the report:
In XXXX XXXX, Senator XXXX opened an investigation to determine the extent of fraudulent activity on XXXX, and to understand how the company and the banks that own and operate it make consumers whole when they are defrauded on the platform. Senators XXXX XXXX XXXX XXXX  wrote to XXXX seeking information about the frequency of scams and fraud and the companys policies on redressing consumers who have been defrauded. 
The information provided by XXXX revealed that an estimated XXXX XXXX was lost by XXXX users through frauds and scams in 2021, but that the banks that participate in the network appear not to have provided sufficient recourse to their customers. In particular, XXXX response indicated that XXXX  facilitates fraudulent activity of many kinds That includes activity in which a users account is accessed by a bad actor and used to transfer a payment  often called unauthorized transactions  and activity in which a user is fraudulently induced into transferring a payment to a bad actor  often referred to by XXXX and XXXX-participant banks as authorized transactions.
Senators XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX then sent letters to the seven big banks that own and operate XXXX parent company to determine the extent of the problems with illegal and fraudulent activity, and to determine how banks were helping consumers who lost money on the platform.
At nearly every turn, most of the big banks have stonewalled, refusing to provide the information requested by members of Congress. However, Senators XXXX XXXX XXXX finally obtained commitments from several of the banks CEOs that they would provide the information on XXXX to Congress during a Committee on Banking, Housing, and Urban Affairs hearing on XXXX XXXX XXXX
Overall, the three banks that provided complete data sets  XXXX XXXX XXXX XXXX, and Truist  reported 35,848 cases of scams, involving over XXXX  million of payments in XXXX  and the first half of XXXX. In the vast majority of these cases, the banks did not repay the customers that reported being scammed. Overall these three banks reported repaying customers in only 3,473 cases (representing nearly 10% of scam claims) and repaid only XXXX XXXX  (representing 11.2% of payments).
The findings of this report reveal that fraud and theft on XXXX are widespread and growing, with consumers losing XXXX  each year. The banks that own and profit from the platform are failing to make their customers whole for both authorized and unauthorized fraudulent transactions, while refusing to release information publicly or to their customers that could help keep all consumers safe. Given this uncertain landscape and the banks abdication of responsibility, regulatory clarity is needed to further protect XXXX  users.
The CFPB has regulatory authority over peer-to-peer platforms including XXXX, and is reportedly considering issuing guidance to push banks to cover more fraudulently induced transactions, a move that would greatly improve consumer protections on peer-to-peer platforms like XXXX The agency should act to clarify and strengthen Regulation E and include fraud in the Regulations error resolution purview, increasing the responsibility of banks to keep XXXX safe and to ensure that consumers will be protected. The banks that created and profit off of XXXX should be pushed to protect their consumers from bad actors on their platform, and regulators should step in to ensure a fair and consistent process for everyone.
From the report issued by the office of Senator XXXX XXXX, it is clear that the banks dont treat scam victims fairly, only 10% of scam victims get a compensation from the bank, while others just left suffering. Even more, banks keep getting their profit, while more and more people keep being scammed, hacked, simply saying, losing their hard-earned funds.
As it is mentioned in the report, such organizations as CFPB should issue a guidance in which it will be written how step-by step, financial institutions need to check each and every transaction that looks suspicious, especially those which are sent to a new payee (e.g., cryptocurrency platforms). In case if the financial institution doesnt follow these rules and their customer is scammed, it shouldnt be blamed only as a victims guilt. Financial institutions need to take their responsibility as well and provide their customer with a decent compensation.

Desired outcome: Truist Bank has to put things into the right perspective for me by reversing the total amount of XXXX  USD paid to scammers as I have suffered a great loss because of this fraud, it had affected me personally, emotionally and financially. 


Yours sincerely, 

XXXX XXXX

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation