Consumer complaint received 2021-07-22
Company: U.S. BANCORP
State: PA
Product: Credit card or prepaid card
Sub-product: Government benefit card
Issue: Problem getting a card or closing an account
Sub-issue: Trouble getting a working replacement card

Complaint:
US Bank allowed my PA Unemployment Reliacard to be compromised. A US Bank representative allowed an individual to call into their service and request that the email address attached to my account be changed. I was informed by a second individual at US Bank that this is against their policy and that a written request or a fax request must be used to change an email address. 
This individual had US Bank change my account email address to their own. Then this person proceeded to the US Bank Reliacard website and clicked on " forgot username ''. My account username was then emailed to this person. The person then clicked on " forgot password '' and had my account password reset. 
The individual then went into my account and changed the bank routing number and account number then proceeded to withdraw {$1000.00}. Then this individual changed the bank routing number and account number again and withdrew another {$1000.00}. 
US Bank 's security system failed to detect all these suspicious behaviors. This was all done within a short period of time. The two large withdraws were made within 2 minutes. 

US Bank had previous shut off my Reliacard because their system detected a potential fraudulent attempt to use my card number at a restaurant in Florida. US Bank did not close the account and assign me a new card. Instead they just reactivated my existing card. The account was obviously compromised but they did not close the account. 

It seems strange that their system would detect such a small fraudulent restaurant purchase but would NOT detect fraudulent activity when the email address was changed, the website username was requested, the website password was requested, the bank account information was changed twice within 2 minutes and 2 {$1000.00} withdraws were made within 2 minutes. US Bank already had a class-action lawsuit settled against them in California for their lack of security measures such as a chip embedded in their cards. 

I have requested a new card twice and have not received a replacement card yet. It's been over a month and I can not access the money that is left on my account. I no longer have website access to the account. I can't pay any of my bills without the money in this account. I have called US Bank at least 6 times and got nowhere with them. 

I also filed a local police report. However, US Bank refuses to give me the person 's email address that he/she used when changing my account. This information alone would allow legal authorities to try to track this person down. I was given an absolutely ridiculous response that since I do not know the email address that was used, it would be a security breach if they gave that information to me. They were concerned about security when they allowed someone to change my email address without properly verifying whether the individual was the true owner of the account.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation