Consumer complaint received 2021-12-07
Company: FIFTH THIRD FINANCIAL CORPORATION
State: TN
Product: Checking or savings account
Sub-product: Checking account
Issue: Managing an account
Sub-issue: Deposits and withdrawals

Complaint:
Date : XX/XX/2021 To : 5/3rd Bank Office of the President XXXX XXXX XXXX XXXX XXXXXXXX XXXX XXXX XXXX, Ohio XXXX XXXX : XXXX XXXX XXXX XXXX Permissions granted I give ( CFPB ) full autonomy to forward a redacted copy ( minus all proper names ) of this redacted letter and redacted case on file to any all claimants that would be assessing damages, or prosecuting criminals against or at 5/3rd bank respectively. 

On this note, if at any time within the next statutory 7-year period, a claimant or regulating body could find this testimony, relevant or useful to establish a pattern of intentionally unaddressed security issues, of any kind, at 5/3rd Bank, then I will be happy to testify on their behalf and without compensation. 

My objective with this complaint It is objective to bring to the proper authorities within the Consumer Financial Protection Bureau a complete narrative of my experience with 5/3rd bank. I will try to capture the entire experience here in this comprehensive narrative so that any additional violations that I may fail to address can be revealed to investigators who could take corrective action. It is my feeling that there is a host of backend server and security related non-compliancy issues stemming from 5/3rd banks corporate oversight and management. 

Where there is smoke.. 
I can only relay the events as they occurred and happened to me so as to help those people within the federal government who might recognize a dangerous pattern of non-compliance that could jeopardize account security and access of funds of all of 5/3rds trusting customers and not just myself. 
This final narrative of events regarding compromised internal security measures that ultimately allowed actions to be conducted on my ATM debit card and my associated checking account that are inconsistent with financial account security protocols set f orth by federal regulations. There is evidence of cross-departmental involvement that stems from the sheer absence of automatic alerts and notifications that should have arrived to me in some way, from those various departments upon my cards deactivation, but did not.

Section 47-4-402 of the Uniform Commercial Per section 47-4-402 of the Tennessee adoption of the federal Uniform Commercial Code, language has originally been intended for valid written physical paper checks that have been mistakenly or willfully dishonored by financial institutions that should have paid funds on those cashed checks but instead denied paying funds that were readily available. 

Relevant parts of this section that could easily bed subject to reinterpretation go as follows : 47-4-402 ( a ) Except as otherwise provided in this chapter, a payor bank wrongfully dishonors an item if it dishonors an item that is properly payable, but a bank may dishonor an item that would create an overdraft unless it has agreed to pay the overdraft. 

( b ) A payor bank is liable to its customer for damages proximately caused by the wrongful dishonor of an item. Liability is limited to actual damages proved and may include damages for an arrest or prosecution of the customer or other consequential damages. Whether any consequential damages are proximately caused by the wrongful dishonor is a question of fact to be determined in each case. 

Relevant case law XXXX XXXX XXXXXXXX My experience with 5/3rd bank ( chronologically ) : Supporting arguments for grounds for federally required independent Information Technology Compliance Audit at 5/3rd bank . 

i. Experienced chronic password username retrieval issues with the mobile application Apparently 5/3 had been having a chronic, ongoing, malfunctioning, backend server problem with its User Id retrieval and password reset process. I experienced this issue from the start of my account. 

When trying to retrieve my user Id, this malfunctioning backend system software would inform me that it had successfully found my user ID, after filling out a lengthy form, and that I just needed to log in with that user Id, that I dont have yet, to retrieve it. This ridiculous backend system error never was corrected. 

After 3 attempts to retrieve the User Id Wednesday night on my phone, it then either silently frozen the checking account, or locked the card and froze the account from any and all subsequent usability. Nevertheless, no notice was ever sent to me when it did this. In fact, I would find out the hard way, at midnight on the following Wednesday night ( XX/XX/2021 ) when I was stranded at a XXXX XXXX  rental lot while trying to load my locked 5/3rd bank ATM card into the XXXX and XXXX apps to get a ride home, but could not. 



ii. Experienced serious backend meta data Zip Code issues 5/3rd bank also maybe has backend meta data inconsistencies associated with its account holders profile data and associated ATM cards. As I kept trying to get an XXXX and XXXX ride home from the XXXXXXXX XXXX  XXXX dealership, Wednesday night at XXXX, about 5 weeks ago, both XXXX and XXXX XXXX were unable to load my 5/3rd card due to inability to accept my zip code of XXXX that has been on file with my account since opening around XXXX. 



iii. Experience lack of customer support in a situation that 5/3rd bank deliberately caused There was no reliable night or weekend phone support at all to call and resolve this. Could not reach any support the night that my card became locked. 




The following 1, 2 and 3 events by themselves do not constitute malfeasance or even cause for inquiry, they simply run off customers. Coupled with next mentioned events though they are beginnings of an in-series blockchain of evidence that validates a burden of proof of corporate-wide, non-compliance with federal safety regulations pertaining financial security measures that all financial institutions must have in place, and continuously comply with.. 

[ Event 1 ] : Was never contacted before or after the initial card lock My card is locked sometime late Wednesday night or early Thursday morning with no notice given ( XX/XX/2021 ). 5/3rd also fails to communicate to the affected ( me in this case ) of this automated locking action and leaves me stranded and unable to access direly needed funds to get home. In my case, I was at a XXXXXXXX XXXX XXXX dealership at midnight with no way to pay for a XXXX or XXXX driver. I could not load either a frozen card or a card whose zip code has been miscoded on 5/3rd bank 's poorly maintained backend user account systems. 

So by no fault of my own, at this point, I have a no-notice lock placed on my card due to either : A ) The atm card being rendered unusable because of internal backend server issues that 5/3rd bank has created with my zip code, or..

B ) rendered unusable because 5/3rd bank has locked me out due to all the attempts to access my account and retrieve my User Id with 5/3rd bank 's broken user-id and pw retrieval system or..

C ) a combination of Both A ) and B ) at the same time because of 5/3rds general big- bloated-bank culture of visibly observable lax-ness everywhere throughout the entire customer experience.

[ Event 2 ] : Branch manager disconnects our phone call deliberately leaving my locked debit card in locke
d status after previously unlocking my online account, retrieving the username, and discussing the issue of not being contacted prior to, during, or after the lock ( XX/XX/XXXX ) The following day ( Friday ), I called into the XXXX XXXX XXXX XXXX XXXX Tennessee branch to have a discussion with branch manager XXXX XXXX about being locked out of my account online and about the ATM card that would not work at the XXXX dealership XXXX which I could only concur at that time were one and the same. We finally unlock the account and retrieved my username that the broken username retrieval process in the 5/3rd application could not do. Then after finally logging back in to see my funds, we then began to discuss the inconvenience that the locked ATM card had caused me. Branch manager XXXX, tells me that 3 illegal attempts that had caused the lock. He then tells me he doesn't know why I was not contacted when my card was locked and doesn't have a means for me to talk to any individuals anywhere at the bank to ascertain what specifically prompted the hold on the card, and most importantly why I was never notified when the hold was placed. 

Recapping branch manager XXXX XXXX then hangs up the phone abruptly. His disconnection happens after we have : A ) just unlocked my online account and finally retrieved the user Id that the password retrieval process was unable to do. 
And. 

B ) Then had a 10-minute discussion about the locked ATM card, wherein I have pleaded with him tell me why I can not be at least transferred to someone to give me more insight as to what specifically prompted the lock on my card. 

At this point, Im under the impression, that because we have finally that he has at least gone ahead and unlocked the ATM card as well, but he has deliberately not. 

I HAVE NO REASON TO BELIEVE THAT MY CARD IS STILL IN A LOCKED STATUS. 

I DO HAVE EVERY REASON TO BELIEVE THE CARD IS UNLOCKED BECAUSE a. WE RETRIEVED A USERNAME, b. UNLOCKED MY ONLINE ACCOUNT, c. JUST TALKED ABOUT DISCUSSING GETTING TO SOMEONE INTERNALLY at 5/3rd TO FIND OUT WHY I WAS NOT NOTIFIED ABOUT IT FOR 10 MINUTES.

And it is at this point, after discussing this on the phone for 10 minutes, that he chooses to just disconnect the call. Branch manager XXXX XXXX never calls me back to inform me that I still need to unlock my card, nor does he fulfill his duties as Manager to unlock the card by : A ) either filling out ticket to initialize the process that would reach out to notify relevant parties to do so, if he can not unlock the card himself, Or..

B ) just unlock the card himself from his workstation while the screen on his computer is still indicating my cards locked status. 

He rather disconnects the call, goes about his marry way as a counterproductive, problem causer, who is supposed to be resolving issues like these, but deliberately does not. 

[ Event 3 ] : My card then is mysteriously deactivated on the Friday night of ( XX/XX/2021 ) after having discussed its locked status with XXXX branch manager XXXX XXXX earlier that day. 

That night, I go out to celebrate my new job. 

I had just recovered from a XXXX XXXX XXXX XXXX XXXX. 

And just returned a rented moving truck and moved into an apartment in XXXX with almost no energy while still recovering. 

Had then become stranded at a XXXX dealership when I returned the truck, and was unable to unlock the defective 5/3rd ATM card because by bank had no night time customer service to unlock the card. 

B ) Had even called into the branch the next day though and seemingly resolved the issue, and thought that I did.

Was even disconnected during the phone call by that branch manager, but at least I was able to get back into my account and was now under the assumption that all the issues were resolved after discussing them with that branch manager for 10 minutes.

Then went to a restaurant with some family. Carrying now my seemingly unlocked ATM 5/3rd card, as an only means of payment for the dining experience. Ran up a sizable tab. Then as we are getting finished with dinner, the waiter comes back to tell me that he tried to run my card, but that it has been unfortunately " declined 3 times in a row ''. I have turn to my invited guests to pay for the entire dinner. 

Next morning, I am at the XXXX XXXX XXXX branch, and I'm there 30 minutes early! I'm the first one in the building when door opens! My focus is to find out why my card is still in locked status, just after I have had a lengthy discussion with the branch manager, Mr. branch manager XXXX XXXX a day before. I decide not to talk to branch manager XXXX XXXX first, instead I want to gather intel on this continuing situation, so I go to another associate with some hopes of maybe also straightening all this out but only after I got a full explanation. And I am expecting to have a conversation about compensation for my inconvenience. 

She now tells me that my card is not just locked, but that somehow it has now been deactivated. 

It takes 20 minutes and multiple demands for me to speak to the general manager, who I was beginning to suspect was most likely responsible for this latest surprise. When I am finally invited into his office to get my answers he admits to me ( and others standing there ), that he actually did disconnect the phone the day before when we spoke about the locked card and did so knowing full well that my ATM debit card was still in a locked status. 

He even admits and acknowledges that our discussion had been at that time about my dissatisfaction with : A ) my ATM card becoming locked and its associated inconvenience, B ) not being notified beforehand, or at least shortly thereafter when my ATM card was locked, C ) and also, with not being able to discuss with anyone other than him at 5/3rd about A ) and B ) from above as to why my ATM card was locked. 

These are all admitted acknowledgements that I have brought to his attention the day before about my ATM card being locked and that I am bringing to his attention that I need fixed right then as we were speaking on the phone. I was trying to tell this Branch manager on the phone that I want to talk to a badged 5/3rd employee about this matter and not some outsourced 3rd party in a foreign country who just reads off a general, unspecific copy/pasted script, but I did not get the chance before being disconnected. 

Keep in mind an ATM card deactivation is very different than the card being placed on locked status. 
* An ATM card lock happens all the time with backend security automation, and they are usually but not always accompanied with automatic texts and calls notifying the affected ATM card holder ( which did not happen ), but they are ... NOT ... ATM card deactivation. 

* An ATM card deactivation is entirely a different thing. Deactivations involve much separate set of protocols and s.o.p.s. and is never allowed to be automated by software in any banking institution per adopted federal and state guidelines. These guidelines pertain to required communication with the card holder prior too or just after a deactivation. 

Now we have the 2 isolated events 1 and 3 that should not normally happen in succession and certainly not as a sequentially chained automation process [ Event 1 ] [ Event 2 ] [ Event 3 ].

These three events do not yet suggest strongly that something is amiss with backend security processes but are the precursor for general cause for concern for upcoming successive evidence exhibits. 

[ Exhibit A ] : No alerts are ever dispatched to me my phone about my ATM debit cards deactivation. 
I was never notified either for the lock that was placed on my ATM the 2 days prior too and most importantly after the cards deactivation. In fact, it was not until ( XX/XX/2021 ) inside the XXXX XXXX XXXX, when I found out was not only locked, but now deactivated. 

[ Event 1 ] [ Event 2 ] [ Event 3 ] [ Exhibit A ] [ Exhibit A ] has its own autonomous processes. It generally is initialized with a call from a call center, or many times can often precede a manual deactivation [ Event 2 ] by the person who manually deactivates the card but make no mistake [ Exhibit A ] can never be deliberately skipped all together and an institution that skipped this process would be in violation of Federal guidelines if it was.

I was never notified, by any means, when the card went to deactivated status, [ Event 2 ], on Friday night ( XX/XX/2021 ). Those federally required automatic notifications, require all banking institutions to immediately contact the effected account holder by 2 of 3 means. The automated notification process that is normally triggered immediately by a card deactivation did not occur. 

The mere absence of these mandatory alerts and notifications suggests some kind manual override has taken place by someone who would have had those executive privileges to do so. These three events together suggest possibly someone internal to 5/3rd backend security, most likely someone manually disabled those automatic alerts that would have informed me of my cards deactivated status. The system that automatically dispatches those notifications, if left alone, would have been sent immediately and automatically to my phone upon my cards deactivation, but were not. 

[ Exhibit B ] : Evidence that the ATM card automatic re-issuance system was disabled. 
This system should have dispatched a new card immediately and automatically as well upon my card deactivation but did not.

Now we have isolated events : [ Event 1 ] [ Event 2 ] [ Exhibit A ] [ Exhibit B ] Neither did this notification process contact me to confirm a correct mailing address, nor was I was never mailed a new card automatically by the backend automatic ATM debit card reissuance process.

So, whoever deactivated my ATM card [ Event 2 ] also went a step farther with disabling notifications and [ Exhibit A ] then went a step farther with [ Exhibit B ] manually disabling 5/3rd banks internal processes to reissue a new card. What these actor ( s ) dont realize is that this potentially jeopardized my life, and not just my inability to pay for something like a restaurant meal.

Banking institutions reserve the right to manually deactivate any clients ATM cards that they deem necessary, and as much, and as often as they deem necessaryas long as they meet one federally mandated requirement.

What banking institutions do not reserve a right to do, is deactivate a persons ATM card, and then also disable the means of notifying that affected cardholder about it as well. When this happens, then there is evidence of critical security violations ( not just one ) have occurred either at once or in tandem and are just cause for further inquiries be made by regulating authorities to assess the danger that these infractions may have to users. In many cases an automatically dialed person to person phone call is made prior too or in real time to the affected card holder before deactivation ever occurs if not a direct phone call from the G.M. 

How did my 5/3rd ATM card get deactivated with no disclosure? 

[ Exhibit C ] : XXXX XXXX branch manager XXXX XXXX manually issues a new card, the next day, on behalf of the disabled ATM card automatic re-issuance system mentioned above. 
[ Exhibit C ] even occurs, the next day when I go into the XXXX XXXX branch and branch manager XXXX XXXX says, let me go ahead and send a card out to you now. 

Now we have isolated events : [ Event 1 ] [ Event 2 ] [ Exhibit A ] [ Exhibit B ] [ Exhibit C ] This is significant because branch manager XXXX XXXX is now manually doing what should have already been done automatically by an autonomous process but did not. 

All these events and exhibits suggests at a very minimum that 5/3rd bank has such lax internal security measures that it could allow in some manner a clients card to become locked, then deactivated and without notice. Is this repeatable on a massive scale?

Sleepy unconcerned District Manager on the phone.

When I brought all of this to a district managers attention a couple days later, who is over branch manager XXXX XXXX, he literally fell asleep on the phone, while I was talking to him. When he called me back generically apologizing for my overall bad experience ... he could not recall what I said in particular when I questioned him about the things I had been discussing when his phone went silent for 30 plus seconds.

 Multiple disconnects by XXXX. supervisors who would not transfer to the presidents office. 
Attempted to get the president office phone number to convey this whole experience for over 20 plus different calls amounting to 5 hours total of phone time and was disconnected by a supervisor each time. I had to wait to get to each one of those supervisors for over 25 minutes each time. Was finally able to hack my way in through a mortgage sales line phone number and talk to a XXXX salesperson, who was actually very helpful and even demonstrated concerned with my experience at 5/3rd.

Experienced the worst of all customer service when I spoke to XXXX with my second call back into the 5/3rds Presidents office. 
Then after originally speaking to XXXX, who was also helpful, I spoke to another rep, XXXX, in what was supposed to be just a quick call back to the presidents office to just confirm a few questions about fees. XXXX appeared to be uninterested, callous, and deliberately unhelpful. I asked politely to be transferred back to XXXX, where I could pick up where I left off with XXXX and was told by XXXX that she will be taking over my case. Then XXXX with the same insincere, mono-tone told me that I would be also incurring additional fees to my 5/3rd account as well to the ones that I had already picked up from other severed auto-billing relationships due to the cards deactivation. 


Accrued fees as a result of the unnecessary deactivation Fees accrued at my apartment complex where I tried to pay a bill and assessed a {$6.00} fee and then, and a fee with the city of XXXX XXXX XXXXt where my account assessed {$35.00}. Comes to a current total of XXXX. There may be more fees. 


5/3rd Corporate Security Officer who calls me on the phone and tells me he is closing the account My account was closed by Corporate Security Officer who called me out of the blue and was not remotely concerned with hearing about any of the security concerns. He became interruptive on the call and then hung up the phone and closed the account. 



Good questions that the CPFB could pose to 5/3rd bank might be..

1. How do locked cards pose less of a threat to the customer such that an additional security measure such as a deactivation need to be taken if it remains unaffected in locked status?

2. Were the usual alert notifications that would have notified the affected card holder manually, ( or willfully ) disabled somehow in some subtle, or not so subtle, way by 5/3rd employees with executive privileges to do so.

3. If a locked card was never supposed to go to deactivated status then how was it this one- time event?

Put another way..

If 5/3rds legal team just copies and paste an explanation as a response to the CFPB ( or.. some future civil or criminal prosecution team that will be using this narrative as supplemental evidence of a pattern of negligence due to non-compliance ), then how is there not a potential pattern hazardous reoccurring repeatable issues at least addressed here?

4. Have the concerns for account and card holder safety and notifications within the ATM card deactivation process brought forth in this complaint mostly fallen on deaf corporate ears? Or can they show proof of demonstrate measures taken to prevent no-notification deactivations from ever occurring to its customers again. 




Sincerely,

Company response to consumer: Closed with explanation