Consumer complaint received 2017-08-03
Company: CAPITAL ONE FINANCIAL CORPORATION
State: MN
Product: Credit card or prepaid card
Sub-product: Store credit card
Issue: Problem when making payments
Sub-issue: Problem during payment process

Complaint:
Capital One N.A. manages the credit card for Menards Home Improvement Store. My card of 17+ yrs was PIF until I used it in XX/XX/XXXX/XXXX XXXX 2017 to purchase items for painting. Approximate total {$220.00}. Subsequently, 1/3 of the unused items were returned in XX/XX/XXXX for about {$70.00}. My ebill/estatement arrived in email on XXXX XXXX 2017. A few days later ( XXXX XXXX 2017 ), I 1st tried to login to make a payment using my stored/known username & password. Oddly, the system required me to login multiple times - FLAG!! This is what a false site will do when trying to steal your credentials, so I closed the window immediately. Later, on a different device, I attempted to access the credit card directly from the store 's own site ; not failsafe, but fewer fraud events than a emailed link. Still an odd/unusual return : " We will send you a new authentication number. '' Immediately " we are unable to send you authentication numbers, please call us at XXXX. '' But not open at night. I attempted repeatedly and the system ACCEPTED MY USERNAME AND PASSWORD but then stopped, telling me I needed " authentication. '' Finally I got in touch with what must be the dumbest bunch of " security consultants '' on earth. " We 've sent EVERY CUSTOMER A NEW PIN VIA EMAIL '' Oh dear Lord. My assessment of dumbest bunch was smack on the nail head!! Sending credentials thru email TO EVERYONE?!!? Are they mad or just criminally stupid with other people 's money?!? " With XXXX, their security protocols prevent us from sending any codes this way '' Thank you, XXXX!!! " So for the meantime, you 've got no access to your account online but you can make a payment via phone. '' Excuse me??! " You can give us another credit card or all of your banking details via phone, and we 'll process a payment for you. '' ... So you 've made it so I 1. Have no access to my account in ANY WAY except though another human being 2. I can only make a payment thru the LEAST SECURE METHOD POSSIBLE, by making either my CHECKING ACCOUNT INSECURE or another credit card insecure.
3. And if I do n't make my banking information insecure by putting it out over the air to you & God & everyone with a decent police scanner, you will charge me a late fee and report me to the credit bureaus?!!?
Are you NUTS?!!!? They have refused to send me a statement & to allow me to pay via check ( would n't even give me the mailing address when I called in on unidentified lines! ) - " you are a paperless statement, so you ca n't now get a statement and we 're not set up to receive additional payments for all if the XXXX users that do n't want to pay online. '' My reading of the law & credit regulations is such that if the creditor a bridges my ability to access my account, he ca n't charge interest, a late fee, or report to credit bureaus until he has restored to me full, unrestricted access to my account. That is where this stands. As a security professional, I 'm not going to do anything so insane or inane as to give credit or banking information over a open phone line ( nor should you or anyone else unless on a VPN, and still only when alone ). That the actions of the company have made the portfolio insecure goes without saying. I am sick with concern and anger that they 'd PAY someone for advice that a senior in high school knows is total unadulterated crap. Violates every security principle for portfolio account security : never send credentials through the same medium ; never send them enmasse, never do all accounts at the same time EVER. And now I hear Capital One has done this on ALL consumer credit managed accounts!!

Company response to consumer: Closed with explanation