Consumer complaint received 2021-07-09
Company: KEYCORP
State: NY
Product: Mortgage
Sub-product: Conventional home mortgage
Issue: Applying for a mortgage or refinancing an existing mortgage

Complaint:
Dear Consumer Financial Protection Bureau, I am writing to seek this email to obtain your assistance regarding the matter of a major financial investment theft and identity fraud that occurred to me while dealing with Key Bank loan servicing department. 

I became a victim of a major financial fraud due to XXXX XXXX XXXX on XX/XX/2021. We had closed on our new home on XX/XX/2021 and we were moving to our new house on XXXX XX/XX/2021. While I was driving to my new home address, I lost my cellular service around approximately between XXXX to XXXX XXXX on XX/XX/2021. When my cellular service did not return on my cell phone for some time, I tried using cellular carrier XXXX  and they told me that they could not locate my original sim on their network. I then drove to the nearest XXXXXXXX store located near XXXX location where I was provided a new XXXX sim card approximately around XXXX XXXX. 
Later that night, I could not access my primary email account. I also could not access my XXXX and XXXX crypto investment accounts. I found that my XXXX account balance was completely wiped out on which I had originally invested around XXXX . Also, my XXXX XXXX XXXX account which was attached to XXXX and XXXX suffered unauthorized transactions while the scammer tried to steal XXXX funds from my XXXX account for buying more crypto, however those transactions were thankfully suspended in a timely manner by XXXX account under their fraud protection insurance and my account was suspended at my request for any transactions due to fraudulent activity. 

Later that day on XX/XX/2021, I was able to recover some emails from my deleted folder of my email account ( once I got the access back of the email account by resetting password with a request code sent to my cell phone number ), I learnt that my email password was reset on XXXX XXXX at XX/XX/2021 using my attached cell phone number. XXXX and XXXX passwords were reset on retrospective investigation on XXXX XXXX and XXXX XXXX respectively ( found some emails on my deleted box folder of my email ) which was immediately after the change of my email password. 
After further investigation, the drop of cellular network was just not a coincidence, it was a very well planned event and I became the victim of a Sim Swap attack. My Sim number was swapped and assigned to someone else. The Sim swap attack from cellular carrier service and hence cryptotheft becomes only easily possible if someone has personal identifiable data about the victim and the exact knowledge about crypto holding accounts with the associated email and phone account information. The timing of the event is very peculiar in my case. It happened right after our closing and on the very day of our move to our new home, like someone was very aware of my move plans and monitoring our activity. I have been the email owner of my email account for 20+ years, have owned the same phone number for 12+ years and also held these crypto accounts for 3 years without ever experiencing any problem with these accounts. The only thing different that I did recently that I had applied for a bank loan with Key Bank and was required to provide all my personal sensitive information including my full contact info, emails, phone number, DOB, SSN, Income tax returns, bank statements, proof of funds specifically including crypto holdings. Although I had been very skeptical about giving my particular Crypto details since the usernames of crypto accounts and associated XXXX XXXX are very sensitive piece of information. I was particularly asked by my loan officer Ms. XXXX XXXX for these details. Even though I initially gave her limited snapshots of my accounts, she specifically asked me to provide further details including my Userid illustration on all these accounts including my identifiable XXXX XXXX to the accounts. I had informed her that these are particularly very sensitive details which we as crypto users are advised not to share with anyone. She further insisted by saying, If I would wear the hat of an underwriter, I would not approve the loan without having the actual knowledge of these details as I would like to definitely ensure that you own these accounts and thus you should provide these details for the loan approval. Thus, she insisted that I provide my user id ( without asterisks ), crypto holding details with amounts of dollars and cryptos held, last coinbase and XXXX  crypto holding statement and XXXX XXXX XXXX report which included XXXX XXXX of my crypto accounts along with an explanation letter addressed to the Underwriter of the loan. I had specifically advised Ms. XXXX on our phone conversation that all this information must be dealt with ultra-care and she assured me that it will be kept confidential. I had no reason to doubt her as I thought I was dealing with a major reputable bank. The timing of the fraud is such that we are not only strongly compelled to think but feel almost certain that my sensitive information was not handled with care by the Key Bank loan officials and/or their processing department. It is very likely that the scammer obtained access to some or most of the information from Key Bank loan processing department, since I never shared any specific details of my crypto account holdings with anyone else before, even including my own wife and neither have I been previously ever hacked on my personal email or crypto holding accounts. Its also possible that my loan application candidacy was shared by the Key Bank loan department to their subsidiary or third party loan services/processors which led to the occurrence of this crime easily. This event has been absolute shock to me and my family. 

The biggest thing here is that asking about the details of these crypto holding accounts and related sensitive information by Key Bank loan officer and her underwriter/s was quite redundant especially that I had provided proof of enough USD ( XXXX ) funds in my Bank checking accounts, the proof of which I had already provided to the loan officer. The person who applied for the SIM card very likely already had the knowledge of my crypto holdings, userid of the accounts, associated email and phone number and the XXXX keys which made the crime very easy to commit. All these details were only revealed by myself for the first time to another person besides me which was my loan officer. My loan officer had asked me about these specific details about the crypto holdings which she specifically told me were required by her underwriter. Ms. XXXX had always shown a kind demeanor towards me during this transaction and in fact spoke with with me on several occasions including XXXX XXXX congratulating me about the home purchase and casually enquiring about the move plans. She particularly had made one remark in a casual way stating, You are making good money in your crypto and one day, you should teach me how to make money. Although I am not sure whether these remarks were just coincidental, but I definitely believe that my personal information about my accounts and crypto holdings was not handled well and leaked somewhere in the chain of command at the Key Banks loan processing department. 
I and my family already feel very saddened by this financial loss of nearly XXXX $ but especially by the security threat that this incident posed to our personal information which can impact us in the future. Not only this has led to stressful mental impacts but also will lead to significant constant expenses in ensuring our personal security, credit monitoring services and credit theft insurance. I and my family would really appreciate your assistance to help us recover our financial damages that we have sustained in this case mainly due to the negligence of Key Bank loan department in handling our private information. I also demand that Key Bank senior officials should hold an internal investigation about this incident so that frauds like this can be prevented in the future. This incident has left such a bad taste that we will never recommend Key Bank to any of our family members or friends unless KeyBank fixes this for us.

Company response to consumer: Closed with explanation