Consumer complaint received 2021-05-07
Company: JPMORGAN CHASE & CO.
State: TX
Product: Money transfer, virtual currency, or money service
Sub-product: Domestic (US) money transfer
Issue: Fraud or scam

Complaint:
I. RELEVANT FACTS On the morning of Thursday, XX/XX/XXXX, I was a guest at the XXXX XXXX XXXX in XXXX and accessed the XXXX XXXX identified at reception as secure and reserved for guests. At XXXX XXXX  I received a phone call and a male identified himself as an agent with Chases fraud department. He informed me that Chase identified suspicious activity involving my business debit card ending in XXXX. To authenticate his affiliation with Chase he provided me my Chase login ID, date of birth, and address. He then asked if I received a text message from Chase. I checked my phone and discovered a text inquiring about a purchase at XXXX and listing the last four digits of my business debit card. The Chase agent asked whether I had authorized that transaction and three other transactions which allegedly were made in New York City at XXXX, XXXX, and XXXX XXXX. I informed him that none of the aforementioned transactions were authorized. Being cautious, I cross-referenced the incoming phone number, XXXX. It matched the number on the back of my business debit card as well as the number provided on Chases website for existing business customers ( XXXX ) : https : //www.chase.com/business/contact-us. As an additional prophylactic measure, I also ran a malware scan on my laptop with my XXXX XXXX antivirus software and nothing was detected. 

I quickly logged in to Chase online banking to see if any of the fraudulent charges had posted. While logged in, I noticed an inter-account transfer that I had not performed. I expressed my alarm and the Chase agent informed that the fraud team was working to ensure all accounts were restored to the status prior to the compromise. He further informed that Chase would need to deactivate my business debit card and lock me out of my accounts so they could locate the perpetrator. As I had timed out from Chase online banking due to inactivity, I tried to log back in and I was indeed locked out. Notably, no e-mail from Chase was delivered confirming that my ID or password had been changed. While I rarely change my ID or password, on the occasions I have done so I consistently received an alert from Chase confirming a change has been made. The lack of notification reassured me that my accounts have been securely locked by legitimate Chase personnel and not a fraudster. 

To reverse the fraudulent debit card charges, the Chase agent informed that pins would be delivered via text and I would need to provide one for each fraudulent transaction. I am on the phone with the Chase agent for approximately one hour during which time three pins are delivered and relayed. Thereafter I had to terminate the call to check out of the hotel. Before departing the hotel, I asked to speak to the manager and informed her that the guest network may not be secure. I reported that no damages had been suffered as Chase detected the fraudulent activity. 

I was scheduled to have lunch with my sister and niece and activated the Do Not Disturb feature on my XXXX. After departing lunch, I deactivated the feature and almost immediately received a call from the same Chase number. The same agent I spoke with in the morning informs he requires a fourth pin to reverse the last fraudulent debit card transaction and that arrives via text instantaneously. I provided it and then commenced driving home to XXXX. 

On the morning of Friday, XX/XX/XXXX, I identify an e-mail notification from Chase informing that Chase approved a wire transfer from my business account for {$19000.00} payable to a stranger : XXXX XXXX. That denomination is almost triple the amount that was in the business account the day prior, signaling that funds had been withdrawn from multiple personal accounts and consolidated in my business account. This is an aberration as I do not comingle personal and business funds in my business account in keeping with the terms provided by Chase to utilize business accounts strictly for nonpersonal purposes. Online transfers are not frequent and when made constitue withdraw funds from my business account and deposit them in my personal checking or savings as a salary. 

I immediately drove to the local Chase branch in XXXX XXXX located at XXXX XXXX XXXX XXXX XXXX XXXX XXXX, XXXX, Texas XXXX. I met with banker XXXX XXXX, who confirmed that Chase had indeed approved the wire transfer and it had cleared my account that morning. I reported that Chase should have declined the wire transfer request given the multiple instances of debit card fraud detected the day prior. XXXX XXXX accessed my account and did not identify any notes pertaining to debit card fraud. However, he informed that Chase flagged my business account for suspicious activity the morning of Thursday, XX/XX/XXXX. Despite flagging the account, XXXX XXXX informed that Chase made no attempt to contact me and apprise me of any risk. My husband XXXX XXXX joined us and for approximately three hours we worked with XXXX XXXX to try and recoup the funds. As part of the process, I complete the XXXX XXXX XXXX onsite and execute it before XXXX XXXX, a Chase employee and notary. XXXX XXXX reports that all formalities have been completed to file the claim and the assigned case number is reported to be # XXXX. Immediately upon departing the branch location, I further undertook all of the prescribed measures XXXX XXXX delineated, including but not limited to : filing a police report with the XXXX XXXX XXXX XXXX, filing a report with the Federal Trade Commission, placing security freezes with the three credit bureaus, re-running malware scans on my laptop and XXXX, and changing my password for my XXXX e-mail account. Lastly, XXXX XXXX instructed that I directly contact Chases fraud department to apprise them of the three additional instances of fraud, namely, the unauthorized transfers of funds from my personal checking, joint checking, and savings account to the business checking account. 

On XX/XX/XXXX, after having addressed all other prerequisite tasks identified by XXXX XXXX, I contacted Chase to repot the three instances of fraud involving my personal accounts. The Chase agent with whom I spoke had no record of my case number. But, after relaying the facts and circumstances that culminated in the unauthorized wire transfer, the agent informed that only the wire transfer constituted fraud despite the fact that the online banking transfers were performed by a fraudster. The representative then recited all of the tasks that I had already undertook pursuant to XXXX XXXX guidance. 

On the morning of Thursday, XX/XX/XXXX, a full week after the incident, I call Chase again to ascertain the status of my claim and anticipated arrival for the debit cards. The representative that I speak with again informed there is no record of any claim having been filed on my behalf. When I provide the aforementioned case number, the Chase representative again searches for the claim to no avail. Thereafter I drive directly to the local Chase branch. XXXX XXXX concedes that that the debit cards were not ordered and rectifies that oversight. He does, however, insist that the claim was promptly filed on XX/XX/XXXX and faxes me a copy of the XXXX XXXX XXXX. 

On XXXX, XXXX, our Chase Private Client Manager, XXXX XXXX XXXX, facilitated a call with Chases fraud department in an attempt to expedite the processing of my claim and reimbursement of the fraudulently transferred funds. We were connected with a representative named XXXX XXXX XXXX XXXX asked for her full name and she declined to provide it XXXX. XXXX reported that the claim was initially misfiled on XX/XX/XXXX, but ultimately she was able to locate the relevant information. Per the records available to XXXX, Chase did indeed flag my business account for suspicious activity on the morning of Thursday, XX/XX/XXXX. And, in accordance with XXXX XXXX report, Chase never took any initiative to contact me to alert me of any possible risk. Per XXXX account, Chases records indicated that I called in directly to Chase requesting a wire transfer from my business account. And, when questioned as to the purpose of the transfer, the individual purporting to be me reported it was intended to be a birthday gift for my son. I informed XXXX that while I received multiple calls from a number affiliated with Chase, I did not make any outgoing calls to Chase, which my XXXX phone log supports. And, I do not have children. While neither XXXX nor her supervisor were ultimately able to provide assistance, it was invaluable to learn that the proffered justification of gifting tens of thousands from a business account for an expressly non-business purpose failed to raise any red flags with Chase. This reinforced several other red flags which Chase should have countenanced, including but not limited to : ( 1 ) my account was flagged for suspicious activity the very morning of the wire transfer request, ( 2 ) personal funds were drained from my personal checking, joint checking, and savings account and consolidated in my business account in an unprecedented manner that liquidated nearly all funds collectively held by Chase, and ( 3 ) I have never authorized any wire transfer from any account in the history of banking with Chase. 

On XX/XX/XXXX, I received a call from XXXX XXXX, a manager overseeing the XXXX XXXX and XXXX XXXX  branches in XXXX, Texas. She regretfully informed that Chases fraud team reported that I will not be reimbursed the funds that were fraudulently transferred without authorization unless Chase could persuade XXXX  XXXX XXXX to reverse the wire transfer. XXXX XXXX made no mention of when that recall request to XXXX  XXXX XXXX was placed, but presumably it should have been dispatched on XX/XX/XXXX as I had reported the fraud within hours of the funds clearing. XXXX XXXX informed that the justification for denying my claim was owing to the fact that I was allegedly involved in the scam. I protested that I committed no wrongdoing and XXXX XXXX avowed to escalate the matter to Chases complaint escalation team. 

XXXX XXXX of Chases complaint escalation team contacted me on XX/XX/XXXX and we conferred on multiple occasions through XX/XX/XXXX. I informed him that I have consulted with an attorney and appreciate that Chase is responsible for reimbursing the lost funds under various legal theories including but not limited to the Electronic Funds Transfer Act ( EFTA ) and UCC Section 4A. I have also compiled substantial documentation to debunk any allegations that I was actively engaged in any fraudulent activities. XXXX XXXX regretfully reported on XX/XX/XXXX that the fraud team had once against declined my claim without reviewing any additional information or documentation I was willing to provide. XXXX XXXX informed that Chase could not recoup the fraudulently transferred funds owing to the unreasonable delay in requesting the recall which was not made until XX/XX/XXXX. He further suggested that I pursue the matter with law enforcement. My reaction was nothing short of incredulous. I reported the fraud in person at Chases XXXX XXXX branch within twenty-four hours of notification and within hours of the funds clearing, why had Chase not demanded a recall that same morning?. And, I had already engaged both local and federal law enforcement as evidenced by the XXXX XXXX and FTC reports to no avail. XXXX XXXX sympathized and avowed to escalate the matter to Chases executive fraud team. 

As of this last conversation with XXXX XXXX on XX/XX/XXXX, it is abundantly clear that Chase breached its fiduciary duties on multiple occasions. First, Chase recklessly approved the wire transfer despite multiple red flags presented by way of an alert as to suspicious activity involving my business account followed by multiple unprecedent online transfers and a phone call requesting an unprecedent wire transfer purported to be a birthday gift for a son that does not exist. Secondly, post-transfer, Chase filed to timely process my claim and demand a recall from XXXX  XXXX XXXX despite being notified that the wire transfer was fraudulent within twenty-four hours of notification and hours after the funds had cleared. Time was of the essence and only Chase, not I, was in a position to identify the banking institution to which the funds were transferred and immediately make the request to reverse the transfer. 

II. LEGAL ANALYSIS A. Electronic Funds Transfer Account and Regulation E Federal Regulation E ( 12 CFR 205.6 ) was issued by the Consumer Financial Protection Bureau ( CFPB ) pursuant to EFTA and applies to electronic funds transfers involving personal banking accounts. Qualifying accounts include [ c ] hecking, savings, or other consumer asset account [ s ] held by a financial institution ( directly or indirectly ), including certain club accounts, established primarily for personal, family, or household purposes. An electronic funds transfer ( EFT ) constitutes a transfer of funds initiated through an electronic terminal, telephone, computer ( including on-line banking ) And an unauthorized electronic funds transfer constitutes an EFT from a consumers account initiated by a person other than the consumer without authority to initiate the transfer and from which the consumer received no benefit. 

Each of the three personal accounts that I maintained with Chase which were compromised qualify under EFTA, namely, my personal checking, joint checking, and personal savings. And the three transfers from each of these account to my business checking account within hours of the wire transfer request, presumably performed via online banking by the fraudster, constitute EFTs. And, given the fact that I did not authorize the initiation of any one of these transfers nor benefited from the transfer, they are deemed unauthorized under EFTA. The fact that a third party other than myself performed these transfers is verifiable. As reported herein, I was locked out of my account during the span of my conference with the purported Chase agent between XXXX and XXXX CST. Whether Chase locked me out or a fraudster reset my password is not readily discernable. However, Chase should have a record of my attempt to log in during that interim and my ID and password were rejected. Thus, I I had no capacity to transfer funds nor the capability to monitor and report to Chase. 

Regarding a consumers responsibility to report an unauthorized EFT, Regulation E provides that in the case of [ u ] nauthorized transfer ( s ) not involving loss or theft of an access device, a consumer should report the incident [ w ] ithin 60 calendar days after transmittal of the periodic statement on which the unauthorized transfer appears. In such instances, there is [ n ] o liability for the consumer.

Unlike other banking institutions, Chase does not issue fobs or other access devices for the purposes of securing wire transfers. Thus, this is an instance in which no device was lost or stolen. And, as aforementioned, the fraudulent transfers from all three personal accounts were fraudulent and unauthorized. There can be no refuting that the fraud was timely reported as I was physically present at the XXXX XXXX Chase branch within twenty-four hours of notification of the fraudulent and unauthorized wire transfer as supported by the notarized XXXX XXXX XXXX and undoubtedly surveillance cameras. 

Based on the foregoing facts and pursuant to Regulation E, Chase is liable at a minimum for the unauthorized and fraudulent transfers from personal accounts which collectively amount to XXXX  XXXX and XXXX XXXX dollars ( {$11000.00} XXXX. 

B. Uniform Commercial Code Article 4A ( also known as Division 11 ) Unlike EFTA which governs EFTs involving personal accounts, Uniform Commercial Code ( UCC ) Article 4A applies to customers commercial business accounts. UCC Article 4A provides that a receiving bank ( the bank that receives wire instructions from a sender ) ordinarily bears the risk of loss of any unauthorized wire transfer. However, unlike Regulation E, the risk of loss may be shifted to the customer under certain circumstances.

Customers are most vulnerable to assuming liability for any loss due to a fraudulent wire transfer under UCC Section 11202 ( b ). The framework of Section 11202 ( b ) involves two-steps. First, the financial institution must prove that the institution and customer agreed upon certain anti-fraud security procedures which constitute a commercially reasonable method of providing security against unauthorized payment orders. Whether a particular security procedure is commercially reasonable is a question of law to be determined by considering the customers stated expectations, the customers known needs, alternative security procedures offered, and security procedures used by similarly situated banks and customers. Cal. U. Com. Code 11202 ( c ). Second, the financial institution must prove [ ] that it accepted the payment order in good faith and in compliance with the security procedure and any written agreement or instruction of the customer restricting acceptance of payment orders issued in the name of the customer. Cal. U. Com. Code 11202 ( b ). 

There is ample case law detailing the evidentiary showing a bank must demonstrate to shift the loss to the customer. And, as we have retained an attorney, we will rely on the expertise of counsel in this arena to cite the appropriate authority. However, to summarize our understanding, Chase failed to make an adequate showing in the instant case because it failed to act in good faith when it accepted the wire transfer request. Courts look to circumstantial evidence when analyzing whether a banking institution acted in good faith. Taken into consideration are factors such as the customers election of ( 1 ) security protocol, ( 2 ) the reasonability of the request in light of the customers established pattern of transactions, and ( 3 ) and other facts which should alert the receiving bank as to prospectively fraudulent activity. 
Here, to the extent any anti-fraud security protocol was established, I passively accepted the terms when I opened my business checking account. And, based on ample due diligence and discussions with counsel, Chases dual authorization protocol is the bare minimum industry-wide requiring only a password and pin codes. So, if an XXXX was stolen there would be very low barriers to prevent a fraudulent wire transfer from occurring. Had I known the risk, I would have proactively negotiated for more strict and appropriate security measures. 

Secondly, and most notably, a review of my banking history would reveal that I have never authorized a wire transfer since the day I commenced banking with Chase. This should have been the most glaring red flag that prompted Chase to electively heighten security protocol requiring either an in-branch authorization or, at a minimum, to proactively attempt to contact me rather than passively rely on the incoming communications of a fraudster. 

Lastly, the circumstances preceding the approval of the wire transfer overwhelmingly suggest that any Chase agent receiving the unprecedented request should have declined. Initially, the very account from where the funds were being transferred was flagged internally that morning for suspicious activity. Secondly, Chase did not independently contact me and relied on incoming and unverifiable calls. Third, there was a change in password that morning and at least one attempt by myself to access the account which was rejected, suggesting multiple entities were attempting to access the account. Fourth, never in the history of banking with Chase has three independent online transfers occurred from each of my personal accounts. Fifth, in contravention of Chases own protocol for business accounts, the fraudster proffered the justification that the alarmingly large wire transfer was intended as a birthday gift. And, lastly, the denomination requested constituted a veritable liquidation of all funds held by Chase which should be an anomaly for any customer. 

Based on the foregoing facts, Chase acted recklessly and without good faith in approving the unauthorized and fraudulent wire transfer request and should be liable for the resulting loss. 

C. Failure to Mitigate As aforementioned, the fraudulent and unauthorized wire transfer was reported in-person at the earliest opportunity to XXXX XXXX at the XXXX XXXX Chase branch. Thereafter, I diligently pursued updates on the status of the claim that was timely filed. Regrettably, as has been repeatedly disclosed by various Chase agents, both the claim and the request for a recall were mishandled and/or inexcusably delayed. Regardless of any conclusions under Regulation E and UCC Article 4A Chase that Chase bears liability for the fraudulent wire transfer, Chase was in the best position to mitigate the loss by promptly recalling the wire transfer and negotiating the reimbursement of funds with XXXX XXXX XXXX. To the extent that Chase repeatedly failed in fulfilling its fiduciary duty to try and recoup the lost funds, it should bear the brunt of the loss. should D. Unclean Hands A robust review of the facts and conferences with Chase agents subsequent to the loss suggest that an active Chase employee acted in concert, or aided and abetted, the fraudulent principal ( s ). This is not merely owing to the incoming calls on XX/XX/XXXX from a Chase-affiliated phone number nor the perfectly orchestrated delivery timing of the pin codes. Most remarkable is the fact that I was locked out of my account, which multiple Chase agents insist was not effectuated by Chase. If it had indeed been a fraudster who merely accessed my ID and password, I would have been alerted via e-mail or text when either were changed to lock me out. Even if said fraudster had hacked into my e-mail account, the incoming notification from Chase would have registered on my laptop, XXXX, or XXXX watch before it was deleted. 

And due diligence suggests that this concept should not be foreign to Chase as there have been multiple federal indictments of employees of banking institutions who have been charge with aiding and abetting embezzlement in the past several years. 

III. CONCLUSION Based on the foregoing, we are requesting that Chases executive fraud team find that I am not at fault for any the loss owing to the unauthorized wire transfer and promptly reimburse the {$19000.00} that Chase recklessly approved without justification.

Company response to consumer: Closed with monetary relief