Consumer complaint received 2015-10-06
Company: NAVY FEDERAL CREDIT UNION
State: VA
Product: Bank account or service
Sub-product: Checking account
Issue: Deposits and withdrawals

Complaint:
A person, or a hacker-criminal posing as a person, broke-hacked into my online bank account, on two separate occasions, posed as me ( or my husband ) and drained our accounts and tried to obtain large cash advances from our VISA card. The bank restored our money, and is investigating the issue ... .and we are not entitled to know anything further. WHY? If someone physically assaulted me and took me to an ATM machine and made me withdraw lots of money at gunpoint, the police would get involved, try to catch the person, the person would be apprehended, and a legal proceeding would ensue ... .Why is this level of scrutiny and closure not afforded victims of financial crimes? 

The first time this happened, on XXXX/XXXX/15, the credit union insisted that it was ME that got hacked, not the institution itself. The second time it happened, the credit union took it a bit more seriously but still maintains that my account being hacked is a separate situation from the credit union 's 'back office ' systems being hacked. 
I say this is an INSIDE JOB. How does someone ... .a ) get my access code, and my password ; b ) log into my on-line bank account ; c ) create a third party transfer record to allow the transfer of funds to another credit union member ( whose names I do know ) d ) log into my account and transfer money to the newly created 3rd party transfer record ... then open my visa account and try to get a cash advance of {$15000.00}? The bank says these are 'mule accounts ' which the real perpetrator is using to move money from my account to other accounts that the perpetrator is controlling ... .which must mean that the perpetrator has access to not only my account but other members of my credit union. Yes, the bank is investigating ... .but how do I press charges? 
Also, the first time the hacker helped him or herself to our money, said-hacker went into our account and defined a third party transfer record so that money could be transferred from our account to another credit union member 's account. An automated email was generated to notify us that this 3rd party transfer record had been created, and that if we did n't create the record we should call the bank. Well ... .hacker hacked in at XXXX, moved the money to another valid account ( i.e. depleted our account ), we saw the email at noon, just two hours later, but alas it was too late to prevent the thief from stealing the money. Why, oh, why would n't there be an approval process on setting up a third party transfer record? Why would the bank tell us that just 6 months earlier such a control existed and that before a 3rd party transfer account could be 'authorized-for-use ' it had to be approved from a source outside the on-line account? Well maybe unknowing bank customers complained that they could n't move their money around fast enough ... like to their college student or their ailing relatives. So why can the bank compromise security for customer convenience, at the expense of customers who do n't want their money vaporized from their accounts on a routine basis? 
I believe in my bank, and have banked there for over 20 years. If I went to another bank, what are the chances that the same thing would happen all over again? How do I know which bank is more secure from a cyber-crimes?

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with explanation