Consumer complaint received 2023-01-19
Company: NAVY FEDERAL CREDIT UNION
State: MD
Product: Checking or savings account
Sub-product: Checking account
Issue: Managing an account
Sub-issue: Problem using a debit or ATM card

Complaint:
Between the month of XX/XX/XXXX and XX/XX/XXXX, my online checking bank account with the Navy Federal Credit Union was accessed by an individual unknown to me and a total of {$15000.00} was transferred to two separate banks - XXXX  XXXX XXXX and XXXX XXXX 

When the initial transfer {$10000.00} occurred, XX/XX/XXXX, I panicked as soon as I received a text notification to my mobile device confirming an external transfer of funds from my checking account. 

I immediately called Navy Federal within seconds of receiving the text message notification and was transferred to the Fraud Team to file a fraud claim. The compromised checking account was closed. The bank issued a new bank account, walked me through the process of changing all passwords to my email account, bank login access identification and passwords. These were detailed steps that were provided to be by the bank representative, and I inquired if there were other safeguards in place, other security measures that I could take. I was advised that I had covered all available steps and there was nothing else the bank could do to ensure my money was safe. 

Weeks later, another fraudulent attack was successful on the new issued bank account with updated passwords and user login id and passwords. This time XX/XX/XXXX, {$5000.00} was successfully transferred from my NFCU account to another bank, XXXX XXXX. Note that I had gone to the branch seeking safeguard measures to protect my account ; security mechanisms to prevent this from further occurrence and the bank simply advised me there was nothing else they could do. And it was all my fault that this was happening to me. They issued a provisional claim to cover the amount whilst investigations were still ongoing. 

I was shocked to log into my checking account 1st week of XX/XX/XXXX, to observe that Navy Federal Credit Union ( NFCU ) had debited my account to the tune of {$15000.00}. NFCU went as far as taking ( transferring funds ) money from my savings account to cover the entire amount of {$15000.00} stating they found no errors in the transactions and deemed me responsible for the fraudulent transfers. 
I requested for additional information as I had contacted NFCU immediately I received a transfer notification alert to put a hold on the transaction and notify the receiving banks in this case XXXX XXXX XXXX and XXXXXXXX XXXX and the bank representatives that I spoke to failed to do that. They failed to protect my funds. All the advice they had previously communicated to me to protect my account were fully observed and put in place. 

On XX/XX/XXXX, while researching online to see how best to handle these fraudulent transactions with NFCU, wondering if other NFCU customers were equally experiencing this type of authorized fraud, I came across this news : https : XXXX? XXXX. Last XXXX, internal fraud investigators at the {$150.00} XXXX Navy Federal Credit Union grew suspicious of an employee who was possibly involved in criminal activity on the dark web and reported it to police. 

Who is to state that my account was not compromised internally by a bank employee working with an external party? The is refusing to share how my money was taken out of my own account. They have provided me with the external account numbers and names that the fund was transferred to. I have contacted XXXX XXXX XXXX, but they can't help me. I am not their customer. 

I would like the NFCU to be investigated and held liable for this loss. The bank only just implemented an additional security mechanism in at about XXXX XXXX XXXX that recognizes when a customer uses a new device to access an online bank account. 
The bank system will pose a challenge question that only the customer will be able to respond to. This is something that should have been in place to prevent these unauthorized transactions as the bank could have recognized the unauthorized login attempts as unusual and blockedstopped it.

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with monetary relief