Consumer complaint received 2021-08-01
Company: ALLY FINANCIAL INC.
State: VA
Product: Checking or savings account
Sub-product: Checking account
Issue: Problem with a lender or other company charging your account
Sub-issue: Transaction was not authorized

Complaint:
On Monday XX/XX/XXXX, I received multiple notifications of suspicious activity regarding my Ally Bank checking account via text message and voicemail. I immediately contacted Ally Bank by phone to discuss the referenced activity. After providing the reference numbers and details I received through the suspicious activity notifications, Ally reported that there was actually no recent activity visible on my account. I was able to confirm this through viewing my account using the Ally Bank mobile app- there was no new posted or pending activity visible on my account. The customer service rep said the reference number I received from the suspicious activity notification did not bring up anything in his system, so there was no action he could take at that time. I offered to continue closely monitoring my accounts, but was mistakenly left suspecting that my phone number had been compromised, leading to false fraud notifications via text and voice mail. 

A short time later, I received an additional notification of suspicious activity from Ally Bank via email. I once again checked my account and saw that there were now fraudulent charges pending. I immediately called the number on the back of my Ally Bank debit card, and the person on the line confirmed that there were pending charges on my account. I confirmed that these charges were fraudulent ( one was in a foreign country I had never visited ), and should not be processed. The debit card in question was in my possession, and had never been used- not a single time. Not in person, not online. Not as an ATM card, not as a debit card. The card has never left my possession. The fact that I was now a victim of debit card fraud was especially frustrating because I do not WANT a debit card tied to my account, for exactly this reason. I had previously requested an ATM-only/PIN-only card to access cash from ATMs, but Ally 's response was they do not offer one. They only offer MasterCard branded debit cards that leave your accounts vulnerable to this type of fraudulent activity. Additionally, I believed I had used the card control module of Ally Bank 's mobile app to turn off all transactions associated with this card with the exception of ATM withdrawals. As I would later find out, when Ally replaced my expiring debit card in XXXX of XXXX, they did not add that new ( now compromised ) card to my card control module, or carry over the settings from my expiring card to my new ( compromised ) card. When I check the card control module in the mobile app, the only card visible is still my previous card, expired in XX/XX/XXXX. The bottom line is that I was not provided the access necessary to restrict transactions on the debit card that was compromised using Ally Bank 's card control module, and even if I had, I would not have expected my card controls from my account to have been reset by Ally Bank when my card expired. 

During this initial phone call with Ally Bank, my debit/ATM card was cancelled. This was terrible timing, as I was hundreds of miles from home and low on cash. I was also informed I would need to make an additional phone call to request a new card. On this second phone call I once again requested an ATM card without an associated debit card number, but was denied. I was also informed that despite Ally immediately knowing these charges were fraudulent and quickly notifying me of the same, as well as the fact that I immediately responded and confirmed that the suspicious activity was indeed fraudulent, Ally would still process the clearly fraudulent charges and send the money out of my account. I believe this is negligent, and completely defeats the purpose of the suspicious activity alert system. I requested that Ally not pay/deduct the charges both Ally Bank and myself believed to be fraud out of my account. My request was denied. I requested a temporary credit in the amount of the fraudulent charges, justified by the fact that both Ally Bank and myself believed these charges to be fraud, until the matter could be settled. My request was denied. With bill payments already scheduled, my account balance was reduced to less than {$6.00}, and I was forced to make an immediate emergency transfer of funds into my compromised account to avoid a negative balance. 

On this second phone call, Ally Bank 's position was that they were sending money out of my account to cover charges they knew to be fraudulent, and my only recourse was to wait days until the charges posted, after which I would be required to call a third time to request an investigation of the charges that I had already called about twice and that Ally Bank knew were fraudulent from the moment they occurred. They offered nothing to help, and have wasted hours of my time pursuing a refund of money that should have never left my account, all because a of a debit card I never wanted and still do not want. Their only solution to avoid this situation in the future is a card control application that is faulty. I have zero confidence in the security of my funds at Ally Bank, and Ally Bank takes no responsibility for this vulnerability or any steps to reduce the inconvenience of their security weaknesses on their customers. 

During the third call to officially contest the charges, on Thursday XX/XX/XXXX, I once again asked for a temporary credit to replace the funds Ally Bank withdrew from my account until the matter could be settled, and was again denied. I was told it could be up to 10 days before a decision was made about refunding my funds.

One week after becoming a victim while Ally stood by and did nothing, I am still missing the money that Ally knowingly sent out of my account due to fraud. One week later, am I still without a replacement card to access cash from my account. Ally did offer to expedite a card to my home address in 1-2 days. However, a signature would be required to receive the card, and unfortunately, as someone with a job, I do not have 1-2 days to take leave from work and wait for a replacement card. It was laughable to me that Ally Bank cares enough about " my security '' that they would not send a replacement card to my place of employment where I could sign for it, but would empty my account to known fraudulent charges without a second thought. In that moment, they are on the phone with me and have confirmed my identity by asking my mother 's maiden name, the last four digits of my social security number and an additional security question. They are accessing and openly discussing my account. They have eliminated to their satisfaction the possibility that they are speaking to anyone but me. However, they are unable to expedite a debit card to an address I give them at that time, because of ... security concerns. In the meantime, they have left me far from home with a cancelled debit card and an empty, compromised bank account. I could not be more disappointed with Ally Bank, and look forward to the return of my funds and the resolution of this issue so I can move to a bank that protects their customers and cares about their financial well-being.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation