Consumer complaint received 2023-04-10
Company: U.S. BANCORP
State: MO
Product: Credit card or prepaid card
Sub-product: General-purpose credit card or charge card
Issue: Other features, terms, or problems
Sub-issue: Privacy issues

Complaint:
On XX/XX/2023 at XXXXXXXX XXXX I received a text from US Bank providing a code " US Bank Alerts : XXXX is your code. Do not share this code ... '' I thought it was odd as I hadn't logged into our account. However, at XXXX XXXX I received a text that my credit card account password had been changed. I logged in through my phone and it seemed fine ; however, I logged in by my computer and, in fact the password had been changed. I immediately called the customer service phone number on US Bank 's website and was told " you'll need the State Farm department '' ( State Farm was the previous issuer of the card ). They transferred me to that department and I was met with " we are closed our office hours are ... ''. I hung up and called the number on the back of the card. I informed the customer service agent they have a breach as someone was accessing my account. The agent transferred me to another agent who walked me through changed the username and password on the account. However, had no explanation as to why or how someone had access to my account. I asked to be transferred to the security group and was assured they were the person that could assist. However, no information was taken nor asked for. I reiterated many times this is a security breach and was dismissed many times. I hung up and called back. Another agent assisted and suggested cancelling the card. I again told the agent you have a security breach. Nothing was done other than the agent suggesting to report the card as stolen. I told the agent I wasn't concerned about the card ; I was concerned that someone had access to the account, the information on the account, my SSN, my address, my phone number, my email address... etc. The call ended with nothing done. I had a previous interaction several years ago that XXXX XXXX XXXX had assisted with. I sent an email direct to him. He is listed on XXXX as Vice Chairman | Technology and Operations Services at U.S. Bank. No reply by XXXX XX/XX/XXXX. I emailed XXXX XXXX who is listed on XXXX as Information Security Director as well as emailing XXXX XXXX who is listed on XXXX as Vice President, Information Security Director at US Bank. I had a call back from a XXXX at US Bank at XXXX XX/XX/XXXX. XXXX was confident the issue was that someone had randomly gained access to my account as all cards are accounted for. I was on the phone for 55 min with XXXX. XXXX transferred me to a group that had a new card issued ; however, nothing was done about the breach. I explained over and over my concern is that someone has had access to ALL of my information. Nothing was done. I had new cards issued. Total to this point I had spent roughly 2.5 hours on the phone with US Bank with no results. The next day I received an email confirmation from the Executive Offices of US Bank that my email to XXXX XXXX XXXX had been received. I believe it was on Tuesday the XXXX I received a call from the customer service group inquiring why I had rated their customer service so poorly. I explained the entire thing again - again stating " You have a security breach ''. The person said they'd pass my information along. Add an additional 30 min so far. On the same day, the XXXX I noticed our Rewards ( this is a rewards credit card ) was wiped out. I thought, ok, they've placed the rewards in suspense until the new card arrives and is activated. The new card arrived on XX/XX/XXXX. I activated it ; however, the rewards did not transfer back. I gave it several hours before calling thinking it may need a bit to transfer to the new card. Not seeing any change I dug the rewards account to find that the rewards had been redeemed on XX/XX/XXXX, same day as the breach, to a XXXX XXXX Account ending in XXXX. I contacted the rewards group asking where I rewards were the response was we redeemed them. I said it wasn't us that redeemed them. They placed a fraud request in to their Rewards Fraud group. From XX/XX/XXXX until today, XX/XX/XXXX I have heard nothing from US Bank. In the meantime, my account was compromised, information was leaked and crickets. Today, I had a call from XXXX from the president 's office at US Bank. The information that XXXX had was incomplete as she apparently hadn't been briefed on the breach ; instead began by the Rewards fraud. I explained the whole thing all over yet again. Insisting US Bank has a security breach. I was told repeatedly that US Bank 's internal fraud group is managing the issue but could not tell me what, if anything was being done. I asked several times if the FBI or law enforcement had been contacted and was met with " I can not tell you what is being done ''. US Bank has had a full 10 business days to run an investigation, even with me providing them the information that the rewards were redeemed and transferred to a XXXX XXXX Account ending in XXXX and they have as of today done nothing. I ask the CFPB to intervene to initiate an investigation into how someone was able to gain access to my credit card account, change the password, and redeem rewards dollars all with avoiding US Bank 's own security measures. Thank you. XXXX

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation