Consumer complaint received 2020-04-16
Company: JPMORGAN CHASE & CO.
State: UT
Product: Checking or savings account
Sub-product: Checking account
Issue: Managing an account
Sub-issue: Problem using a debit or ATM card

Complaint:
Unauthorized Withdrawal of {$4000.00} : On XX/XX/2020, a person accessed my sole Chase Checking Account ( ending in XXXX ) using the Chase Mobile app to transfer {$4000.00} to a shared Chase Checking Account ( ending in XXXX ) and then finally moving the {$4000.00} to Chase Checking Account ( ending in XXXX ). On that same day, the person had also taken {$2800.00} but what appears to have been only from account XXXX to XXXX. 

Unauthorized Withdrawal of {$5000.00} : On XX/XX/2020, the person again accessed my sole Chase Checking Account ( ending in XXXX ) using the Chase Mobile app to transfer {$5000.00} to a shared Chase Checking Account ( ending in XXXX ) and then finally moving the {$5000.00} to Chase Checking Account ( ending in XXXX ). 

Sole Account Holder ( Me ) Identifies Missing Funds : On XX/XX/2020, after seeing {$5000.00} had been pulled from my sole account, I started to investigate and found my soon to be ex-wife ( XXXX ) had been the one to pull the money from my account. I went to local Chase Bank Branch in XXXX XXXX Utah and asked one of the employees how was she able to pull money from my sole account. He only could tell me that it wasn't done physically in the branch. He confirmed that she never had an electronic account set-up in her name and password, so she shouldn't have been able to do it electronically, either. I asked him to close the account while I continued to investigate. 

Submitting Claim to Chase Fraud Team : I called Chase to notify them of the issue, at the time only thinking {$5000.00} had been pulled from my sole account, I created the fraud claim for the same amount. The fraud team almost immediately denied my claim because they said it was a civil issue I had to take up with my wife. 

Investigating the Issue Further : Still confused at how she was able to take money out of my sole personal account, I continued to investigate and noticed she had taken {$4000.00} via the same method on XX/XX/2020. While she had a debit card and her name was on the Chase Checking Accounting ( ending XXXX ), she has never ever had electronic access to this account so I knew she must have pulled the money in an unauthorized fashion. 

I was confident she couldn't have done all this electronically, because she never knew my passwords. As I started to investigate using the limited security tools Chase has on their website, I saw a device with the name of " XXXX XXXX XXXX '' had been accessing my account. I again changed my password, but saw almost in real time, that she was still able to access my account from her phone! This really worried me because there was no way for me to block that device. I knew there was a bigger problem here!! 

Finding Major Security Issue with the Chase Mobile App : After seeing her phone was still accessing my account, I decided to test the Chase Mobile App on my phone. I immediately found that even after changing my chase.com password on my computer, I was STILL ABLE to access my Chase accounts via the Chase Mobile App WITHOUT having to update the password in the mobile app. So, my theory was that at some point, XXXX had gotten my Chase password, saved it to her Chase Mobile App using her biometrics, and even after I've changed my password, she was still able to access my account. 

Working with Chase Branch Team and Chase Executive Support : After finding the Major Security Flaw in the Chase Mobile App, I was not satisfied with their response because XXXX should have NEVER had electronic access to our shared account or more importantly, my sole account. Worse, even after taking precautions to change my password, she was still able to access my accounts. 

I then went to the Chase Bank Branch in XXXX Utah and met with the VP/Branch Manager ( XXXX ). I walked him through the issue, even showing him how I could change the password for my accounts on chase.com but still bypass password requirements on the mobile app by using my biometrics. He was shocked and told another colleague, " this seems like too big of a technical oversight and should not be possible. '' XXXX and I called the Chase Executive Office to walk them through the issue. A new case had to be opened since the other case was closed. I was told they would again research and get back to me. Over the following weeks, they requested more information, which I provided. They called again after a few weeks and asked I create another case but state that it was an " unauthorized withdrawal, '' which I went into the branch and did with XXXX ( colleague of XXXX ). I was verbally told that they were confident I would be reimbursed for the funds that were removed because they were unauthorized withdrawals. 

Working with Chase Executive Office : A couple days later, I received a call from the Executive Office Team Member who was investigating. She said Chase was sending me a check for {$6800.00} while they continue to research the issue. A couple days after that, she called and told me that the case ( s ) were going to be closed and that I can not cash the {$6800.00} because Chase believed that they were NOT at fault for the unauthorized withdrawals. 

Conclusion : As of today ( XX/XX/2020 ), Chase has NOT fixed the Security Issue in the Mobile App. Not only have I lost {$11000.00} from unauthorized fund withdrawals because of this cyber-security flaw, but Chase Bank is leaving ALL of their customers at risk because of this issue. Just as happened with me, if someone ( like a hacker, family member, friend, associate, etc. ) would only need to get a customers password once and save to a biometric fingerprint to access funds, even after customers change their passwords, the person will still have access to the accounts. 

I have evidence, including video of the mobile app security flaw for bypassing passwords that I can share upon request. I also have copies of the transactions and the device that was used to pull the funds. 

I'm fine with CFPB publishing this, but if bad people find out about this flaw ( bypassing passwords using biometric fingerprints ) in the Chase Mobile App, I do not want to be responsible for losses to others. 
Compensation : Up to this point, all I've asked for is that the {$11000.00} be put back into my new account. Chase has access to the current location of the funds, so they can get them from there. 

I've spent more time than necessary helping Chase understand the issue. It is now becoming a burden for me and causing distress in my life, for which I should also be compensated.

Company response to consumer: Closed with explanation