On XX/XX/XXXX a fraudulent transaction was made for {$.00} followed immediately by a {$2800.00} fraudulent transaction in our SunTrust bank account on our debit/check card. This fraud pattern is a fairly typical pattern and should be detected easily. SunTrust has inadequate fraud controls which failed to detect fraud on these transactions despite the fact that I had called within the past two weeks to provide them with my location ( vacation in Florida ) for the time period in question ( these transactions were not typical for my account and were not made in the location I had provided to SunTrust for my location over two weeks beginning on XXXX/XXXX/17 ). The small and large fraudulent transactions which SunTrust controls failed to detect was caught by three channels all of which are not named SunTrust. Thankfully XXXX, XXXX, and my wife watch our accounts and detected the anomalies. We notified SunTrust of the activity ( they still had not identified any issues ). After notifying SunTrust of the issue and of their inability to detect fraud they have refused to make the funds available while they research which will take 10 business days. The issue there is that I am on a family vacation for only 4 more days. I do not know how they could pass any credible audits on their control infrastructure to ensure appropriate controls are in place to protect their customers from fraud. Additionally, their failures to protect customer accounts from the most basic fraud patterns result in the consumer bearing the financial burden of Suntrust 's failures as a bank. Customers should be aware of these policies ( takes up to 10 bus days to replace funds made fraudulently ) prior to opening accounts so that they can make informed decisions on the burden they will most assuredly bear at some point due to Suntrust 's inability or incompetence with respect to designing fraud controls. This issue also calls into question Suntrust 's core values. At best they are not adhering to any core mission value that focuses on doing the right thing or at worst, SunTrust does not have a core mission value aligned to doing the right thing. Also of concern in an incidental observation while talking to 1 of 4 representatives, supervisors, and managers, was that SunTrust requires that their employers provide their first and last name to customers calling in versus providing an operator id thus resulting in the representatives being forced to provide API ( associate personal information ) which should be protected. All of this brings into question the ethics, competence, and policies of SunTrust with respect to its customers and employees. Going back to the original fraud issue which SunTrust should bear the burden of considering their fraud controls failed, despite multiple calls over the course of the day I am being told that I have to wait 10 business days to have access to the funds which were stolen from my SunTrust account. This will impact my annual vacation and potentially create many other issues however my larger concern is that SunTrust is not competent to manage customer accounts and does not have adequate fraud controls deployed and I can only assume due to the level of failure in this space that there are similar control design/implementation failures that may exist in other acquisition and/or customer management functions.