Consumer complaint received 2024-10-28
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: Credit Karma (FL)

Somehow an attacker bypassed 2FA on my account by it looks... first changing the phone number through some means and then logging in using the other login option of phone verification code. They used this to then disable my virtual card lock. I don't use Credit Karma for anything other than ACH debits through XXXX XXXX to pay my credit card bills. Never activated my physical card. The attacker then added XXXX XXXX to my account to go on their quest for a moment of love and attention charging thousands at grocery stores in XXXX with large cash back withdrawls and an ATM one to boot. 

Then a back and forth game of changing the phone back to mine, to have the attacker change it back to their 's. We kept doing this after the daily limit was hit that we both sometimes locked the phone number down since verification codes were restricted at too many attempts. Support kept telling me the fraud department is investigating with open disputes while I kept yelling at them to lock the account down from any changes and that I know disputes are open and to focus on locking the account down. Same circular logic of fraud department investigating ( yeah right on a Sunday ... and apparently the request went in an hour after first contact with the 2nd agent trying to " correct '' my timeline and mentioning this ) while not trying to do anything to freeze the account. Then I gave up with support and tried closing ( then breaking since unable to close a funded account, especially with open disputes ) my account after this to freeze it and have a check hopefully mailed out. No luck. How inept support is, I'm wondering if it is an inside job,
after checking breach reports through XXXX XXXX XXXX XXXX XXXX and the XXXX XXXX breach by an employee recently...

Even trying to transfer my remaining funds out to XXXX XXXX XXXX that I initially funded XXXX with, I have to constantly verify my device via SMS code in that app even if I remember the device it seems... and they have an option to untrust/purge all verified/trusted devices. Credit Karma doesn't! No login activity records. No verified device records and a way to purge them. Poor security mechanisms and procedures. 

Also should mention, XXXX froze my account 4 hours after I filed a web form complaint. 10 hours after the initial breach. Love how the account wasn't frozen after the first two {$2000.00} failed XXXX XXXX transactions and they just strolled over to another grocery store to hit the {$5000.00} limit for the day. I had XXXX before and called them to allow transactions in XXXX XXXX XXXX back in 2012. Flew in and went to the hotel bar to wait for my room. Transaction declined. Account frozen due to fraud protection. Called and rementioned I was traveling. No option with Credit Karma support either to change daily limits. XXXX I could call and change, either up or down no problem.

This should probably be investigated as financial terrorism, seeing how this isn't an isolated case, and has been occurring for awhile according to online posts. I'm wondering if overseas support is in on phishing through corporate espionage of being outside the U.S. with lax background checks or just spotty records. For that reason, I'm holding off with direct contact with Credit Karma support. I will let law enforcement and federal agencies contact them on my behalf.

Moreover, I'm sure XXXX will have others pay for this through increased costs and corporate insurance while their stock price keeps increasing. Consequently then, XXXX  XXXX  need to be put under more scrutiny and perhaps be court ordered to host data and provide login through government-vetted organizations that specialize only in XXXX and banking compliance of financial data storage and authentication.