Consumer complaint received 2018-05-12
Product: Credit card or prepaid card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Privacy issues
Company: UMB FINANCIAL CORPORATION (KS)

XX/XX/XXXX : In looking at my XXXX XXXX statement, I saw a link to look at my rewards. In the 22 years I've had this card, I've never used any rewards, ( rewards weren't even around when I started with this card ), so did some investigating to see what I could use them for. I had XXXX or XXXX and some rewards points showing to use. I saw where I could use them as cash back against my balance. So I cashed in XXXX points or {$500.00}. After doing so, I went to look at my transactions and saw not only the one I had just made but also three other transactions. These other three transactions used XXXX points each time in XX/XX/XXXX, all on the same day. Since I had never done anything with rewards points previously, this was suspicious. I noticed that the name on these other three transactions was not my name but another individual. It also had this other individual 's address. I called Cardservices immediately to ask what how this other individual was on my account. They said they would investigate and would get back to me within a few days. I called them back after the allotted time because I had not heard back from them and they said my account had gotten linked to another account somehow. When I asked what they were going to do, they said they were still looking into how that happened to correct it and referred me over to UMB about changing my security settings. I did this changing my username, password and security questions. 

Next day, I tried logging into UMB ( https : //www.umb.comXXXX ) and was not able to ... the security questions that came up were not mine. I discovered that if I logged in through Cardservices ( XXXX XXXX XXXX ), I could using my new security information. But have never been able to login directly to UMB since this began. If I try to, it loops me around from being locked out because the information doesn't match ( the security questions I don't know answers to ) to unlocking my account using my information, then back to the login page to go through it all again. While it recognizes my information to the account, the security does not let me in after I changed it all after finding this other individual linked to my account. 

I was able to get in to my account through my Cardservices login and to my rewards points. I saw where instead of the XXXX or so points I had left after I cashed in XXXX the week before, I only had XXXX and some points. They eventually all disappeared. 

I, in the meantime while waiting for UMB to straighten out the linked accounts issue, had contacted my local credit union about getting a credit card through them. I was then going to transfer my balance over to the new card. I was very uneasy and leary at this point of UMB 's security and if someone else could get to my account and/or card information. As soon as the issue was resolved, I was going to close the UMB account. I will not tolerate lack security. And they did not seem to know what happened or how to correct it. 

XX/XX/XXXX : I logged into my UMB account to see if the balance was {$0.00} after receiving notice that the balance had transferred to the new card. The balance was {$0.00}. I wanted to look at past statements while I was there to look for charges that automatically come out so I could switch them before canceling the UMB card. I wanted to make sure I did not forget about any auto payments. First statement I opened was NOT my statement. It was this other individual 's statement. I was looking at someone else 's balance, credit limit, charges and their credit card number. ( Their credit card number 's first 8 digits are the same as mine but the last 8 are different so I know it's not card number issue ). This was unbelievable and very disturbing to me. I immediately called UMB and canceled my card with them. I'll figure out my auto pays later. I told the customer service rep what had been going on when she asked why I was canceling and she started asking me all of these questions about it and I frankly told her that I was done and they could figure it out. I said that I didn't know if it was a hacking or internal issue but I wasn't playing games any longer with my account and their security. I was also going to try to notify the other individual, since I had their name and address, about the situation so they could protect their account. ( I have sent a letter to them with a copy of their statement I was able to see ). She didn't believe me that I was looking at someone else 's statement. I have attached a copy of the first page of my statement I printed off in XXXX when this situation was first noticed and the first page of the other persons statement that I printed XX/XX/XXXX, both of which I saw after logging into MY account. 

Since I have canceled my UMB card I no longer have this issue and they did give me that {$500.00} credit after about 10 days towards my balance before taking the rest of the points away. But this is completely unacceptable that accounts got linked. They said they had no idea who the points belonged to. That was NOT my first concern. It's disturbing that I had to call and tell THEM they had a problem in the first place. Going through Cardservices it seems to work every time but I may not see my account information but the information of this other individual. Everyone needs to be wary of UMB and watch their accounts closely, not just the charges on their statements if they still get paper bills but their online accounts. This a major security flaw that needs to be investigated by the FTC as I have the feeling I am probably not the only customer who's account/security has been compromised. 

I am an XXXX XXXX XXXX and I know security. I am an honest individual who will not take the other person 's information and use it maliciously. I have notified the other individual of the situation so they can protect themselves. However, the next person that can obtain information in this manner may not be so honest and can ruin another individuals credit. 

As of XX/XX/XXXX, a month after being notified of the problem, UMB still did not have this issue resolved.