Consumer complaint received 2021-12-22
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Unauthorized transactions or other transaction problem — 
Company: WELLS FARGO & COMPANY (CA)

This statement is regarding fraud that I experienced that put an undue financial burden on me. On XX/XX/2021 I checked my Wells Fargo Mobile app at approximately XXXX XXXX and I noticed two fraudulent charges ( one for {$99.00} in XXXX, FL and one {$14.00} XXXX XXXX charge ). I have never authorized anyone else to use my card at any point in time and I have no ties to any part of Florida, so I knew they were fraudulent. At XXXX XXXX, I received a text message ( from XXXX ) asking if I authorized an attempted {$450.00} charge at XXXX. I said no. At XXXX XXXX, I called Wells Fargo, dialing the number that is on the back of my debit card ( XXXX ). I spent a little over a minute on hold when I saw the same Wells Fargo number I dialed ( XXXX ) calling me at XXXX. I answered, and the man on the phone identified himself as a Wells Fargo employee and he addressed me by name before I introduced myself. He offered an employee ID number and said he was on a recorded line. He said he was calling about fraud on my account. He proceeded to list off personal information of mine such as my bank account numbers and my address, along with my first and last name. He then proceeded to ask me about charges on my debit card, asking me to confirm whether charges were legitimate or not. He was able to reference legitimate charges as well as the fraudulent ones I listed above. I do not know how he would have been able to see all of that if he were not a Wells Fargo employee. He told me he was going to send me a new debit card in the mail, asked if my address was still the same, I said no and I gave him my updated address. He then asked me if I had authorized charges on XXXX for {$2500.00} and {$1000.00}. I said no because I had not. He said that since the charges were still pending, I would not see them in the app. He said that the only way to reverse them would be to XXXX myself the money and that would cancel it out. He had me input my own email address into the recipient field. I had no reason to believe something with my email would go anywhere but to my own account. He said that since XXXX was a third-party app that this is how they chose to do things, which was different from debit fraud. Once I sent the money, I received an email from XXXX XXXX saying my money had been deposited in a XXXX XXXX Checking  account ending in ****. I do not have, and have never had, a XXXX XXXX account. Within a second of receiving the email, he hung up on me and I knew I had been defrauded. I immediately called the legitimate Wells Fargo, filed a police report, filed a report with the FTC, and filed a report with the FBI 's IC3. 
Wells Fargo did not take basic security precautions to prevent this from happening. Someone clearly accessed my bank account on another device which is how they were able to read off my personal information. On sites like XXXX and XXXX, if my account is accessed from a device I have never used before, I receive push notifications and emails on my device. Wells Fargo did nothing of the sort. Why is my social media more secure than my bank? I also did not receive notice of any kind that my XXXX information was now tied to a different bank account. Additionally, on XXXX XXXX XXXX 's mobile banking app, they offer a warning that XXXX will never ask you to XXXX yourself and that this is a scam. Why does Wells Fargo not take this basic precaution? 
I have spent a collective total of over 14 hours on the phone with Wells Fargo and they say the transactions were authorized. 
I told a Wells Fargo employee that according to CFPB 's Regulation E, these transactions were considered unauthorized and they are still refusing to reimburse the money. 
From CFPB 's website : Yes. As discussed in Electronic Fund Transfers Error Resolution : Unauthorized Fund Transfers Question 1, Regulation E defines an unauthorized EFT as an EFT from a consumers account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit. 12 CFR 1005.2 ( m ). Comment 1005.2 ( m ) -3 explains further that an unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery. Similarly, when a consumer is fraudulently induced into sharing account access information with a third party, and a third party uses that information to make an EFT from the consumers account, the transfer is an unauthorized EFT under Regulation E.

For example, the Bureau is aware of the following situations where a third party has fraudulently obtained a consumers account access information, and thus, are considered unauthorized EFTs under Regulation E : ( 1 ) a third-party calling the consumer and pretending to be a representative from the consumers financial institution and then tricking the consumer into providing their account login information, texted account confirmation code, debit card number, or other information that could be used to initiate an EFT out of the consumers account, and ( 2 ) a third party using phishing or other methods to gain access to a consumers computer and observe the consumer entering account login information. EFTs stemming from these situations meet the Regulation E definition of unauthorized EFTs.