Consumer complaint received 2023-01-26
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: ALLY FINANCIAL INC. (CA)

Complaint:
My Ally bank account keeps getting hacked, which has resulted in my account balance being unusable. The bank has failed to investigate this, so I don't know how to protect accounts at other companies or how to protect my Ally bank account. 

This all started with a new debit card, which was stolen from my mailbox. Someone spent a total of about {$2500.00} on XX/XX/XXXX, XX/XX/XXXX, and XX/XX/XXXX. I noticed the fraud on XX/XX/XXXX and reported it to ally bank. They cancelled the stolen card, and the charges were refunded. 

On XX/XX/XXXX at about XXXX XXXX, I got an email from Ally saying that a customer service representative had helped me log into my account. That wasn't me. Then I got emails saying I changed my password, email, phone number, etc. I called Ally and was on hold for XXXX XXXX XXXX. I hung up and called again and finally got someone who was able to give me access to my account. The attacker had setup XXXX and was getting ready to send the money out of my account. The customer support agent didn't know how to reverse the changes, I manually reversed what I could, and then I had them freeze the account. I believe they chose not to start an investigation at this time. 

On XX/XX/XXXX, I called and had them unfreeze the account so I could pay my credit card bill. I also sent them a message asking for an investigation into the account takeover since I hadn't heard anything from them. 

On XX/XX/XXXX at around XXXX XXXX, I received an email saying Ally customer support had given someone access to my account, again. And then they changed the username, password, phone number, etc. I called immediately. The customer support agent, named XXXX, said they had just talked to me- but that wasn't me, it was the attacker. XXXX did not ask me security questions- they were clearly very poorly trained. They just reset my username and password when I asked. They did not seem to understand the situation. They kept asking me if I was done. I had to ask them to go through and reset everything. Then I asked for their supervisor, they muted me for about XXXX minutes. I asked again for their supervisor, finally they put me through. 

The supervisor, XXXX, reviewed the situation and opened a case to investigate the agent who did not ask me security questions. Then they added a lock to my account, with a passcode, so it should be impossible for the attacker to get access. Then they opened a fraud investigation. She gave me a ticket number for my interaction with her, which was XXXX. She said I will hear from the back office fraud department within XXXX business days, and to call again if I don't hear anything on Wednesday. 

On XX/XX/XXXX, I still had not heard anything despite Ally twice promising they would investigate the fraud. I still don't have access to my funds, about $ XXXX. I called customer support. The agents transferred me to the wrong department or hung up on me XXXX  times in a row. Finally, I reached someone who did not hang up, and they said the investigation hasn't started yet, and will take another XXXX business days, and I can call again if it still hasn't started.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation