Consumer complaint received 2025-09-19 00:00:00
Product: Checking or savings account — Checking account
Issue: Problem with a lender or other company charging your account — Transaction was not authorized
Company: U.S. BANCORP
State: CA

Complaint narrative:
This is an update to our previously filed CFPB complaint ( Case XXXX XXXXXXXX ) regarding fraud on our U.S. Bank XXXX XXXX Since that filing, we have obtained additional information and are resubmitting with supporting exhibits for clarity. 

On XX/XX/XXXX, an unknown individual fraudulently accessed our U.S. Bank business account and added XXXX XXXX as an employee on our profile. We do not know this person, and no such individual has ever been associated with XXXX XXXX XXXX XXXX XXXX. Using that access, the fraudster opened a credit card under her name tied to our business ( Exhibit XXXX  ), changed our XXXX  address from XXXX XXXX XXXX XXXX XXXX XXXX, XXXX, CA XXXX to XXXX XXXX XXXX XXXX, XXXX XXXX, KS XXXX, and changed our business phone number from ( XXXX ) XXXX to ( XXXX ) XXXX. U.S. Bank processed these changes without safeguards or verification. 

On XX/XX/XXXX, an {$8000.00} transfer was attempted from our personal account ending XXXX. The transaction failed, but we were not notified at the time. We only learned of this when we later called U.S. Banks fraud department after the fraudulent debit had already occurred. Had we been notified, it would have put us on alert before the larger fraud. 

On XX/XX/XXXX, the fraudster logged in from a new XXXX, Oregon XXXX address using a new device ending in XXXX. U.S. Banks own records confirm this IP and device were first seen only on XX/XX/XXXX. Despite this suspicious login, no one-time passcode ( OTP ) was generated or sent. Once inside, the fraudster created a new payee, XXXX XXXX, and processed a {$13000.00} external ACH debit ( Exhibit XXXX  ). This was the very first external XXXX debit on our account. All prior transactions had been internal transfers between our U.S. Bank accounts or U.S. Bank credit card payments. The debit also went to a new and unfamiliar bank, Minnesota XXXX XXXX  XXXX. Approving this anomalous payment reflects a breakdown of U.S. Banks security controls. 

On XX/XX/XXXX, we received mailed notice of the unauthorized address change. We immediately logged in, discovered the fraudulent debit, corrected our phone and address, and filed Claim XXXX XXXXXXXX. At that time, U.S. Bank itself XXXX our online access, acknowledging that the account had been compromised. 

Between XX/XX/XXXX and XX/XX/XXXX, we repeatedly followed up with our bankers XXXX XXXX and XXXX XXXX but received no information ( Exhibit XXXX  ). On XX/XX/XXXX, we learned secondhand from XXXX that the fraud team had sent questions to a branch XXXX, XXXX XXXX, whom we had never worked with. He never contacted us, which blocked us from responding directly. On XX/XX/XXXX, once we learned of these questions, we provided responses through XXXX. 

Despite our diligence, U.S. Bank denied both our initial claim ( XX/XX/XXXX ) and reconsideration ( XX/XX/XXXX ) under Claim XXXX XXXXXXXX ( Exhibit XXXX  ), citing consistent login patterns. This contradicts their own evidence showing a new XXXX, new device, and no OTP triggered. 

On XX/XX/XXXX, banker XXXX XXXX acknowledged to us in writing that our online banking had been compromised ( Exhibit XXXX ). On XX/XX/XXXX, U.S. Bank issued its information used during the investigation letter ( Exhibit XXXX  ), confirming the suspicious login from XXXX and the absence of an XXXX. This document actually supports our case, demonstrating U.S. Bank ignored multiple red flags. 

Total fraudulent loss : {$13000.00}. To date, no reimbursement has been made.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation