Consumer complaint received 2026-04-10 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement — Card was charged for something you did not purchase with the card
Company: PENTAGON FEDERAL CREDIT UNION
State: TX

Complaint narrative:
Please accept this as a second complaint against PenFed Credit Union, supplementing my prior complaint on XX/XX/XXXX regarding a series of unauthorized debit card transactions. This complaint is specific to investigation failures that raise significant concerns regarding fraud detection controls, vendor oversight, and PenFeds refusal to conduct an independent investigation despite clear discrepancies in the third-party alert system and delayed fraud detection. These concerns directly implicate compliance with the Electronic Fund Transfer Act ( Regulation E ). ________________________________________ On XX/XX/year>, I requested a call with PenFeds Consumer Advocacy team. During this call, I was informed that PenFed relies solely on a third-party provider for fraud detection, investigation, and reimbursement determinations. I requested that PenFed conduct an independent investigation due to inconsistencies in the third-party fraud detection and alert system. PenFed declined, stating they do not have access to that system and can not view my dispute or claim number. An independent review was not possible. ________________________________________ I explained to the PenFed advocate an independent investigation is supported due to the inadequate fraud detection controls by their vendor, explaining the unauthorized activity by the same merchant continued over a XXXX period, during which XXXX transactions were processed before any fraud controls were triggered. Only transactions XXXX and XXXX ( from the same merchant ) reflecting the same patternwere identified by their controls as fraudulent and declined. Further explaining- I learned of the fraud when I initially contacted PenFed after my card failed during a gas station purchase on XX/XX/XXXX, PenFed : Did not identify or disclose the prior XXXX transactions Did not inquire about a broader pattern of suspicious activity It was only after I independently accessed my account on that call through the mobile application that I identified the earlier transactions from the same merchant and reported the XXXX processed transactions starting XX/XX/XXXX as unauthorized. This demonstrates : Ineffective fraud controls resulting in delayed fraud detection Failure to identify the full scope of related transactions occuring over 16 days An incomplete and fragmented investigation ________________________________________ Lastly, I explained to the PenFed Advocate, during the recorded call, that an invalid and unsupported basis was used for transaction XXXX - XXXX authorization. Informing her, XXXX security team stated on XX/XX/XXXX that reimbursement will not be issued based on a presumed YES response to a fraud alert dated XX/XX/year>. However : The first unauthorized transaction occurred on XX/XX/year> No fraud alerts were received at the time the disputed transactions occurred ( XXXX ) subsequent transactions from the same merchant ( XXXX ) on XX/XX/XXXX and ( XXXX ) on XX/XX/XXXX were debited from my account The only alerts I received from PenFed Security were on XX/XX/XXXX and XX/XX/XXXX for transactions XXXX and XXXX, which were declined resulting in my card suspension An authorization can not precede the transaction it is intended to validate, nor can an authorization for a single transaction be applied to multiple subsequent transactions without transaction-specific verification. ________________________________________ I requested that the PenFed Customer Advocate add the PenFed Security team ( third-party provider ) to the call on a recorded line. During this portion of the same recorded call on XX/XX/year>, from approximately XXXXXXXX XXXX XXXX XXXX XXXX involving PenFed, its Customer Advocate, and the third-party fraud provider, the following was established : PenFed Customer Advocate representatives stated they do not have access to : The underlying fraud system A case number Transaction-level investigation data They were unable to : Identify the specific transaction associated with the alleged initial fraud alert Provide the transaction amount or merchant tied to the alleged alert Produce any transaction-level validation or authorization disclosures During this conference call, the third-party fraud provider confirmed that a single presumed YES response to an alleged fraud alert dated XX/XX/year> ( XXXX day prior to the first transaction ) was used to attribute authorization for ( XXXX ) XXXX subsequent transactions from the same merchange totaling approximately {$1800.00}. However, the PenFed third-party provider admitted they allowed ( XXXX ) transactions to process on XX/XX/XXXX, but flagged ( XXXX ) other attempts on the same day : Transaction XXXX attempt from day XXXX ( which was transaction # XXXX attempt on XX/XX/XXXX ), reflecting the same pattern, and required additional verification and was declined Transaction XXXX ( which was transaction # XXXX attempt on XX/XX/XXXX ) required additional verification and was declined, and resulted in the suspension of my card PenFed security admitted on the XX/XX/XXXX recorded conference call ( same response on XX/XX/XXXX call ) their actions are based on the alleged ' Y ' response to an alert on XX/XX/XXXX, justifing their approving for the first ( XXXX ) transactions from the same merchant for similar amounts, AND -- - using this basis to refuse to provisional credit during the investigation. ________________________________________ Regulatory Concern PenFeds investigation is not consistent with the requirements of Regulation E, which mandates a reasonable investigation and demonstration that transactions were authorized. In this case : Authorization for the 10 transactions has not been demonstrated The investigation relies on unsupported and non-specific assumptions by a 3rd party in which PenFed can not access Identical transaction patterns have been treated inconsistently PenFed lacks the ability to independently verify third-party findings or complete an independent investigation Consumer harm has not been mitigated ________________________________________ Conclusion This matter reflects PenFed 's breakdown in fraud detection, reliance on unverified third-party determinations, and failure to conduct a complete and independent investigation, and continued unwillingness to remediate customer harm stating 'there is nothing we can do '. PenFeds continued reliance on unsupported authorization assumptions raises significant concerns regarding consumer protection compliance.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation