Consumer complaint received 2026-06-01 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Funds not handled or disbursed as instructed
Company: NAVY FEDERAL CREDIT UNION
State: KY

Complaint narrative:
COMPLAINT AGAINST NAVY FEDERAL CREDIT UNION Failure to Answer Basic Account, Privacy, Third-Party Vendor, and Security-Breach Questions ; Suspected Data Misuse and Resulting Fraud Calls Complainant submits this complaint against Navy Federal Credit Union ( Navy Federal or NFCU ) for refusing to provide a substantive written answer to basic questions concerning Complainants accounts, Navy Federals third-party vendors , a publicly reported XX/XX/XXXX data exposure or security incident, and the privacy/data-sharing practices affecting Complainants personal and financial information. On or about XX/XX/XXXX, Complainant contacted Navy Federal Credit Union seeking answers concerning account-related privacy, vendor, data-security, and breach-notification issues. Navy Federal refused to answer the substance of the inquiry in writing and instead directed Complainant to call by telephone. On XX/XX/XXXX, Complainant submitted the following written inquiry through Navy Federals eMessaging system : Did Navy Federal Credit Union suffer a Security Breach about XX/XX/XXXX. What is the name of the third party vendor of NFCU that suffered such breach? Was it XXXX? XXXX? When did Navy Federal Credit Union notify members? What remedy is Navy Federal Credit Union providing to members. We have noticed an uptick on offers for credit from companies we have not corresponded to. On XX/XX/XXXX, Navy Federal responded : Thank you for using Navy Federal 's eMessaging Service. In order to assist you further, it will be necessary for you to contact us by phone at XXXX. Thank you. This was not a substantive answer. Navy Federal did not deny the breach, did not identify the relevant vendor or vendors, did not state whether XXXX XXXX, XXXX, or any other mortgage, credit, analytics, servicing, marketing, or technology vendor was involved, did not state whether Complainants information was accessed, disclosed, shared, exposed, sold, processed, modeled, analyzed, or otherwise used, and did not state whether any member notice, remediation, monitoring, suppression, opt-out, investigation, or correction process was available. Complainant has contested Navy Federals XXXXdata-collection, privacy, and vendor-related practices in other CFPB complaints. Navy Federals refusal to answer basic written questions is especially concerning because Navy Federals privacy notices indicate that personal information may be collected, shared, processed, and handled through multiple categories of systems and third-party relationships. Complainant is entitled to a clear account-specific response concerning whether Complainants personal, financial, credit, contact, transaction, device, behavioral, application, or account information has been shared with, processed by, or exposed through third-party vendors. After these unanswered inquiries, Complainant and/or Complainants household began receiving more than XXXX unsolicited scam calls from persons claiming to offer credit or claiming that Complainant applied for credit. These callers used a false ruse that they had previously sent a reply by United States mail and that Complainant did not respond, so they were following up. These statements are false. Complainant did not apply for such credit, did not request such offers, and did not authorize these parties to contact Complainant. The pattern is consistent with fraud, scam activity, improper lead generation, data-broker misuse, identity misuse, or unauthorized use/disclosure of personal information. Known scammer or suspected scammer numbers include : XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX Complainant does not claim, at this stage, to know whether Navy Federal directly caused the scam calls. However, the timing, subject matter, and content of the calls create a reasonable basis to demand that Navy Federal provide a complete written explanation of its vendor relationships, data-sharing practices, breach investigation, member notification decisions, and any credit-offer, pre-screening, lead-generation, marketing, analytics, XXXX or third-party data-processing practices involving Complainants information. Requested Resolution Complainant requests that Navy Federal Credit Union provide a complete written response, not merely a telephone-only response, addressing the following : 1. Whether Navy Federal experienced, discovered, received notice of, investigated, or was associated with any data breach, data exposure, security incident, misconfigured database, unauthorized access, vendor incident, XXXX exposure, or backup-file exposure on or about XX/XX/XXXX. XXXX. Whether any XX/XX/XXXX incident involved a third-party vendor, contractor, cloud provider, mortgage technology provider, analytics provider, loan-processing provider, data processor, AI vendor, marketing vendor, credit-offer vendor, lead-generation vendor, or customer-service vendor. XXXX. The name of each third-party vendor involved, including whether XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX successor, affiliate, platform, or related entity, or any other mortgage/credit/data-processing vendor was involved. XXXX. Whether Complainants information was included in, accessed through, processed by, exposed by, or otherwise affected by any XX/XX/XXXX event or related vendor incident. XXXX. Whether Navy Federal notified members, when it notified members, how it determined who was notified, and why Complainant did or did not receive notice. XXXX. Whether Navy Federal reported the incident to NCUA, CFPB, FTC, state regulators, law enforcement, cyber-insurance carriers, or any other federal or state authority. XXXX. Whether Navy Federal has offered or will offer any remedy, including credit monitoring, fraud alerts, identity-theft protection, account monitoring, suppression of marketing/lead-generation data, opt-out processing, written confirmation of third-party vendor deletion, or other corrective measures. XXXX. Whether Navy Federal has shared, sold, disclosed, transferred, licensed, permitted access to, or otherwise made available Complainants information for credit offers, pre-screened offers, marketing, analytics, XXXX, call-center analytics, vendor optimization, lead generation, or third-party financial-product offers. XXXX. The categories of Complainants information shared with third parties, the categories of third parties receiving or processing that information, and the purpose of each sharing or processing relationship. XXXX. Whether any third party has used Complainants Navy Federal-related information to generate credit offers, solicitations, calls, mailings, or marketing leads. XXXX. Whether Navy Federal maintains any internal record of Complainants privacy objections, opt-out requests, CFPB complaints, disputed consent, or limitations on data sharing. XXXX. Whether Navy Federal will preserve all records, logs, vendor contracts, audit trails, incident reports, privacy-notice versions, call-center notes, member-message records, vendor tickets, breach assessments, and data-sharing records relevant to Complainants inquiry. XXXX. Whether Navy Federal will provide a written point of contact authorized to answer privacy, vendor, security, and account-specific questions without forcing Complainant into an undocumented telephone call. Complainant further requests that Navy Federal immediately preserve all evidence relating to this matter, including records of Complainants XX/XX/XXXX contact, the XX/XX/XXXX eMessage inquiry, the XX/XX/XXXX response, all account notes, all privacy preferences, all vendor-access logs, all account-access logs, all marketing/credit-offer data-sharing logs, all breach-investigation records, and all records concerning any XX/XX/XXXX Navy Federal or Navy Federal-associated data exposure. Complainant requests that CFPB require Navy Federal to provide a substantive written answer and not evade the complaint by directing Complainant to call a general customer-service number. A phone-only response is inadequate because the issue concerns privacy, third-party vendors, data security, breach notification, possible identity misuse, and evidence preservation. Written answers are necessary to preserve the record and prevent further confusion, misrepresentation, or denial. Complainant also requests referral or coordination, as appropriate, with NCUA, FTC, state consumer-protection authorities, and any other agency with jurisdiction over federal credit-union privacy, vendor-management, data-security, unfair/deceptive practices, scam-call activity, or unauthorized credit solicitation practices. Requested outcome : Navy Federal is demanded to provide a complete written response ; identify all relevant vendors ; confirm whether Complainants data was affected ; explain all member-notification and remediation decisions ; stop any unauthorized data sharing, marketing, AI/data modeling, or lead-generation use involving Complainants information ; confirm preservation of records ; and provide any available remedy or protection for Complainant and Complainants household.

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with explanation