Consumer complaint received 2026-05-15 00:00:00
Product: Checking or savings account — Checking account
Issue: Problem with a lender or other company charging your account — Transaction was not authorized
Company: NAVY FEDERAL CREDIT UNION
State: PA

Complaint narrative:
-- - GROUND XXXX : SOCIAL ENGINEERING FRAUD VIA NUMBER SPOOFING I was the victim of a sophisticated vishing ( voice phishing ) attack in which the fraudster spoofed Navy Federal Credit Union 's official customer service number. The call appeared entirely legitimate on my end. Believing I was speaking with a Navy Federal representative who was helping me secure my account due to fraudulent activity, I was directed step-by-step through a password reset process. Critically, the caller dictated the specific password I was to enter " XXXX which demonstrates unambiguously that I had no independent intent, knowledge, or control over what was being done to my account. I was not acting as an informed, willing participant. I was being used as an instrument of the fraud by someone impersonating your institution. This is a legally significant distinction. I did not authorize a transfer of funds. I was manipulated under false pretenses by someone fraudulently using Navy Federal 's identity to gain control of my account. The resulting transfer of funds was not an action I took. -- - GROUND XXXX : FORMAL REQUEST FOR TECHNICAL RECORDS I am formally requesting the following records associated with the password reset on my account on XX/XX/year> : XXXX. The IP address and device fingerprint associated with the password reset and more importantly the subsequent transfer of funds. XXXX. The geolocation data tied to that IP address XXXX. The device ID and browser signature recorded for the funds transfer after the password change XXXX. Any one-time passcode ( OTP ) or authentication logs from that session Given that the password entered was dictated to me by the fraudster, it is possible the reset was initiated or completed from a device other than my own. If the IP address or device information does not match my known devices or geographic location, this constitutes direct evidence that the reset was not an independent action on my part- directly contradicting the basis for your denial. I expect these records to be included in your review and provided to me in writing. -- - GROUND XXXX : FRAUDULENT DISPUTES ON A DEACTIVATED DEBIT CARD INTERNAL CONTROL FAILURE Separate from the password reset, I am also disputing fraudulent claims filed against legitimate transactions on my debit card ending in XXXX, which had been deactivated prior to these disputes being filed. These claims which I did not initiate were made against legitimate, recognizable payees including my insurance provider and my son 's extracurricular activity program among other merchants. Despite being filed on a deactivated card, your systems processed these disputes and issued provisional credits to my account. The fraudster subsequently withdrew those funds, leaving my account with a negative balance of approximately {$1700.00}. A deactivated card should not be capable of generating active disputes within your system. The fact that it did represents a clear internal control failure on the part of Navy Federal Credit Union not an action attributable to me in any way. I bear no responsibility for this additional loss, as it resulted entirely from a gap in your institution 's own fraud prevention systems. I am requesting : - Immediate reversal of the {$1700.00} negative balance A full written accounting of how disputes were processed through a deactivated card Confirmation of what corrective measures are being taken to prevent recurrence -- - GROUND XXXX : DIGITAL EVIDENCE OF A PREMEDITATED, MULTI-DAY FRAUD SCHEME Following the incident, I discovered that an unknown Android tablet a device I do not own and have never used accessed my personal XXXX account on XX/XX/year>, XXXX days before the fraud occurred on XX/XX/year>. This is documented in the enclosed screenshots ( Exhibit A ). This unauthorized access was not coincidental. My XXXX account contained bank notification emails, account alerts, one-time passcode messages, and a full history of my legitimate payments and payees. This reconnaissance access on XX/XX/XXXX provided the fraudster with the detailed knowledge necessary to : XXXX. Impersonate Navy Federal Credit Union convincingly during the XX/XX/XXXX call, demonstrating familiarity with my account that made the call appear legitimate XXXX. Identify my legitimate payment history including my insurance provider and my son 's extracurricular program which they subsequently used to file fraudulent disputes on my deactivated card XXXX. Monitor incoming OTP and verification emails in real time during the password reset on XX/XX/XXXX This evidence reframes the entire incident. This was not a spontaneous or opportunistic attack that I could reasonably have been expected to detect and prevent. This was a premeditated, multi-day scheme in which my accounts were surveilled, and my personal information was weaponized against me. The level of sophistication involved further underscores that I was the victim of deliberate, coordinated fraud not a participant in any unauthorized activity.

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with monetary relief