Consumer complaint received 2025-07-29 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Funds not handled or disbursed as instructed
Company: UNITED SERVICES AUTOMOBILE ASSOCIATION
State: VA

Complaint narrative:
Below is the documentation of a successful scam attempt by an individual impersonating USAA, and the subsequent mishandling of the case by USAA. 

On XX/XX/XXXX at XXXX XXXX  I received a text from USAA, identifying itself as USAA Alerts, claiming that suspicious activity had occurred on my debit card and I was to reply with a " Yes '' or " No '' to authorize or unauthorize. I replied " N '' immediately, and was prompted with a text saying I will receive a call from automated services. I will attach photos of these texts. 

At XXXX XXXX, I received the expected call. The individual identified themselves as a USAA representative from the fraud and security department and explained that my debit card ending in xxxx ( they had my information already ), had been used for multiple fraudulent charges and we will need to cancel it to secure the account. They explained that the card was compromised along with my XXXX account, as the card had been added to XXXX XXXX and XXXX XXXX. To rectify this, we established that the card would be cancelled and he would initiate sending a new card to my address, which he also read off to me. This whole process took about an hour, in which I asked many clarifying questions and not a single red flag was raised. During this time, he asked me to verify my account by providing a one time pin that was sent to me, by the actual USAA number during this process, as well as providing my logon pin. This is the exact same process that occurs when I verify my identity when I talk to the real USAA. Other than these two identifiers, I did NOT provide any personal information. This individual had already compromised all the other personal and financial data needed to flawlessly interpret the USAA fraud department.

The last 30 minutes of the call the individual walked me through adding my now cancelled debit card to XXXX XXXX and XXXX, the two attempted transfers according to him. He ensured me that because my card was cancelled, this would just be to ensure that XXXX and XXXX would not allow any further transfers on this card and this would secure my card. We did so, and every transaction was declined as expected and the individual was satisfied with the results. He explained that we would need to follow up again on Monday to transfer my funds into a new checking account to be sure none of my checking account information was compromised. Before we hung up, he advised me to change all my passwords and pins, update my XXXX Account, and monitor for any activity on my account over the weekend, which I did vigilantly. Throughout this entire process, the individual did not make a single mistake when guiding me effortlessly through the USAA interface to allow me to do these things. This individual clearly had access to my account and information, and was looking at the dashboard himself to guide my hand. 

On Monday, XX/XX/XXXX at XXXX XXXX, as scheduled, The same representative handling my " case '' called me again to follow up. He explained that USAA will be setting up a new checking account for me and we will need to transfer funds. This is when the funds actually went through. He told me that my account would be locked for an hour but then he would call back with my updated checking information. Still, no red flags had been raised, as this is the level of involvement from USAA security that I had expected. Ultimately, about {$9000.00} in funds were transferred - the entirety of my checking account. 

On Monday at XXXX XXXX  I called USAA to get an update as I had not heard anything back yet. To my utter shock, the security department informed me that there has not been any fraudulent activity on my account at all and the individual I was speaking to was not from USAA. I immediately explained the situation and was assured by the security department on Monday XX/XX/XXXX, that at the very least, the XXXX and XXXX XXXX fraudulent charges would be refunded and the wire would be the more difficult one to achieve. She also explained that this exact scam has become exceedingly common amongst the members and explained ways to avoid in the future, which were besides the point. 

Still, I am shocked that the actual USAA did not detect any of the actual suspicious activity that was occurring, especially given their frequency. I was able to add my account to XXXX Pay and XXXX, neither of which I have EVER used before, and transfer over {$5000.00}. Additionally, I was able to send an ACH wire transfer, which I have never used before, without any flagging or locking from the actual USAA security systems. The initial contact with declined payments occurred 3 days before any funds were actually transferred. This was ample time for USAA to detect, lock my account, and contact me about the real suspicious activity. 

Come Monday, XX/XX/XXXX, after having called multiple times a day every day since the XXXX, I received a notification from USAA that my XXXX XXXX case had received a resolution. The letter stated that there was no error and I will not receive a refund because : For this transaction, the service provider is responsible solely for the transfer of the funds. Since the funds were sent in exchange for goods and/or services to be provided by the recipient, and the funds were successfully moved, the dispute will need to be settled with the recipient directly. 

This reason is completely irrelevant to the details of my case and is entirely dismissive of the traumatic event that I have experienced due to this companys inability to protect its members from an unsettlingly frequent scam that has been occurring for years. The response is clearly automatically generated and provides no indication that the information and letters I provided on the case were even looked at. 

It is now Tuesday, XX/XX/XXXX and I have received no direct personal communication from any USAA official regarding this case. I have called multiple times a day since the event transpired, explaining my situation to a new representative every time, and they assure me that everything is being done and they have no capability to escalate this. 

After doing further research in regards to this exact scenario, I have found a troubling pattern of this scam and a concerning trend for how USAA handles these cases. 

These scams are not the fault of the members. These criminals follow a scam pattern that USAA is intimately familiar with and whose systems should be designed to detect and lock a members account when these patterns arise until the member is made aware and resolves the issue personally. In addition, the pattern of these large, fraudulent transactions is completely out of normal for my account usage patterns. For transactions of this volume to occur within such a short period of time should have triggered escalated fraud protection such as a hard account lock, or even a short lock period of 2 hours, and would have prevented this entirely. For USAA to be unable to eliminate this threat through simple measures that are commonplace in other financial institutions and that USAA has implemented in the past, while being fully aware of this particular scam for nearly 3 years, is a frustrating realization for a member of 25 years. 

Furthermore, notifications to USAA members about fishing scams are general in nature and are NOT specific to this very specific, targeted scam, on USAA members. Given the prevalence of this issue, as informed by XXXX XXXX XXXX XXXX, USAA management should prioritize communication with its members to protect them. 
Additionally, USAA corporate officers have publicly stated in reports, news outlets, and elsewhere, their knowledge of this particular scam and that members impacted by it would be assigned an account takeover team and USAA would do everything possible to restore members funds. The handling of this case along with the resolution provided on XX/XX/year> explicitly violates this promise. 

My wife and I are graduate students working to pay for our degrees and never seeing this money again will have repercussions that I would rather not think about. I have expressed the severity of this attack on multiple occasions, explaining that in a few days we will no longer be able to pay our rent or our bills. We feel abandoned by the institution that I have banked with for 25 years.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation