Consumer complaint received 2026-04-23 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Other problem
Company: CAPITAL ONE FINANCIAL CORPORATION
State: CA

Complaint narrative:
I am writing to complain about CapitalOnes website allowing hacker to repeatedly reset my password using other phone number not in my profile then change my phone number, email, and address in my online account. This annoying issue started at the end of XXXX XXXX. After I clearly reported this security backdoor multiple times since early XXXX XXXX, CapitalOne did not take any action to block this security loophole. Instead, CapitalOne penalized me by freezing my online access, going through time-consuming ID verification on me in order to recover my online access, and replacing both my credit card and debit card, which have nothing to do with this specific security loophole. Once online access recovered, the same hacker continued using the same backdoor to reset my password then access my online account repeatedly in the past two months. Therefore, I am hoping authorities can step in to force CapitalOne to close this security backdoor ASAP. More specifically, the hacker uses the security flaw in the Find Me Tool ( Forgot username or password ) on CapitalOne website to recover my Username by Last Name, SSN, and Birthday. Apparently, this hacker got my personal information somewhere. Once the Username is recovered, CapitalOne allows using a NEW phone number XXXX controlled by hacker ( rather than my phone number in my account profile ) to reset my password then access my account. Once in my account, the hacker replaces my phone number by his/hers ( XXXX XXXX XXXX XXXX ) for text/app verifications as well as changes my home address and email. I received either CapitalOne alert text or email in each move by the hacker. The home address used by hacker is XXXX XXXX XXXX XXXX XXXX XXXX, XXXX, NJ XXXX. Several emails were used by hacker, e.g., XXXX, XXXX, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX Besides accessing my online account via this security backdoor, this hacker also tried to apply for CapitalOne and XXXX XXXX cards using my personal information between XXXX XXXX and XXXX XXXX, XXXX. Note that CapitalOne and XXXX just merged into one company recently as such the two fraudulent applications seem highly related. And somehow this hacker never tried my personal information on other banks, e.g., XXXX, XXXX, XXXX, XXXX, etc., I also have business with. On XXXX XXXX, XXXX, the hacker got my credit card number from online account and tried to make a fraudulent charge {$50.00} with XXXX In the latest fraudulent access to my online account on XXXX. XXXX, XXXX, this hacker obtained credit card number from the account again and tried to make a $ XXXX online purchase with XXXX XXXX Since the hacker doesnt have credit card expiration date and CVV code, which are only available on physical card, the transaction was declined and a text alert sent to me, while I was in the middle of a meeting. When I followed CapitalOnes instruction to call in verifying the fraudulent transactions about 2 hours later, the hacker attempted again making a {$50.00} online purchase with XXXX during my phone conversation with CapitalOne representative. I noticed that CapitalOnes credit card and banking branches are operating completely independently as such no one really cares or is capable of resolving this online access security flaw, which has nothing to do with the physical credit card and debit card. And I found that as a victim I am instead penalized by the prolonged period of time spent with CaptialOne representatives and the inconvenience of online account being frozen as well as repeated ID verifications, which were proven to be useless, not addressing the real website security loophole. I repeatedly told CapitalOne representatives that whenever a new phone number to be used for resetting password, the same ID verification process should be implemented. But unfortunately each CapitalOne representative only focused on his/her narrow area without willing to take extra step resolving the real website security issue, which he/she probably has no control at all.

Company response to consumer: Closed with non-monetary relief