Consumer complaint received 2024-08-19 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Privacy issues
Company: WELLS FARGO & COMPANY
State: NY

Complaint narrative:
This complaint focuses on Wells Fargo 's failure to protect ( my ) personal information, allowing fraudulent access to my account. There have been two instances where they have demonstrated this negligence. 

XXXX  First instance, details XXXX I purchased a bicycle online helmet from XXXX on XX/XX/year>. I had never use this vendor before, but it had a XXXX XXXX XXXX prefix, so I had assumed it was safe. The sale posted quickly to my account, which shows the vendor was certified by visa ( WF ) to process transactions. 
I received a confirmation from the vendor shortly after ordering and it immediately raised suspicion. The purchased item was not listed, the charged amount was wrong, and the return email address was from a XXXX account. No phone contact was shown on the website, so I tried contacting the email address requesting a ship date and got no response. I waited one week for the vendor to respond, at which time I requested a charge back from Wells Fargo. 
Wells Fargo did contact me via telephone about the charge back. During this conversation, I shared with the Wells Fargo rep my concern that the website was fraudulent and my card information had been stolen. The response from the rep was that there was no reason for concern, the information was safe. 
I had seven reoccurring bills which are automatically billed to the Wells Fargo card. Shortly after the call with WF, the card was invalidated by WF and these transactions started to be declined. Some were late, the damage to my credit is unknown. After some investment in time I was able to get these billed to another credit card. 
On XX/XX/XXXX, I showed up in person to my closest WF branch, a XXXX minute XXXX XXXX XXXX to rectify the problem. I was shocked to find out that someone had called WF, changed my phone and address of record and ordered a new card to be delivered to the fraudulent address. How WF could have allowed this unauthorized assignment is beyond me, and allowing a new card to be sent to the newly minted address is the coup de grace. Clearly WF does not have in place even the most basic protections for my personal information. The vendor website was still in operation at this point, showing WF had not taken any action to shut down this fraud.

WF or their contractors deficiencies in basic securing of personal information are shown to be : XXXX ) Insufficient vetting of the vendor, allowing a scammer to be certified to accept credit cards. 
XXXX ) Failing to act promptly on the fraudulent vendor, with the scammer still in operation after one month. 
XXXX ) Insufficient checks to allow personal account information to be changed via phone with the information derived from XXXX ) & XXXX ) only. 
It took about XXXX XXXX  or travel, waiting and in person interaction with WF to resolve this and another XXXX hours to deal with the mayhem of the declined auto billed transactions that were denied. 

XXXX  Second instance XXXX  WF replaced the card they allowed to be compromised as detailed above and issued a new card. This new card was registered to pay one monthly bill, and for no other purchases. The physical card was not carried and was secured in my home.

Even through the card was unused, I was informed by WF that the card had been used in a fraudulent manner on XX/XX/XXXX. As this card was essentially unused by me, it is quite clear that the card information was compromised at Wells Fargo, again demonstrating their neglect with personal information. 

When the first card was compromised, WF informed me that the most secure way to prevent unauthorized access via the phone was to create a phone passcode with them, which I did. There were several phone calls with WF when the second card was compromised, on none of these phone calls was I asked the passcode, only information which had already been proven to be compromised to verify my identity.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation