Consumer complaint received 2026-05-04 00:00:00
Product: Checking or savings account — Other banking product or service
Issue: Managing an account — Problem accessing account
Company: PNC Bank N.A.
State: PA

Complaint narrative:
I am a PNC Bank customer. Between approximately late XXXX and early XXXX, my personal account was accessed without a legitimate business purpose by XXXX XXXX ( XXXX ID XXXX ), a Federal Mortgage Loan Originator at the XXXX XXXX branch in XXXX, XXXX XXXX XXXX was my partner of approximately five years at the time. In XX/XX/XXXX, XXXX XXXX disclosed in writing via text message that PNC had identified his access to my account and issued him a final written warning. He also disclosed that PNC had specifically instructed him not to access accounts of individuals he knew personally indicating PNC was already on notice of this policy concern. The business purpose he provided to PNC for accessing my account checking my interest rate for a " rate exception '' was not accurate. My rate exception had been processed in XX/XX/XXXX at the XXXX XXXX PNC branch by a banker named XXXX. XXXX XXXX was not working that day ; he accompanied me to the appointment as my partner. He was personally present when the rate exception was completed and had no legitimate need to " check '' it later from the XXXX branch. XXXX XXXX also verbally disclosed to me that he had accessed my account in XX/XX/XXXX, around XXXX. He admitted that he typed in my information, viewed my transaction history, and immediately clicked out of the account. While this disclosure was verbal rather than written, it indicates that the documented XX/XX/XXXX incident was not the only unauthorized access of my account. On XX/XX/XXXX, XXXX XXXX sent a group message via personal device to two PNC coworkers Lead Teller XXXX XXXX and banker XXXX XXXX discussing our relationship and my concerns about his interactions with those coworkers. This communication demonstrates that the unauthorized access to my account occurred in the context of overlapping personal and workplace dynamics involving multiple employees at the same branch. On XX/XX/XXXX, I sent a written message to Lead Teller XXXX XXXX requesting that her communication with XXXX XXXX remain professional only. She attempted to contact me by phone after I declined further communication. On XX/XX/XXXX, I submitted a formal complaint through the PNC customer portal ( Reference # XXXX ) requesting a privacy audit of all employee access to my account, including dates, times, user identification, and business purpose. Executive Client Relations Specialist XXXX XXXX acknowledged the complaint on XX/XX/XXXX, and I spoke with him by phone on XX/XX/XXXX. He assured me that PNC was taking this very seriously and assisted in placing a verbal password on my account. Despite my formal request, I received no written documentation of the investigation findings. On XX/XX/XXXX, I contacted PNC through the secure messaging portal for a status update on Reference # XXXX. A PNC portal agent acknowledged the message and stated she had " forwarded the details of your experience to the proper area, '' but no substantive update on the investigation status was provided. Later the same day, a separate PNC representative contacted me by phone. I do not have a record of this representative 's name. During that phone call, the representative refused to provide any information about the investigation and stated I would need a subpoena to obtain any details whatsoever. This response indicated that PNC was not willing to communicate basic procedural information about my own privacy complaint without legal compulsion. After more than 60 days without a written response from Executive Client Relations, I sent a follow-up email on XX/XX/XXXX, citing the Pennsylvania Breach of Personal Information Notification Act and requesting written confirmation of audit findings, scope of access, and whether the access complied with PNC policy . On XX/XX/XXXX, I sent additional emails attaching documentary evidence. On XX/XX/XXXX and XX/XX/XXXX, XXXX XXXX responded but refused to provide any information in writing and attempted several times to continue the conversation by phone. His initial refusal cited email security concerns ; when I offered to receive the response through PNC 's own secure message portal, this was also declined without explanation. As of XX/XX/XXXX, XXXX XXXX XXXX shows XXXX XXXX remains actively authorized to represent PNC at the XXXX XXXX branch. As of the date of this complaint, PNC has not provided a written accounting of who accessed my account, whether the access was authorized, whether my information was improperly used, or what corrective actions were taken. I am requesting a full written audit of all employee access to my account and confirmation of whether any policy violations occurred. Given XXXX XXXX 's verbal admission of the XX/XX/XXXX access, I am also requesting confirmation of whether the audit covered all access to my account, not only the XX/XX/XXXX incident PNC initially flagged. XXXX XXXX also told me that the reason he was flagged in XX/XX/XXXX was because we shared the same address at the time. If PNC 's controls only flag access when an address match is detected, this raises serious concerns about the adequacy of PNC 's access control framework. Why wasn't the XX/XX/XXXX access flagged when we also shared an address at that time? I work professionally in cybersecurity and compliance, and underwent a 6C public trust clearance investigation in order to access sensitive customer data in my own role. The apparent reliance on address-based access flagging as a primary control falls well below the standards expected for protecting non-public personal information. The average bank employee should not have easier access to a customer 's full financial information than a cleared professional has to data under formal background investigation procedures. I have since changed my address on my account, but I have no confidence that PNC has implemented sufficient controls to prevent further unauthorized access by the individuals named in this complaint. Because of PNC 's handling of this matter, after being a PNC customer for six years, I have begun the process of migrating all of my finances to XXXX XXXX. Every day I check my PNC app and wonder who can see my information, because PNC has not taken my complaints or my evidence seriously enough to provide me with any written confirmation that my account is secure.

Company response to consumer: Closed with explanation