Consumer complaint received 2025-09-25 00:00:00
Product: Checking or savings account — Other banking product or service
Issue: Managing an account — Banking errors
Company: SOFI TECHNOLOGIES, INC.
State: CA

Complaint narrative:
Re : Formal Complaint Against XXXX Mishandling of Potential Unauthorized Access & Security Negligence I am writing to file a formal complaint against SoFi Bank, XXXX. and its parent company XXXX XXXX XXXX XXXX for a series of potential security failures and repeated refusals to properly investigate or respond to clear indications of unauthorized access to my financial account. 



Summary of the Incident : Today, at approximately XXXX XXXX, I received a two-factor authentication ( XXXX ) code via text message from XXXX official XXXX  short code the same number XXXX always uses for login verification. I had not attempted to log in at that time, which immediately raised concern. 

I logged into my XXXXXXXX XXXX XXXX and checked the XXXX XXXX section under the XXXX tab. There, I found a pattern of nearly daily logins using the XXXX browser over the last XXXX  days. I do not use XXXX and have not authorized any apps or individuals to access my account. 



Inconsistent and Misleading Responses from XXXX : When I contacted XXXX about this, I encountered a disturbing series of conflicting explanations : XXXX. Initial Chat Support : The agent told me that XXXX is aware of an ongoing issue with XXXX logins, and said they would be adding additional security to my account. 
This implicitly acknowledged a security issue yet no further steps were taken, and no follow-up was provided. 
XXXX. XXXX  Phone Call to Customer Service : The first customer service agent I spoke with said she could not see several of the XXXX logins I was seeing in my own login history. 
This raises serious concerns about what internal access XXXX agents have to security logs and whether login activity is being monitored properly. 
XXXX. Call to XXXX Department : A woman from the security team told me, verbatim, that XXXX logins are literally nothing to worry about. 
She suggested the logins were probably from an app I had given access to, but I have not authorized any third-party apps to access my XXXX account XXXX 
She dismissed my concerns entirely without any actual investigation or offer to review the access logs. 
XXXX. Level XXXX XXXX XXXX ( Later Call ) : They told me the login activity was authorized and likely related to XXXX reviewing transaction activity. 
However, this claim makes no technical or operational sense. XXXX does not log in to individual customer bank accounts through consumer-facing browsers. 
XXXX. Request for Login Records Denied : I requested the full login logs including XXXX addresses, device IDs, and geolocation and was told that XXXX could only confirm the activity came from XXXX. 
As I explained to XXXX, XXXX geolocation is easily spoofed using VPNs or masking tools. The geographic claim provides no assurance of legitimacy. 



Why This Is a Serious Concern : My XXXX account holds a large personal loan, in addition to checking, savings, and investment balances. The repeated logins via an unfamiliar browser, occurring on days with no actual user activity, is extremely concerning. 

The fact that XXXX : Refused to investigate further Dismissed the issue without looking at the full logs Gave conflicting explanations from multiple departments Denied me access to my own security data Told me there is nothing to worry about based on an incorrect assumption demonstrates a severe failure of internal security practices and accountability. 



What I Am Requesting : I am respectfully asking your office to take the following steps : XXXX. Investigate XXXX  handling of this potential unauthorized access. 
Why were daily XXXX logins from an unused browser not flagged? 
Why do customer service agents not have visibility into complete login records? 
XXXX. Compel XXXX to provide me : A complete copy of all login logs for my account ( IP, timestamps, device/browser ID, geolocation ) Internal notes or reports related to the incident or any investigation A copy of my customer file, with any security or fraud case references XXXX. Ensure XXXX improves its internal procedures, including : Immediate escalation of suspicious login reports Access to full login and access logs for customers upon request Transparency and consistency in responses from their security department Supporting Documentation : I am prepared to provide : Screenshot of the XXXX code sent by XXXX at XXXX XXXX  Screenshots of XXXX login history shown in my app Full logs of my conversations with XXXX representatives via phone and chat Copies of my requests to XXXX complaints team and their responses This situation demonstrates a pattern of negligence and deflection, not a good-faith effort to resolve a potential breach. I am formally requesting that your office hold XXXX accountable under applicable financial protection, data security, and consumer complaint laws. 

Please confirm receipt of this letter and let me know the best way to submit supporting evidence. 

Sincerely,

Company response to consumer: Closed with explanation