Consumer complaint received 2025-11-26 00:00:00
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Other transaction problem — 
Company: JPMORGAN CHASE & CO.
State: CA

Complaint narrative:
My account suffered an account takeover and high-velocity ACH fraud attack resulting in 227 unauthorized ACH debits totaling ~ {$81000.00} between XX/XX/XXXX and XX/XX/XXXX. I filed a Written Statement of Unauthorized Debit ( WSUD ) on XX/XX/XXXX. Chase refunded only a few isolated entries and ignored the majority of fraudulent transactions despite clear account takeover patterns and Regulation E requirements. 

My Chase bank account was the victim of an account takeover and high-velocity ACH fraud attack, resulting in 227 unauthorized ACH debits totaling {$81000.00} between XX/XX/XXXX and XX/XX/XXXX. None of these ACH debits were authorized by me. 

On XX/XX/XXXX, I submitted a Written Statement of Unauthorized Debit ( WSUD ) covering ALL unauthorized entries. Despite this, Chase : Returned only a few isolated entries from XX/XX/XXXX and XX/XX/XXXX Refused to return the main block of fraudulent ACH debits in the central period ( XXXX XXXX ) Provided no written explanation Did not provide the required provisional credit within 10 business days Has continued to stall and refuse action This fraud involved clearly abnormal velocity and pattern indicators, including : Numerous ACH debits from multiple unfamiliar originators Repetitive unauthorized withdrawals Supposed loan and finance entities pulling funds daily or weekly Activity inconsistent with my normal banking behavior Escalating withdrawal frequency before discovery No matching transaction history prior to the attack These are classic account takeover red flags, and Chase failed to detect them, block them, or notify me. 

Under Regulation E, an ACH debit is unauthorized if the consumer did not authorize it, regardless of whether : A fraudster accessed the account Credentials were compromised The fraudster used login information The pattern was prolonged or disguised CFPB guidance explicitly states banks can not deny claims based on customer negligence, compromised credentials, or delays in discovering the fraud. 

Chase is in violation of : Regulation E Violations 12 CFR 1005.6 Unauthorized EFT liability rules 12 CFR 1005.11 ( c ) ( 1 ) Failure to issue provisional credit within 10 days 12 CFR 1005.11 ( d ) Failure to provide written explanation on why only few transactions are returned Official Interpretation 1005.2 ( m ) -3 Account takeover counts as unauthorized EFT CFPB Compliance Bulletin XXXX Banks can not deny claims due to credential compromise NACHA Rule Violations 2.3.3.2 Unauthorized Entry Return Requirements 3.12 RDFI responsibilities to act on WSUD 7.4 Timely return obligations R10/R11 rules ALL entries from originators must be returned once WSUD is filed Chase selectively refunded only a few transactions and ignored the rest, which violates both Regulation E and NACHA rules. 
Chase has not provided any rationale for refusing to return unauthorized entries in the core fraud period. 

Because Chase has stalled, ignored WSUD obligations, and failed to comply with federal law, I am requesting CFPB enforcement.

Company response to consumer: Closed with explanation