Consumer complaint received 2024-06-19 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Funds not handled or disbursed as instructed
Company: WELLS FARGO & COMPANY
State: CA

Complaint narrative:
Wells Fargo has allowed unauthorized users to access my bank account three times in the last 6 months -- XXXX, XXXX, and XXXX. It appears their security verification for changing online banking passwords is not strong enough -- seems like you only need a phone number or email, or if you have the last four digits of the SSN you can change it, and those are easily found on the dark web. When this happened in XXXX, I asked the bank to open an investigation and they found that one of their customer service agents failed to recognize that someone was impersonating me and had called asking to change the phone number associated with my bank account, so they were able to set it to their phone number, change the password, and withdraw funds. The investigator told me that the customer service representatives didn't catch the fraud because the person calling " sounded confident, '' which was not an indication that anything was wrong. I pointed out that people committing fraud are often professionals and very good at coming across in a certain way, so their security should be more than what appears to be them just checking out the vibes of the person calling. 

Wells Fargo also represented to me that their would be additional fraud alerts placed on my account after the XXXX incident. However, if they did anything like that, it didn't work because my account has now been compromised again. This time, someone was able to change my password without my authorization, and then they granted themselves guest access to my online banking. The hacker was able to transfer {$2500.00} before Wells Fargo 's fraud system caught on and alerted me. It also allowed some of the transactions to go through ; only one was caught and frozen. The hacker overdrew my bank account, so Wells Fargo allowed the {$2500.00} transaction to go through. The hacker also used XXXX to transfer {$950.00} after adding a new recipient. This was not picked up by fraud detection either, even though I had never sent money to this recipient before. There should be some kind of multi-factor authorization or other security measure for adding or sending funds to a new phone number. Wells Fargo did freeze an attempted {$45.00} transfer, but the other money had already been taken. I'm attaching to this complaint emails that I received that indicated that the fraud was occurring. I don't know the people or phone numbers who are listed as recipients in the emails. 

I have been very careful with my online password -- it is not saved in my browser nor is it a password I use anywhere else. I have done scans of my devices for keystroke tracking and have not found anything. I often use my work computer to log in, using XXXX mode, and I work around sensitive information so the security on the work devices is very high. The problem seems to be with Wells Fargo not having effective security. I have been a customer for 10 years, but I am going to close my account and move my money to a bank with better security practices.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with non-monetary relief