Consumer complaint received 2024-08-17 00:00:00
Product: Checking or savings account — Checking account
Issue: Problem with a company's investigation into an existing problem — Was not notified of investigation status or results
Company: TRUIST FINANCIAL CORPORATION
State: VA

Complaint narrative:
This is the text of a letter I sent to Truist on XX/XX/XXXX. To date, I have not heard one word from the bank : I have received from you a letter, addressed to my corporate name, XXXX XXXX XXXX, and dated XX/XX/XXXX, which after an apparently circuitous route reached me nearly two weeks later. The letter was to inform me that my personal and business information had been stolen through a security breach involving a small number of Truist employee accounts, but that I should be assured you are not aware of any fraudulent activity on my Truist account as a result. 

Your letter also informed me that this security breach occurred around XXXX XXXX, XXXX, but that despite your cybersecurity team promptly taking steps at that time to assess the situation, you did not determine until XX/XX/XXXX, that my business information was among the affected files. You did not provide an explanation for the seven-month lag between your discovery of the breach and your discovery that my information had been accessed. 

Meanwhile, it turns out that on XX/XX/XXXX, someone made an online application for a credit card through XXXX XXXX XXXX in Maryland using my business name and other personal information. At about the same time, an online application using my personal information was made for a line of credit with XXXX XXXX XXXX XXXX in South Carolina. Both fraudulent applications were denied, but Ive subsequently had to put a freeze on my accounts at the major credit rating agencies and Im still waiting to have the hard credit inquiries removed. 

I think its reasonable to think, although I cant prove as much, that these unprecedented identity theft attempts were a direct result of your security breach. So although my Truist accounts may not be compromisedyetthe information you collected from me has been used in fraudulent activity at other financial institutions. Your letter makes no mention of this possibility, nor does it present any corrective action Truist might take in that regard. 

On XX/XX/XXXX, I visited my Truist branch in XXXX and met with branch manager XXXX XXXX to ask if he knew about the XXXX XXXX security breach, whether that breach was localized or system-wide, if any other Truist customers in XXXX had been affected or what kind of criminal investigationas claimed in your letter to mewas being conducted. XXXX XXXX said he was unaware of the security breach and did not know the answers to any of my questions, but that he would contact the head office and see what he could learn. 

On XX/XX/XXXX, XXXX XXXX sent me an email saying he had been unable to obtain any information from your office and still could not answer my questions. He added, however, that he had requested that someone from the head office contact me directly to respond to my concerns. To date, that has not happened. 

Your letter therefore tells me very little while providing a lot of hollow assurances that everything is under control. Among those assurances is the claim that youre working closely with law enforcement to support their criminal investigation, which seems unnecessarily vague and non-specific. Whatever investigation is being conducted has not included any effort to contact me. 

On XX/XX/XXXX, I filed a criminal complaint with the XXXX Police Department, case no. XXXX, about the two fraudulent attempts to obtain credit from XXXX XXXXXXXX XXXX and XXXX XXXX XXXX XXXX XXXX I dont know that I would have bothered, if not for the fact that the application to XXXX XXXXXXXX XXXX XXXX while including my XXXX home address and other personal information, also provided a different local address to which the credit card was to be mailed. I think this is what people in the criminal investigation business call a clue. 

To date, as far as I know, no one has followed up on that clue. Moreover, as far as I know from the scant information youve provided, no one from your criminal investigation with an unspecified law enforcement department has contacted the XXXX Police Department to compare notes. I beg you to prove me wrong. 

The bottom line is that despite your belated notice to me and your many honeyed assurances, I really dont think anyone is taking this too seriously. I realize that cyber-theft and compromised online information are widespread and possibly chalked up as a cost of doing business by large financial institutions, but such incidents are of course far more meaningful and damaging at the street level at which most of us live. Its also why skeptics like me do as little on-line banking as possible, eschew social media and steer clear of the cloud. 

If you have any substantive information you can provide in response to the questionsimplicit and otherwiseIve raised above, Id be happy to hear from you, but save yourself the time and effort if all you can provide is more empty rhetoric. Oh, and one other thing : I have no idea if this letter is being sent to the best address, because Truist ( and its not just you ) goes to great lengths not to provide analog points of contact. You have my address ; I think its only fair that I have yours. And no, I dont want to call one of your client care representatives, because doing so will take more time than writing this letter has -- -plus I think theres a lot to be said in having things set out in black and white.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation