Consumer complaint received 2025-07-02 00:00:00
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Unauthorized transactions or other transaction problem — 
Company: Block, Inc.
State: MA

Complaint narrative:
Subject : Formal Complaint Regarding Data Breach, Impersonation Scam, and Negligent Account Security To the CFPB, I am writing to file a formal complaint regarding a serious security incident that resulted in financial loss due to a sophisticated impersonation scam, which I believe was a direct consequence of data breaches at both Coinbase and Cash App, combined with severe negligence in account security by Cash App in Mid XXXX of XXXX approximately one month after being a victim of an AI Coinbase personal recovery specialist who called me while on the phone with a real Coinbase representative making it seem very authentic and indicated that the impersonator somehow tapped into Coinbases phone system in Mid XXXX around the XXXX of XXXX 

I started noticing the daily multiple attempts to charge my Cash App Card multiple times per day around exactly a month after being victimized by the Coinbase worker impersonator. I became aware of multiple security vulnerabilities and a lack of responsiveness from Cash App concerning a past data breach that I had found out about, was never informed about, have contacted them multiple times, and there has been no responsiveness from Cash App concerning a past data breach in addition to not responding as to why they did not flag the multiple daily charge attempts that went on for at least three months. Despite my repeated attempts to contact Cash App and their settlement XXXX, I received no response or assistance regarding the potential compromise of my account information. 

The most significant event occurred on XX/XX/year>. On this date, while on an legitimate phone call with a XXXX representative, a fraudulent Al impersonator, claiming to be a Coinbase recovery specialist, called my phone from a XXXX California number. This imposter, who was a real person mimicking an Al, managed to intercept or spoof my ongoing call with the legitimate XXXX representative. This highly sophisticated tactic strongly suggests that the imposter had access to real-time information related to my Coinbase activity, likely obtained through the XXXX data breach that was later announced. 

When I subsequently contacted XXXX to report this incident, they unfortunately dismissed my concerns, stating it was a " security problem on my end. '' This dismissal occurred even after I had sent a detailed letter to XXXX a week prior to their public detailed letter to XXXX a week prior to their public announcement of a data breach, outlining my concerns about their security. 

Believing the imposter to be a legitimate recovery specialist and under the impression that they were assisting me in recovering my lost Coinbase wallet ( which I lost due to XXXX 's reported " lack of security purposes '' ), I inadvertently paid this individual via Cash App. Although I became suspicious before paying the full requested amount, I did transfer some funds. 

Approximately XXXX to XXXX weeks following this payment via XXXX to the fake XXXX XXXX XXXX XXXX began experiencing an alarming number of unauthorized attempts to charge my Cash App card. For a period of two to three months, I received multiple charge attempts every day, all day. While my Cash App card had no funds at the time, I purposely allowed these attempts to continue with no amount in my account to build a clear record of Cash App 's complete failure to detect, flag, or stop these suspicious activities. Cash App took absolutely no action to protect my account or investigate these continuous fraudulent attempts, even though they occurred daily for an extended period. 

As a direct result of Cash App 's negligent security practices and lack of response, and the initial exploitation of the XXXX data breach, I have sustained financial losses and suffered significant distress. I have since deleted my Cash App profile and attempted to reach out to the settlement XXXX for the Cash App data breach, but have received no contact. 
I believe this incident highlights : o A severe lapse in data security by both XXXX and Cash App, leading to the exploitation of my personal and financial information. 
o A sophisticated impersonation scam that leveraged leaked information to appear highly credible.

o Gross negligence on the part of Cash App in monitoring and protecting user accounts from continuous fraudulent activity, even when no funds were present.

o A sophisticated impersonation scam that leveraged leaked information to appear highly credible.

o Gross negligence on the part of Cash App in monitoring and protecting user accounts from continuous fraudulent activity, even when no funds were present. 

I urge your office to investigate this matter thoroughly. I have attached all relevant documentation, including communication records, dates, and screenshots of the fraudulent Cash App attempts. I am available to provide any further information required for your investigation. 

Thank you for your time and attention to this urgent matter. 
Sincerely, XXXX XXXX

Company response to consumer: Closed with explanation