Consumer complaint received 2025-10-10 00:00:00
Product: Mortgage — Home equity loan or line of credit (HELOC)
Issue: Trouble during payment process — Trying to communicate with the company to fix an issue while managing or servicing your loan
Company: LoanCare, LLC
State: CT

Complaint narrative:
LoanCare has failed to investigate a report I made to them in early XXXX of a fraudulent password change on an account LoanCare chose to maintain on its computer systems ( without notifying me ) after I canceled a HELOC they were servicing in XXXX. The HELOC was originated through XXXX Bank which had subcontracted loan servicing to LoanCare as it prepared to sell its banking unit to an investor group which renamed the bank XXXX. LoanCares customer service representatives informed me that they had no fraud investigation area or protocols this likely violates FCRA and state regulations and is especially egregious as LoanCare experienced a significant data breach and had failed to inform affected customers, including me, in a timely manner when that breach happened Background I originated a HELOC with XXXX Bank in XX/XX/XXXX, on the advice of my XXXX XXXX  XXXX  Advisor as part of my regular retirement account review. For almost 5 years, I had not used the HELOC, but in XX/XX/XXXX, I used my home equity line of credit to help my sister with a bridge loan so she could purchase a new home in XXXX  before she received her closing settlement from the sale of her home in XXXX. During the 2 months before my sister could repay me, I received notice that XXXX was selling the bank to a private group of investors and that the bank would be renamed XXXX ; XXXX would retain a seat on its board as part of that sale. LoanCare was extremely difficult to work with as I tried to pay off my HELOC balance, with contradictory guidance and delay tactics that cost me additional interest ; those problems were resolved only after I reached out to my XXXX  XXXX  XXXX  Advisor to complain and ask for help. During this process, I received notice of LoanCares data breach, and after researching how much time had expired between the breach and the notification, I decided to end the HELOC, 5 years before it would have expired. LoanCare did not make closing out the HELOC easy, but ultimately acknowledged the loan was settled and released the lien that had been placed on my homes title. Because of the extent of the data breach, I froze my credit at all three agencies, added extra layers of security on my retirement accounts, bank accounts and Social Security and enrolled in my municipalitys fraud alert service for my homes title. I thought all of this would protect me against the effect of this egregious data breach. But it didnt stop LoanCare from doing more harm to me harm I believe originated with the data stolen in the data breach and perhaps involving an insider who knew that LoanCare was maintaining live accounts after customers had closed out their loans. 
The fraudulent change at LoanCare At XXXX XXXX  on XX/XX/XXXX, an automated email arrived in my Inbox from LoanCare, informing me that I had successfully changed my password on my loan account. My account name was in the email as was the location where this request was made ( XXXX, XXXX  ) and a time stamp that did not make sense -- that was for XXXX XXXX XXXX XXXX XXXX, basically from somewhere with a four hour time difference. I did not initiate this password change and was surprised that there was an active account at LoanCare. The email informed me to call the customer service number on my original loan paperwork if I did not initiate the transaction. Even though the XXXX address in the confirmation email indicated it was in XXXX, XXXX, the odd timestamp told me that this fraud likely originated somewhere overseas, 4 hours ahead of XXXX XXXX XXXX. 
I had to wait until XXXX XXXX to call to reach someone at the XXXX LoanCare customer service area. The LoanCare automated system recognized the number I was calling from, but asked me to key in the last 4 digits of my SSN just to be able to reach a representative. Through all the " press this, press that '' instructions, the system told me when my last payment was made ( XXXX of XXXX ) and other details about my old loan. I was shocked that so much information was available to be heard from just entering the last 4 digits of my SSN. Clearly LoanCare had not increased security measures after the data breach. The first representative I spoke with told me that LoanCare does not have a Security or Fraud department, and that all she could do is to reassure me that my account was paid off and closed. I told her I was following the instructions in the email I had received from LoanCare to report a fraudulent password change, but she said that there was nothing more she could do for me. I insisted on speaking with someone who would investigate. Finally, she offered to transfer me to the technology area. There I spoke with someone who asked more verification questions and promised she would " write up a ticket '' for the technology area to research how a password change could be processed by their system without a two-factor verification code ( I verified that there was no code sent to my phone ). She acknowledged that although I had closed out my HELOC, LoanCare was maintaining a profile with my personal data on their system for future needs ; that account was linked to my closed out loan. After I told her I would never knowingly do business with LoanCare again, she offered to wipe that profile off their system and add notes on my historic closed account about this fraudulent attempt to take control of my expired account. She had no answers to my questions about why Customer Service could not help me. Our conversation closed with her sharing that the ticket would expire in one week, whether or not I was contacted and that I might not get an answer. After hanging up with her, I was uncomfortable, and I wrote to my XXXX XXXX XXXX Advisor asking for his help again with LoanCare. 
Attached to this complaint are two files. One file contains all the email correspondence with XXXX about LoanCares handling of this report of fraud. In spite of the numerous promises that I would hear from their bank complaint unit, I never received a call, email or letter from XXXX. The second file contains scans of many letters from XXXX serviced by LoanCare ( the address is LoanCares address ). Most arrived 12 to 15 days after the dates on the letters. They appear to have been generated after each email I sent to XXXX and when a XXXX business day period from a previous letter was elapsing without resolving the investigation. I also received a phone call from LoanCare on XX/XX/XXXX, which may or may not have been related to this situation. As I was at a funeral, the call went to my voicemail. When I returned the call, I was told that the call was to verify my contact information only for future marketing purposes the call is described in detail in the email to XXXX of XX/XX/XXXX. I dont believe anyone at XXXX XXXX LoanCare, or XXXX is really looking into this situation everyone is passing the buck as if each complaint was unrelated. I am getting nowhere with LoanCares computer which continues to acknowledge receipt of my complaints and asks for additional time to investigate. 
In addition to this report, I plan to file complaints with the offices of the Attorney General in my home state of XXXX, XXXX XXXX where the email says that the fraud originated ( and where XXXX headquarters are located ), XXXX  where LoanCare is located ; and XXXX, where XXXX ( formerly XXXX Bank ) is located. I am aware that a settlement was reached in the LoanCare data breach case, but based on my reading of the settlement agreement, it appears that neither the judge nor the attorneys representing the class included any residual protection from the use of the stolen data to attempt fraud not even at the organization from which our data was stolen. 
I do not understand how a loan service company can be allowed to operate without having a fraud response process and/or unit to deal with situations like I have described especially an organization with at least one serious data breach settlement in recent history. I do not understand how a bank can offload the servicing of loans that they originate to a loan services firm that can not ensure that data stolen from them isnt used to commit fraud against that banks customers. As XXXX has not delivered on its promise to have its bank complaint unit contact me, I am now reconsidering whether to continue to use them for retirement account servicing. Unwinding the almost 27 year XXXX relationship will take at least nine years due to restrictions on some of the underlying annuity investments. All three of these organizations have lost my trust. 
I am hopeful that the CFPB will see the usefulness of pursuing this matter to help me and other consumers being harmed by LoanCare and XXXX ( formerly XXXX Bank ). I am appreciative of past CFPB actions against institutions that have harmed me, especially the settlement reached with XXXX over its six-year discrimination campaign against XXXX  like me based solely on the XXXX/XXXX  ending of their last names. News of that settlement prompted me to unwind a XXXX relationship with XXXX. Even though banking/lending is highly regulated by the states, it is especially important that a federal resource be made available for situations that cross state lines like this situation. For that reason, I hope that the CFPB prevails in its legal quest to remain a vital service to citizens. Please feel free to pass this information on to any other federal agency interested in regulating banks and their subcontractors and in fighting fraud and identity theft.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation