Consumer complaint received 2025-04-27 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: NAVY FEDERAL CREDIT UNION
State: GA

Complaint narrative:
On XX/XX/year>, I was targeted in a sophisticated spoofing scam. The scammer called from XXXX, which is the legitimate number for Navy Federal Credit Union. They impersonated a representative from the Fraud Department and had full access to my online banking account during the call. This was an unauthorized access event conducted through AVoiP spoofing and social engineering. 

While speaking with a legitimate Navy Federal fraud and security representative later, I was told my online banking was compromised on XX/XX/year>, at XXXXXXXX XXXX for a total of 1 hour and 2 minutes. 

During that time, XXXX unauthorized transactions were made : {$1000.00} withdrawn from my joint account {$4900.00} withdrawn from my primary checking account Total unauthorized losses : {$5900.00} Timeline & Claim Handling : XX/XX/year> : {$1000.00} provisional credit issued to joint account XX/XX/year> : {$4900.00} provisional credit issued to primary checking account ( email confirmation attached ) XX/XX/year> : {$1000.00} provisional credit was reversed XX/XX/year> : {$4900.00} provisional credit was reversed Key Issue : Despite clear signs of account takeover, Navy Federal failed to classify this as an unauthorized electronic fund transfer under the Electronic Fund Transfer Act ( EFTA ). The fact that the scammer navigated my online banking account and executed transfers without my authorization, following a spoofed call from Navy Federals own number, shows that I did not initiate or approve these transactions. Their refusal to accept liability contradicts both federal law and CFPB guidance. 



Relevant Law : Under the Electronic Fund Transfer Act ( EFTA ) and 12 CFR 1005.11 ( Regulation E ) : If a consumer is deceived by someone impersonating a bank representative and an unauthorized transaction occurs, the Consumer Financial Protection Bureau ( CFPB ) has clarified that a bank can not deny liability solely because the consumer was tricked into providing access credentials. This includes phishing, spoofing, and AVoiP fraud. 

Navy Federal can not shift the liability to me when : 1. I was fraudulently deceived via a spoofed call, 2. My account was remotely accessed and compromised, 3. Navy Federal has already acknowledged this compromise. 
Added Section : Involvement of XXXX XXXX ( XXXX XXXXXXXX ) In addition to Navy Federal Credit Union, I am including XXXX XXXX ( XXXX XXXXXXXX ) in this complaint, as the fraudulently transferred funds were sent to a XXXX XXXX  account that was unauthorizedly linked to my profile. 
I did not link this XXXX XXXX account, nor did I authorize any transaction to it. 
This fraudulent XXXX XXXX account was able to bypass proper verification, receive funds, and complete a transaction using my compromised Navy Federal account. 
XXXX XXXX has not taken responsibility, reversed the fraudulent transaction, or explained how the unauthorized account was allowed to link and withdraw such a large sum.

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with explanation