Consumer complaint received 2026-06-08 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: UNITED SERVICES AUTOMOBILE ASSOCIATION
State: FL

Complaint narrative:
Product/Service : Checking Account Company : USAA Detailed Description of Issue : I am filing a formal complaint against USAA regarding a catastrophic Account Takeover ( ATO ) fraud event, systemic security failures, and subsequent violations of my consumer protections under Electronic Fund Transfer Act ( EFTA ) XXXX Federal Reserve Regulation E. On XX/XX/year>, a highly sophisticated criminal enterprise initiated an exploit against my financial profile. The attackers utilized telecommunications spoofing technology to mirror USAAs official corporate telephone identity on my Caller ID. The number they called from was XXXX which is the actual customer support number that is listed on the official USAA banking app. Believing I was interacting directly with the legitimate USAA Fraud Department, I was subjected to severe social engineering. Crucially, the phishing link was delivered natively inside the official, pre-existing USAA SMS short-code notification thread on my mobile device. Because USAA utilizes an unauthenticated short-code protocol that allows outside criminals to inject fraudulent hyperlinks directly into a customer 's verified historic bank thread, a reasonable consumer has no technological method to distinguish a real corporate command from an injected exploit. USAA 's reliance on vulnerable communication channels directly enabled this Account Takeover ( ATO ). Simultaneously, I received a text message containing a phishing link under the false pretense that my credentials were being actively hacked and required resetting to a secure " temporary '' password. By manipulating me into using this external link, the unauthorized third party intercepted my authentication credentials and executed an immediate, unauthorized Account Takeover ( ATO ) of my online banking portal. Once inside my secure portal without my actual authority, the unauthorized third party manipulated USAA 's automated system to file fraudulent merchant disputes on old transactions. This triggered a series of internal ledger injections including ACH Provisional Credits, ACH Dispute CR, and error OD fee refunds. The attacker, still masquerading as a USAA agent on the phone, fraudulently claimed these newly injected balances were a " fraudulent loan approved by a third party. '' Under severe coercion and deliberate deception, they instructed me to route {$5000.00} of these provisional funds out via XXXX XXXX to an alleged " support number '' to clear the account. USAA is currently refusing liability, claiming the final external peer-to-peer transfer was " authorized. '' However, under clear CFPB regulatory guidance regarding Regulation E, an electronic fund transfer is legally defined as " unauthorized '' if it is initiated by a person other than the consumer without actual authority to initiate the transfereven if the consumer was fraudulently induced into providing credentials. The root cause of this financial loss was an unauthorized breach of my online platform, unauthorized system manipulation, and the generation of fraudulent provisional credits that should have been flagged by USAA 's internal anti-money laundering ( AML ) algorithms.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation