Consumer complaint received 2025-06-12 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem using a debit or ATM card
Company: ARVEST BANK GROUP, INC.
State: OK

Complaint narrative:
Subject : URGENT CFPB Complaint Arvest Bank Data Breach, Fraudulent Charges, and Unfair Denial of Dispute Im filing this complaint because Arvest Bank is refusing to refund fraudulent charges that occurred immediately after they exposed my full debit card number and personal information in a data breach, a breach they admitted to in writing. 

On XX/XX/scrub>, 2025, I received a Notice of Data Breach letter from Arvest stating that my full debit card number, first name, and last name were sent in error to another customer by email. That customer admitted to receiving it, deleted the email, and was even asked by Arvest to sign an affidavit of deletion. So, Arvest knows and admits that my card was compromised through no fault of my own.

The letter stated : An internal report containing your debit card information was attached in error to an email sent to one customer.

Were providing IDProtect coverage Well also be closely monitoring these cards for fraudulent activity.

If you see suspicious activity, reach out to us immediately.

As a result of this incident, we are offering you identity theft recovery services at no charge for one year. 

Shortly after that breach on XX/XX/XXXX, XX/XX/XXXX, and XX/XX/XXXX there were unauthorized charges made in Arkansas, where I was not located. I immediately contacted Arvest, filed a dispute, and later filed a new dispute with only the charges that match the breach. Despite this, Arvest is trying to deny my dispute, claiming I filed it too late. But this timeline proves otherwise : Fraudulent Charges Tied to Breach : XXXX XXXXXXXX {$91.00} Monday, XX/XX/year>2025 XXXX {$92.00} Monday, XXXX XXXX, 2025 XXXX XXXX XXXX {$79.00} Tuesday, XX/XX/scrub>, 2025 XXXXXXXX XXXX XXXX XXXX  {$10.00} Tuesday, XXXX XXXX, 2025 XXXX XXXX XXXX  {$31.00} Tuesday, XXXX XXXX, 2025 XXXX XXXX XXXX  {$77.00} Tuesday, XX/XX/year>2025 XXXX XXXX  {$320.00} Friday, XX/XX/year>2025 These charges match the exact days surrounding the known breach, before I even received the letter in the mail. I had no prior way to know my card had been compromised until Arvest told me. And now they are blaming me for the delay, when they acknowledged responsibility in writing and offered identity monitoring for one year.

Even worse, Ive spoken to six different Arvest representatives, and no one will take responsibility, even as theyre referencing a subscription charge I never authorized to try and justify denying my dispute.

I am asking the CFPB to hold Arvest accountable and ensure that I receive a full refund for the above fraudulent charges, My dispute is accepted and honored, especially given the documented breach, Arvest follows the law under the Electronic Fund Transfer Act ( Regulation E ), Arvest provides clear and transparent reasoning for how they are handling this situation which right now seems designed to avoid responsibility for their admitted error.

This experience has caused me enormous stress. Arvest is trying to deflect responsibility even though they themselves caused the breach. I deserve my money back. 

Sincerely, XXXX

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation