Consumer complaint received 2025-12-15 00:00:00
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: River Financial Inc.
State: MD

Complaint narrative:
Before the events described below, I had multiple calls and email exchanges with River Compliance regarding my account. I first reported fraud to River on XX/XX/year>, after discovering unauthorized deposits from my external bank account into River. Those deposited funds were later returned by River. During a phone call, River Compliance analyst XXXX stated that the bank deposits were reversed like it never happened. 

On XX/XX/year>, my River Financial account experienced an unauthorized account takeover. An attacker initiated an unauthorized login, changed my password without my authorization, initiated a deposit from my external bank account, immediately converted the funds to XXXX, and sent the XXXX to a wallet I am not associated with. I did not authorize any of these actions. 

River later confirmed the following facts to me during compliance discussions : Multiple failed login attempts occurred prior to the unauthorized access A password change occurred that I did not initiate My device and email were likely compromised This was a targeted social engineering attack exploiting information outside my control The activity was confirmed fraud, not user error Despite these confirmations, River has informed me that it will not reimburse the stolen funds, stating that the loss is solely my responsibility under its Terms and Conditions.

This position raises serious concerns regarding Rivers security practices. River advertises device verification, fraud monitoring, and suspicious-activity detection, yet none of these safeguards triggered or intervened despite : multiple failed login attempts a password change a highly unusual transaction sequence involving a deposit from my bank account, an immediate XXXX purchase , and a transfer of XXXX to an external wallet I was never prompted to enable Rivers XXXX  security feature prior to this incident, even though River has since indicated that this feature could have prevented the fraud. 

The attack closely followed the Mixpanel / CoinTracker data breach on XX/XX/XXXX, publicly acknowledged on XX/XX/XXXX, which exposed user email addresses, location data, device metadata, and transaction context. This information materially enabled the targeted social engineering attack that led to the account takeover. 

On XX/XX/XXXX, I formally requested a written security review from River documenting how this attack occurred and what safeguards failed. The following day, River closed my account, stating : After a careful review, weve made the difficult decision to discontinue our business relationship. As a result, your River account has been closed. No written security findings were provided.

River has declined to explain how an attacker was able to bypass its safeguards, has refused to provide a written security analysis, and has relied exclusively on its Terms and Conditions to deny reimbursement, even after confirming that this was a legitimate fraud event. 

Given the lack of transparency, the absence of a documented security review, and the failure of multiple protective controls, I have no way to independently verify whether this incident resulted from external compromise, internal system failure, or other causes. Rivers refusal to investigate or document the incident meaningfully prevents accountability and shifts all risk to the customer, even in cases of confirmed fraud.

Company response to consumer: Closed with explanation