Consumer complaint received 2021-04-03 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem using a debit or ATM card
Company: REGIONS FINANCIAL CORPORATION
State: AL

Complaint narrative:
On XX/XX/21 my sim card deactivated from my cell phone for the first time around XXXX am XXXX. After dealing with that issue and reactivating my XXXX card at XXXX pm CST, I checked my gmail email and noticed an email from Regions Bank indicating that there was a new device log in on my account at 11:48 am CST on 3/16/21. I immediately tried logging in Regions bank on my work desktop and my password would not work. I called the Semmes, AL branch, and they informed me that I have been hacked and immediately need to go to the nearest branch. I immediately went to the XXXX branch in XXXX, AL and spoke with a representative there who confirmed that all of our accounts were cleaned out, with the exception of a pre-paid card called a Now Card - which won't let you transfer electronically. The accounts cleaned out included our main household checking account, a college savings account, my XXXX XXXX XXXX son 's student account and my XXXX XXXX XXXX son 's student account. I was told that someone had obtained access to our accounts online, opened a XXXX account and transferred {$800.00} to someone named XXXX XXXX XXXX bank shut down online access, but did not feel the accounts needed to be closed, so they were left open. After returning from the bank around XXXX pm CST, I saw an email in my gmail account indicating a new device log in at XXXX am PDT in my yahoo account - which shows it was a safari mobile device in Florida. My yahoo email account is linked to my bank, Facebook and Paypal accounts. I tried logging in to my yahoo account but it wouldn't accept my password. I was ultimately able to change it and regain access to my XXXX account. I called the XXXX Police Department XXXXancial Crimes who asked me to email an account of what happened, which I did on XX/XX/21. Ultimately I had to report it to the county Sherriff 's office and was provided a case number. 

After thinking we had everything under control, on XX/XX/21 my sim card again deactivated from my cell around XXXX pm CST. After discovering it an hour later, I again went through the steps with my phone provider and reactivated the card at XXXX pm CST. At this point, I was not connecting the deactivation of my sim card to the compromise of my bank account of XX/XX/21. Around XXXX pm CST on XX/XX/21, I checked my XXXX email and received a notice that someone XXXX have accessed my XXXX account at XXXX pm CST. I tried logging into facebook but it would not accept my password. I also received another email that there was a new log in to my XXXX account at XXXX pm CST on XX/XX/21 from a device in Florida. I immediately went to XXXX and could not log in there either. Ultimately I recovered both accounts within minutes only to discover that someone had put in a transfer of {$2300.00} from my bank account. This person also tried to transfer {$20.00} from my XXXX XXXX to a person called " XXXX XXXX ''. I immediately reported the unauthorized transactions to XXXX and XXXX. On XX/XX/21 I discovered that the bank allowed this transaction to occur causing our family account to be - {$1700.00} XXXX we had about {$600.00} in there XXXX. I called the XXXX number and reported the unauthorized charges. Thankfully this was resolved rather quickly and we received our {$600.00} back the following day. On XX/XX/21 after visiting my local branch, it was decided to secure the main account by only allowing deposits XXXX was waiting on a tax check ). At this point, I removed my bank account from XXXX and XXXX Pay and deactivated my XXXX account. I changed all of my financial accounts and bills, etc to a gmail address. We still at this point did not have online access to our bank account. 

On XX/XX/21 around XXXX pm CST my sim card deactivated from my cell again. I immediately reactivated it and started checking all of my accounts because at this point, I know now that someone was accessing my sim card to get online log in temp codes. I immediately checked my gmail account and received a notification that a temp code was texted to my cell at XXXX am XXXX. The email said that my XXXX account was being reactivated. I immediately went through the steps to report this to XXXX and change the password, and I'm still trying to get that account closed permanently. On XX/XX/21 I immediately removed my sim card from my phone and purchased another phone with a new sim card. 

On XX/XX/21 at XXXX pm CST I received a call from my XXXX asking if I filed for unemployment benefits. XX/XX/21 it was confirmed through the XXXX XXXX Unemployment office that someone tried filing under my identity. 

XX/XX/21 I received a letter from Regions bank indicating that my claim for the {$800.00} that was taken from us on XX/XX/21 was denied. Their reasoning was because my XXXX yr old son had access to my online banking credentials. The problem is that my son of course had access because all of our accounts were linked together. When I took him to get a student card, nobody told us that he had to have his own sign in. He has an active account that is linked to mine and has every right to access it. He has a job and was at work at the time the compromise began on XX/XX/21. 

On XX/XX/21 I reported my identity theft with the Federal Trade Commission. I also placed an alert with the credit bureaus. 

I apologize for all of the information above that appears irrelevant to the {$800.00} denied to us, however I just wanted to show that my identity has clearly been stolen which should have been taken into consideration by Regions. My son checking his account on his phone has nothing to do with my sim card getting hacked. The compromise clearly came from from my device through the hacked sim card.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief