Consumer complaint received 2025-02-27 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: UNITED SERVICES AUTOMOBILE ASSOCIATION
State: TX

Complaint narrative:
I have evidence that someone has either cloned the USAA XXXX system/database, or an employee got paid to provide internal information, or a hacker has control of the USAA XXXX  system/database. I also have evidence that USAA is at fault, and has acted very suspiciously without exception in this case.

For several years, I have been a senior IT consultant with a major IT firm. Part of my role is catching scammers and being an educator on cyber security. 

Ive been dealing with an imposter claiming to be USAA XXXX  XXXX. On the evening of XXXX, this individual was able to send identical fraud alert texts in the format of known USAA fraud alerts - still, I didnt click anything in these messages, nor interact with these alert texts in any way.

Approximately one minute later, I received a call from a 210 area code number that routes back to USAA when called. This number was listed on my phone as XXXX. When dialed, this routed to the identical call flow same as their primary XXXX number. Additionally, this is the identical result of other 210 area code USAA numbers provided online via USAA's website.

This individual claimed to be USAA XXXX XXXX, providing the name "XXXX" and an employee ID number. They didnt ask for any info, or to click or provide any information. 

Instead - they politely proceeded through a detailed fraud review of my account, taking several minutes. Without my saying anything but yes this is he, they already had literally every detail of recent activity within my account ready and accessible, which they offered to me proactively, seeking to verify each transaction, per standard fraud practices, patiently and thoroughly. 

The individual already had all my recent banking information with vendors used, amounts, dates, everything. They already had it handy, with exact names, and were asking was this charge of X to vendor Y initiated by you on Z date? Do you trust X vendor? Again - I was not my providing nor asked for any info, not changing my password, had not clicked anything. 

They already had all this information at the beginning of the call, and took the time to ask about each charge over the last week in detail - offering from their side.

They also already knew this was the second fraud alert Id gotten in a week, without my providing this info to them. I'd been alerted on XXXX of suspicious charges to my account via USAA texts, and was later called by a USAA agent to verify, with a much less thorough approach than this individual. In that case on XXXX, the charges were noted as fraudulent, then refunded quickly. 

This individual already knew the exact details of these suspicious XXXX charges - verifying them by name of vendor and amount (offered by them, not me) as part of their thorough vetting of my recent account activity details. They only asked I answer "yes" or "no" for the legitimacy of the charges they would list proactively from their side.

The individual stated, being that this was my second recent suspicious activity alert in a week (their words), that USAA felt they needed improvement with fraud management. The OCC issue a third cease and desist to USAA in five years on these specific practices and others on XXXX 

With a very elaborate, very highly detailed story, told patiently, the individual told me this was an internal investigation from the Cyber Security team into data leaks suspected to have been done by internal personnel within USAA. They explained IT security practices very well, in detail, taking several minutes.

They said their department was reaching out based on the fact that this was - as they offered, I did not - my second suspicious activity alert in the past week. They said this was a new kind of attack on USAA member data that had been recently noted, and to address it appropriately, USAA was making sure to take a more proactive and thorough in securing our account to prevent further attacks, as they'd noted patterns of abuses happening six times in certain cases. Again, they had all these details already, and I had not made any changes to my credentials/revealed any information about my account.

They said they'd found evidence that 6,000 USAA members data had been leaked from individuals suspected as internal to the organization, and that they were taking a more proactive stance as a new matter of company policy to improve their security and fraud practices.

They also already knew and provided, without my divulging, the last 4 of a new debit card being sent to me after the XXXX suspicious alerts. I had not received the card yet, nor been able to view this information in the app yet. They were the first to provide me this information, which was then shown as accurate later via the USAA app.

Then, still without my having provided info, or changed a password, or anything clicked/engaged with - they walked me through (very patiently and accurately, from an IT practice standpoint) how scammers/data leaks can be caught via the use of honeypots.

While Im on the call, still havent done anything/provided anything sensitive (just confirming I am the one talking on the phone), they immediately deposited XXXX into my account. They literally said here we go - watch, we're depositing XXXX internally to facilitate these honeypot tests - and XXXX  was there, and applied to our account immediately in front of my eyes. I had only logged in per my usual security settings, not giving any info to the individual. The funds were available immediately.

The check deposited instantly was addressed to someone elses name and signature on it, but had my name and checking account number already typed in to the deposit slip. This account number, as with all other info, was something I had not provided - they had not even asked about the account number from their side. But there it was, my account number already typed in on a deposit slip and registered to my checking account via Mobile Deposit, funds instantly available.

They said I could see that theyre able to access my account internally without issue, claiming to have admin status, which they repeatedly demonstrated. They said this was for triggering USAA honeypots as part of their internal investigation.

Then, as part of this very complex story about 6,000 USAA accounts being breached via suspected dark web activity, they stated for their investigation to work, I should attempt to send out honeypot tests to all confirmed USAA-owned test accounts on the platforms Paypal, CashApp, and Venmo. 

They said you can see were able to instantly deposit money into your account without issue. Were auditing this process and will be reimbursing you in the same way for any additional expenses. We have the demonstrated capability of internal control of your account." 

"We appreciate your cooperating with us very much - your account is now locked due to the suspicious activity, but this could help speed up the process of getting you clear and safe, as well as help prevent other customers from suffering abuse from these bad actors. Your account is part of a very large, complex internal investigation affecting 6,000 USAA customers. 

They were very cordial, and didnt initially have much urgency, taking the time to accurately explain details of processes have been known in the IT field as valid means to catch scammers.

They then said we needed to get to the root of whats going on internally with USAA with this high-level investigation - needing to call in to USAA Support and Fraud to say nearly all of these tests are not us, but this one is us, so to facilitate the honeypot test, and to prevent all attempts from being treated as suspicious.

While in hindsight the sending request may seem obvious - their descriptions of these processes was in line with modern Cyber Security practices, and further, when calling into USAA via their main line of XXXX, the USAA reps all behaved very suspiciously, and in exact accordance with what the individual said would happen - word for word.

The individual had notified us Monday night XXXX our account was locked due to this new alert he was calling about, soon confirmed by the display in the USAA app, pending the completion of this investigation to stop the data leak. 

The malicious individual was able to tell me in exact detail what would happen with USAA reps on each call, every time, from the kind of behavior to the exact words that would be used, even the policy message onscreen that the USAA rep would read off. 

These calls began the morning of Tuesday, XXXX, and all USAA reps continued only to prove the seeming truth of the individual's story.

The individual was able to provide such details as "They will need to take a long pause, claiming they're reading account notes. This will last several minutes. They won't be able to tell you anything specific, they won't review charges, except that, like I've told you, they'll say there's a high-level internal investigation ongoing. But they'll say they'll make notes on your account, and they'll get back to you later."

The USAA reps, time and time again, would prove the malicious individual exactly right. 

No matter whom I talked with, or what department, the rep would pull up my info, state "I need to read some notes on your account," delay for at least 10 minutes, sometimes longer, sometimes saying they needed to discuss something with a colleague or supervisor. Then, they would refuse to provide any specific information about our own account.

The USAA reps would only state theres an ongoing high-level internal investigation going on. We cant tell you anything at this point, please wait till we can review. These exact same results, per the individual's words, continued for a week, during multiple hours of phone calls attempted daily, going from XXXX  nearly all day every day.

Over and over, the malicious individual (who had a deep voice and a thick French accent) was able to tell me exactly what the next USAA rep would say, verbatim, what would be discussed, and what would not be discussed - they knew the USAA system inside and out, the policy messages provided, and proved continually they were in control via the app. 

Their assertions were additionally supported by official USAA emails on status updates as well. "You'll get a vague email notifying you of this" - we would receive the email. Then, they'd stated "good - this is confirmation we've gotten another step done in this complex investigation. We really appreciate your continued cooperation - would you be willing to provide feedback to USAA?"

When I asked for employee IDs and extensions of the USAA phone reps, as recommended by USAA anti-scam practices, the reps in the Fraud department gave me word-for-word the same answer as this Cyber Security imposter had already provided me for their department when I asked - sorry, we just dont have extensions for this department. These USAA call reps also repeatedly refused to provide employee IDs, another recommendation from USAA anti-scam practices.

This behavior was exhibited on calls on XXXX, as well as another call on XXXX. The malicious individual would always claim "this investigation they're reading about is being handled by my department, but these reps don't have the access, or are not authorized to say this is being done by the Cyber Security team. We're making sure to take note of any suspicious behavior from USAA reps in these calls, and auditing all activity in your account for reimbursement."

This person knows USAAs system better than anyone else Ive talked to. They were able to deposit this XXXX  with no issue in front of us instantly, read off all our account info with exact specifics, continually appeared to restore our access in the app when our account would be locked out repeatedly, and tell us word-for-word and step-by-step what each USAA phone rep would say. They had all this info already, at the beginning of our call Monday evening XXXX, without any actions or info given on our part.

Through the next few days - Tuesday XXXX  through Thursday XXXX, no matter what we stated to USAA reps in the way of "this charge is not legitimate, we don't recognize this XXXX  deposit" - all payments and deposits were applied to our account in the following days. 

However, during this time, the USAA app continually stated it was having issues displaying our account information. Our real balance kept being hidden from us, with a wildly different set of results showing. The individual would repeatedly restore our access - calling in to say "are you able to get in now?" after we we'd been locked out, then taking credit when we were continually unlocked - "great! call you later."

The suspicious and entirely dismissive treatment from USAA reps continued without exception. I didnt know who to trust - they were clearly hiding something, and it appeared this malicious individual, in control of the app and knowing of all sides of USAA systems, was explaining why, as they could accurately forecast every detail of USAA rep's behavior.

This individual was repeatedly able to restore my access on the app when Id be locked out, though I'd not clicked any links or received any such from the individual. They were not using typical spammer techniques. They had initially called in with all my account information proactively offered per a standard fraud investigation, and demonstrated they knew USAA's systems and practices far more accurately and thoroughly than anyone else.

With these access issues, they'd repeat got that taken care for you, you can see we're here inside USAA." They asserted the need to have 8am phone meetings on XXXX XXXX, and XXXX, providing detailed "progress reports" with what info they said could be released as far as the investigation was concerned. They took the time to spend many hours with us on the phone, and were never direct in trying to obtain information.

Even though I spent hours on the phone with USAA, and told them this XXXX check wasnt me, and "this X charge is not legitimate," they have been nothing but suspicious, secretive, and entirely dismissive. All charges have now been applied, and at this time over a week later, no urgency or concern has been sufficiently demonstrated from USAA with this decimation of our account. 

Though we reported the check deposited as suspicious the following day (reported XXXX  after the XXXX deposit from the individual), USAA refused to recognize this request, and only days later when the check was put in a "returned" status was the transaction no longer applied to our account, in spite of all the signs of fraud, on XXXX.

All this time, from XXXX  on, our account was locked, with no access to any funds, pending the results of this high-level internal investigation.

We reached out to USAA Abuse via their XXXX to inquire of this individual's name, employee ID, and department being correct on XXXX as directed by USAA Abuse reps. We have received no response.

The USAA app was continually showing inaccurate information all the week of XXXX, with messages indicating trouble with displaying account information, and to please check later. As a result, it appeared these charges were not being applied to our account, and somehow these "tests" were being facilitated per the malicious individual's description. 

I noted the charges beginning to be applied on XXXX, and then the XXXX  check being placed in the status of "returned." I immediately severed all contact with the malicious individual. We made every step to secure our accounts, making a full sweep of swapping out every aspect of each credential and utilizing biometrics.

With all this confusion via phone and every rep we spoke with, on XXXX, my wife and I went in person to the largest USAA Federal location in XXXX XXXX, by their XXXX XXXX headquarters (or former headquarters now, still a massive USAA complex). We arrived with laptop, phones, and much evidence organized, saying Ive been the victim of a cyber crime, I need to talk with someone in person and share my evidence and story so we can secure our account and help stop this individual.

I was prepared to provide verbose technical details which would be essential to any suspicious investigation, and expected to have our concerns treated seriously. I explained my credentials as an IT consultant with a major firm and our willingness to work with USAA.

Instead, the desk representative openly mocked me, condescended to me as though I was an idiot, failed to listen to the context of the issue, then repeatedly refused to let me talk to anyone, citing policy. They forced me to make more calls to other USAA departments from a cubicle - I did so for multiple hours from the USAA Bank lobby, shocked at this lack of concern and empathy for such a serious string of events.

Even though Ive given thorough history and details of this week of XXXX,  reported these charges/"tests" as done under duress from with the context of this individual already holding our account hostage - USAA has had no urgency, applied everything against my account, and demonstrated a refusal to read documents Ive uploaded detailing the events. 

We engaged in a full week of calls with USAA reps, XXXX Without fail, they always took several minutes to "read some account notes," taking very long pauses (usually at least 10 minutes), then responded only with noting in your account - please wait for our review. 

USAA has thus far repeatedly denied any unusual behavior on the account, and shamed us for our supposedly negligent behavior, when it is their practices with our data that have already been classified criminally negligent by a federal regulator such as the OCC.

Ive had many USAA reps behaving suspiciously - demanding payments with urgency, pressuring us get them to process payments immediately for us, refusing to provide employee IDs or any extensions/means to call back in.

This all on their XXXX  number, which they continually demand as the only method of contact.

The same treatment from USAA has continued into the present - even more gaslighting, mockery of my intelligence, assertion I must prove myself trustworthy to them, even after having been a customer in good standing for 10 years. 

They always taking long pauses to read notes, often say they need to converse with a colleague, then are unable to provide any info, repeated the lines about an high-level internal investigation, and adhering exactly to the malicious individual's forecasts.

USAA has thus far claimed via email and phone that no suspicious activity has been found on our account since XXXX. 

USAA has repeatedly demanded I work this out with them via phone, in spite of the details of this extensive case. I have refused, calling in to the Fraud department on XXXX  to note on the record that I do not consent to any discussion of my account info over the phone. 

I have specified this is due to the nature and context of this case, all via supposedly legit USAA numbers. Ive stipulated the request to meet in person with a qualified representative.

Thus far, USAA continues to show neither concern nor urgency, asserting we are the guilty party. They have openly refused to listen in spite of multiple days of many hours of phone interaction. They have treated us with contempt and condescension.

The amount taken by the individual seems is at least XXXX and may be as much as XXXX - the USAA app still keeps changing the specifics, and has continually been unreliable with the info displayed.

This malicious individual already possessed clear access/control with USAA systems and has looted our account for many thousands of dollars we do not have. 

USAA's actions have always supported the predictions of the individual, while also being incredibly inappropriate and strangely secretive. 

In the midst of this trauma, not being able to trust anyone, our account held hostage but not taken seriously - it has been very difficult to be treated as a liar and a fool entirely at fault with no just cause for complaint by USAA. 

While this was a case of social engineering - it is not limited to social engineering with us. This all began and was directly caused by the individual already having clear access to our account information as well as USAA systems.

The continually suspicious practices and outright dismissal from USAA reps and official emails are playing a major role.

We've been made aware of a number of coverups done in remarkably similar instances since the new CEO of USAA took over, in addition to three cease and desist orders from the OCC in five years (most recently XXXX, others in XXXX and XXXX, unresolved) relevant to these exact practices and departments. 

It is well-established that USAA has been repeatedly criminally neglectful in the management of customer data, up to and including the present. We are living proof of this criminal negligence.

This individual was already in, already had all our information, and used their pre-existing access to abuse our bank account beyond what we'd thought was possible with existing USAA security measures.

Given USAA's demonstrated record, and legal precedence, it is clear this gross mismanagement is currently abusing many loyal customers.

We believe, given the continually suspicious and scamlike behavior from USAA reps on multiple officially verified channels, that there is much more to this story. We have seen over and over that USAA is attempting to hide information from us, and it would seem very likely there is at least some level of internal involvement with this malicious individual. 

USAA is refusing to acknowledge this issue appropriately, and it is quite clear customer data continues to be in danger via USAA's cited criminal negligence.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation