Consumer complaint received 2025-09-16 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Banking errors
Company: WELLS FARGO & COMPANY
State: NC

Complaint narrative:
b'Wells Fargo check ordering process contains a security flaw that exposes confidential customer information when Wells Fargo engages third party providers (for example, XXXX XXXX) for check production. Customer data appears to be protected within Wells Fargos internal domain, but when fulfillment is outsourced the order data is either transmitted outside those protections or the vendor is granted direct access to internal data stores to perform the task. \n\nIn either case, unmasked account information and customer contact data  example: my new checking account number and my new cell number  are being disseminated beyond Wells Fargos internal controls in real time.\n\nThis dissemination is active and ongoing and is enabling bad actors to harvest exposed records for targeted attacks and resale on criminal markets. \nThe artifacts and timelines I have preserved show the pattern is repeatable and broad in scope; based on available indicators, thousands of customer records may be exposed each day.\n\nOn XXXX XXXX XXXX my Wells Fargo online account was compromised. I reported this to Wells Fargo on XXXX XXXX XXXX. They opened new accounts and ordered replacement checks as part of remediation and submitted a check fulfillment job to XXXX XXXX on XXXX XXXX XXXX Somewhere in the order/fulfillment process flow ordering/printing new checks, my new full account number and new cell phone number were leaked to a bad actor who then attempted an SMS smish attack on XXXX XXXX XXXX\n\nDetailed incident description (what happened and how)\n\tXXXX XXXX XXXX: my Wells Fargo online account was compromised in an identity theft scheme. \nXXXX XXXX XXXX I notified Wells Fargo of the accounts that were compromised on XXXX XXXX XXXX. The compromised accounts were closed and new accounts opened. One of the accounts was a new checking account. One of the steps in the new checking account fulfillment process is ordering paper checks.\n\tXXXX XXXX XXXX: I logged into WFB OLB to update my account profile. I replaced my personal cell number XXXX XXXX with my work cell number XXXX XXXX. The work cell number was the only contact number in my OLB profile.\n\tXXXX XXXX XXXX Wells Fargo submitted a check fulfillment job to XXXX XXXX for production. The new checking account number XXXX together with my mailing address and contact phone number XXXX XXXX were included in the new checks order.\n\tXXXX XXXX XXXX: I received an email from Wells Fargo check  confirming the checks order and estimated time for delivery.\n\tXXXX XXXX XXXX: I received an unsolicited smish SMS message from someone posing as a Wells Fargo representative asking for confirmation of a funds transfer from my checking account to a bogus 3rd party account. \no\tThe cell number used was my WORK cell number that I changed on XXXX XXXX XXXX XXXXno\tThe account number referenced in the text was my NEW Wells Fargo checking account opened on XXXX XXXX XXXX.\n\tIn the space of seven days, my new Wells Fargo checking account and my work cell number were somehow disseminated to a 3rd party attacker.\n\tFrom the time the account was opened on XXXX XXXX XXXX to the time the smish SMS text was received on XXXX XXXX XXXX  NO transactions were executed against this new checking account. No checks, no deposits, no direct deposits, no autopay checks, no transaction activity of any kind.\n\tThere was a single OLB session which was when I changed my contact cell number in my OLB profile on XXXX XXXX XXXX.\nSuspected breach vector and impact\n\tThis is clearly a serious active data breach. It is continuing to leak customer information to bad actors who are using it to target vulnerable customers.\n\tSuspected vector: unmasked PII and account numbers present in production artifacts, transmission files, vendor operator views, print spool files, XXXX  manifests, or internal agent screens during the check fulfillment workflow (Wells Fargo  XXXX XXXX or related sub processors).\n\tImpact: unauthorized disclosure of account identifiers and contact metadata enabling targeted phish campaigns, facilitating follow on fraud and contributing to documented financial lossXXXX XXXX XXXXWFB check order confirmation\nSmishing text received XXXX XXXX XXXX

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation