Consumer complaint received 2025-09-17 00:00:00
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Other transaction problem — 
Company: WELLS FARGO & COMPANY
State: NC

Complaint narrative:
Incident summary On XX/XX/year> I initiated XXXX transfers from my Wells Fargo checking account ending XXXX to a legitimate recipient I added. I completed a {$1.00} transfer and a {$500.00} transfer. On XX/XX/year> I attempted a second {$500.00} XXXX transfer and Wells Fargo sent an email stating the payment was under review. XXXX hour later I received a phishing email branded as Wells Fargo that linked to a malicious endpoint. XXXX hours later I received a legitimate Wells Fargo email stating the second {$500.00} XXXX transfer could not be completed, the XXXX transfer was blocked, and my Online Banking access was XXXX. I did not authorize any transfer to the bogus recipient referenced in the phishing email and believe an unknown actor observed or intercepted my XXXX activity then used that information to stage the phishing attack. 
Detailed timeline ( chronological bullets local XXXX ) Tue XX/XX/year> XXXX AM You added a XXXX recipient. 
Tue XX/XX/year>XXXX XXXX XXXX  You sent money with XXXX {$1.00}. 
Thu XX/XX/year> XXXXXXXX XXXX XXXX transfer successful {$500.00}. 
Fri XX/XX/year> XXXX XXXX I attempted a second legitimate XXXX transfer for {$500.00}. 
Fri XX/XX/year> XXXXXXXX XXXX Wells Fargo email : Your XXXX payment is under review ( second transfer attempt for {$500.00} ). 
Fri XX/XX/year> XXXXXXXX XXXX Phishing email received ( branded as Wells Fargo ). The message contained an image that linked to a bad actor endpoint. 
Fri XX/XX/year> XXXX AM Wells Fargo email : Your XXXX payment could not be completed ( second transfer attempt for {$500.00} ) ; The XXXX transfer was blocked ; Online Banking XXXX. 
Suspected attack vectors and observations The phishing message closely followed the banks review notice and contained a link to a malicious endpoint, indicating near real time interception or access to notification metadata. 
XXXX disablement and the banks blocking action indicate detection or attempted unauthorized access. 
Core conclusion My devices and mailbox have been scanned and verified clean. Merchant/processor log leaks or exposed cloud storage are excluded to the XXXX window between email events. The XXXX event was captured in real time by an integration or partner that receives live bank events ( webhooks or streaming APIs ) and included the notification address or enough identifiers to resolve my email address. The attacker used that live feed access or abused its credentials to craft and send the timely phishing message. 
High probability real time capture vectors ( excluding phone, mailbox, recipient portals, and exposed logs ) Compromised bank partner XXXX or partner endpoint A partner endpoint that XXXX XXXX XXXX XXXX events to ( XXXX XXXXXXXX XXXX XXXXXXXX XXXX XXXXs compromised, misconfigured to accept unauthenticated traffic, or had leaked signing keys. The attacker received the event payload in real time and it contained the email delivery target or identifying metadata. 
Abused aggregator / XXXX XXXX with streaming access A finance aggregator, bookkeeping app, or reconciliation service you ( or a related party ) authorized had API/webhook access to transaction streams. An attacker who stole its API key, admin credentials, or OAuth client secrets could read live events as they were produced. 
Compromised integration middleware or iPaaS connector Integration platforms ( XXXX, XXXX, custom middleware ) that route bank webhooks to downstream systems can be hijacked. If a connector token or flow was compromised, the attacker could siphon events in real time. 
Insider access at a partner or integration provider An employee or contractor with access to the live event stream, admin console, or webhook deliveries could exfiltrate events as they occur and hand them to attackers. 
Man in the middle at an integration broker or intermediary service A breached or malicious intermediary that proxies webhook traffic could observe and forward live events without touching your devices or the banks primary logs. 
How the attacker linked the event to your email without mailbox or phone compromise The live payload included the delivery address or an explicit recipient field. 
If the payload didnt include the email, it contained strong identifiers ( name, partial account, memo, invoice id, timestamp ) that the attacker immediately resolved to an email by querying breached datasets, vendor contact lists, or an authorized aggregator that stored the mapping. 
Access to the integrations configuration could reveal routing rules showing which email the bank notification was delivered to. 
Why timing and specificity were possible Webhooks and streaming APIs are near real time ; with access, the attacker could detect the under review event and send a phish within minutes. 
Supporting evidence attached XXXX. XXXX IP XXXX XXXX. Email Header Analysis for phishing email received from XXXX XXXX XXXX. Email Header feom phishing email received from XXXX XXXX XXXX. You addeXXXX XXXX XXXX XXXX XXXX XXXX XXXXecipient.msg XXXX. You sent money with XXXX XXXX XXXX XXXX .msg XXXX. You sent money with XXXXXXXX XXXX XXXX XXXX XXXX XXXX. Your XXXX ( R ) payment could not be completed.msg XXXX. Your XXXXXXXX XXXX XXXX XXXX payment is under review.msg

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation