Consumer complaint received 2026-01-27 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: NAVY FEDERAL CREDIT UNION
State: MO

Complaint narrative:
I am submitting this complaint to report identity theft, account takeover, and unlawful denial of fraud disputes, in violation of multiple federal consumer protection laws.

Core Facts ( Undisputed ) My identity was compromised at the identity layer, not merely through isolated transactions An unauthorized party used fraudulent and/or synthetic identity credentials, including a false Social Security number The compromise affected multiple financial institutions and credit systems simultaneously I submitted documentary evidence of identity compromise with my original disputes Despite this, institutions denied the disputes stating no error found The denials failed to address identity theft, account takeover, or unauthorized access This evidence was provided during the initial dispute process, not after denial.

Laws and Regulations Violated 1. Electronic Fund Transfer Act ( EFTA ) Regulation E ( 12 CFR 1005 ) Violations : 1005.11 ( c ) : Failure to conduct a reasonable investigation 1005.11 ( d ) : Failure to determine whether an error occurred 1005.11 ( e ) : Improper denial without addressing evidence Explanation : Regulation E requires a reasonable investigation when unauthorized electronic transfers are reported. Treating each transaction as isolated while ignoring documented identity takeover evidence is not reasonable.

Institutions failed to : Analyze unauthorized access Assess identity compromise Evaluate fraudulent credentials Investigate device/IP anomalies Address identity-layer breaches This renders the investigation procedurally defective and non-compliant.

2. Fair Credit Reporting Act ( FCRA ) 15 U.S.C. 1681 Violations : 1681s-2 ( a ) : Furnishing inaccurate information 1681s-2 ( b ) : Failure to conduct reasonable reinvestigation 1681c-2 : Failure to block identity theftrelated information Explanation : I provided evidence of identity theft and identity verification irregularities. Despite this, inaccurate and fraudulent information was allowed to remain associated with my identity.

Institutions and furnishers : Failed to block identity-theft-derived data Failed to correct inaccurate records Failed to reasonably reinvestigate after notice This constitutes statutory noncompliance under the FCRA.

3. CFPB UDAAP Provisions ( 12 U.S.C. 5531 & 5536 ) Unfair, Deceptive, and Abusive Acts or Practices Violations include : Representing that investigations were completed when they were not Denying disputes while ignoring submitted evidence Shifting burden of identity protection onto the consumer Failing to disclose investigative deficiencies Abusing informational asymmetry Denying fraud claims while disregarding identity compromise evidence is materially misleading and causes substantial consumer harm.

4. Identity Theft Red Flags Rule ( 16 CFR 681.1 ) Violations : Failure to detect red flags of identity theft Failure to respond appropriately to known red flags Failure to mitigate ongoing identity misuse Explanation : Cross-account access, synthetic identity usage, and identity verification failures are explicit Red Flags. Institutions failed to act on them.

5. Gramm-Leach-Bliley Act ( GLBA ) Safeguards Rule Violations : Failure to protect consumer data Failure to detect unauthorized access Failure to respond to known security incidents The compromise of my identity across platforms demonstrates a breakdown in safeguards and response obligations.

Procedural Failure in Original Disputes ( Critical ) In my original disputes, I submitted : Credit bureau correspondence confirming identity verification issues Government and regulatory correspondence Documentation requiring SSN re-verification Evidence of unauthorized access and identity misuse Proof of cross-platform compromise Despite this : Institutions did not address identity theft Investigations ignored identity-layer evidence Decisions were issued without forensic analysis Denials used conclusory language ( no error found ) This violates both procedural and substantive legal requirements.

Requested CFPB Action I formally request : 1. Regulatory investigation into Regulation E violations 2. Review of FCRA reinvestigation failures 3. UDAAP enforcement review 4. Supervisory audit of fraud investigation procedures 5. Mandatory reinvestigation with identity-theft classification 6. Restoration of funds denied through unlawful processes 7. Cross-institutional identity takeover analysis 8. Corrective reporting actions Key Clarification This matter is not a dispute over authorization.

It is a dispute over identity integrity.

Treating identity theft as isolated transactions is legally insufficient and non-compliant.

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with non-monetary relief