Consumer complaint received 2026-03-09 00:00:00
Product: Checking or savings account — Savings account
Issue: Managing an account — Funds not handled or disbursed as instructed
Company: CAPITAL ONE FINANCIAL CORPORATION
State: SD

Complaint narrative:
I am writing to formally report a persistent security breach involving my Capital One checking account that has not been resolved. This follows a previous incident several weeks ago where a large transfer I made in front of local Capital One staff was met with what appeared to be social engineering attempts by internal employees at the Capital One XXXX in XXXX and a " jamming '' of my external transfer ports, which blocked access to my funds for nearly a month. Although I was eventually able to add an account and make a transfer, after I mailed a notarized letter explaining the situation to Capital One Bank by Mail, new evidence proves a systemic failure in the API security and data-sharing protocols, and that the " Jammed '' accounts are still active and harvesting my account data, and there doesn't appear to be a way to sever the connection. 1. Unauthorized Data Sharing & Connection Anomalies Today, XX/XX/year>, I received an automated notification from Capital One stating that I had connected XXXX XXXX XXXX XXXX ( XXXX ) to my account 30 days ago. This statement is factually impossible. Thirty days ago, my transfer options were entirely jammed, and the XXXX account was one of the unauthorized " jamming '' accounts that I could not remove. These accounts were not added to my account by me. Because I had experienced what Capital One claimed was an XXXX, Capital One closed my accounts without my permission, thereby deleting the external accounts that were previously connected. When my new accounts showed up, there were 3 accounts that had been added to my profile, and not by me and these accounts were jamming the external port, stopping me from making transfers. Please refer to my previous notarized letter that documented the encounter. These accounts appeared to vanish only after I sent a notarized letter to Capital One banking, and was able to link an external account and access my money. Oddly, when I linked the external account, there were no other external accounts showing at all. I thought that Capital One must have deleted them per my request. However, today 's notification proves the connection remains active in the background without my consent or knowledge and against my explicit attempts to delete these external accounts and my requests to Capital One to remove these external accounts. Also, in the notarized letter I sent to Capital One, I asked to close one of my savings accounts and have the sum sent to me in 2 money orders or cashier 's checks to the address on file. I gave very specific directions on how to send my funds. Capital One has not responded and never closed the account, nor sent the funds, and my account, although accessible from the one bank I added, is still linked to the accounts I did not authorize. 2. Technical Evidence of " Account Persistent Hooking '' I am reporting what appears to be Account Persistent Hooking or a failure in the OAuth/API handshake process. I have documented the following : Failed Deletion : When I select " Delete '' for the XXXX account via the app or website, the system returns a " Successfully Deleted '' confirmation, yet the account remains active and visible upon refresh. This was the same problem I already reported and apparently it is not fixed. Bypassing Account Limits : Your platform typically limits external links to three accounts. Currently, my profile shows four active connections ( XXXX and three unauthorized ports- at least one is to XXXX XXXX ). This suggests a bypass of standard system constraints, which makes this appear to be something implemented by a rogue internal or 3rd party node. API Handshake Refusal : It appears XXXX or a third-party intermediary is " refusing the handshake '' to disconnect, effectively keeping a digital key to my Capital One data open despite my revocation of access. 3. Regulatory and Legal Context I have already filed serious complaints regarding these incidents with multiple federal agencies. I am treating this unauthorized re-linking of XXXX as a supplemental security breach. The fact that I am receiving emails confirming data is being shared with an institution I have explicitly attempted to block, while being prohibited by your system from stopping it, is a massive violation of consumer privacy and banking security standards. If your staff previously claimed " no issues '' while these shadow connections were active, it indicates either gross negligence or internal complicity.

Company response to consumer: Closed with explanation