Consumer complaint received 2026-07-02 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: WELLS FARGO & COMPANY
State: PR

Complaint narrative:
The incident in question occurred between XX/XX/XXXX ( initial fraudulent contact ) and XX/XX/XXXX ( date of fraud discovery and reporting ). Despite this clearly defined incident period, Wells Fargo failed to conduct a reasonable, good faith investigation based on relevant and contemporaneous evidence. Instead, the institution relied on incomplete, redacted, non-contemporaneous, and in several instances entirely irrelevant documentation to support its denial. XXXX Case Numbers in reference to : - XXXX - XXXX - XXXX Specifically, Wells Fargo included materials such as XXXX XXXX Inquiry dated XX/XX/XXXX XXXX covering a period from XX/XX/XXXX through XX/XX/XXXX. This information predates the incident by approximately XXXX years and bears no logical or evidentiary connection to the fraud reported in XX/XX/XXXX. The inclusion of such materially irrelevant data raises serious concerns regarding the scope and integrity of the investigation. Additionally, other documentation provided, including a Memo Inquiry dated XX/XX/XXXX, contains vague and incomplete entries such as XXXX XXXX XXXX and Account Linkage Removed and Added, without identifying the originating or receiving accounts, associated devices, counterparties, or authorization details. These omissions render the information non-transparent and unusable for any meaningful investigative determination. Further compounding these deficiencies, Wells Fargo provided XXXX XXXX XXXX that was heavily redacted, obscuring critical data points including merchant name, device location, transmission date, retrieval number, and associated wallet email address. Without these essential identifiers, it is impossible to validate transaction legitimacy, trace activity, or assess authorization. The reliance on such incomplete records fails to meet the standards required under federal law. Moreover, certain records relied upon by Wells Fargo fall entirely outside the incident period. For example, token-related data dated XX/XX/XXXX and XX/XX/XXXX were included, neither of which are contemporaneous with the XX/XX/XXXX fraud event. These records provide no meaningful or probative value in determining whether unauthorized activity occurred during the relevant timeframe. Notably, even within the limited data provided, there are clear indicators of unauthorized access that appear to have been ignored or improperly evaluated. Documentation reflects a device location corresponding to Kentucky ( XXXX / XXXX ), which is inconsistent with my actual location in XXXX XXXX at the time of the incident. Additionally, an IP address ( XXXX ) is identified that does not match any known IP address associated with my residence or devices. These discrepancies strongly suggest unauthorized access, potential device cloning, or account compromise, all of which warranted heightened scrutiny and escalation. Despite these material inconsistencies and indicators of fraud, Wells Fargo concluded that no unauthorized activity occurred and denied my claim. At no point did the institution provide a clear, evidence-based explanation demonstrating how it reached this determination using relevant, complete, and contemporaneous data. Under Regulation XXXX, financial institutions are required to conduct a reasonable investigation, review all relevant evidence, and provide a clear explanation of their findings. XXXX XXXX investigation, as presented, fails to meet these obligations. The reliance on irrelevant historical data, heavily redacted documentation, incomplete transactional records, and non-contemporaneous information while disregarding clear indicators of unauthorized access demonstrates a lack of diligence, transparency, and good faith. \n\nUpon review of the previously referenced page ( Page XXXX ), it is evident that the information provided is not relevant to the subject matter of this complaint and falls entirely outside the defined incident and investigative period. The incident involving identity theft and unauthorized financial activity occurred between XX/XX/XXXX ( initial fraudulent contact ) and XX/XX/XXXX ( date of discovery ). \n\nHowever, the referenced material pertains to a XXXX XXXX dated XX/XX/XXXX, with a date range of XX/XX/XXXX through XX/XX/XXXX XXXX XXXX XXXX XXXX XXXX, predating the incident by approximately XXXX years. There is no reasonable or articulable nexus between the XXXX records and the XXXX fraud event under investigation. As such, this material is immaterial, non-responsive, and lacks any probative or evidentiary value. Its reliance suggests either a failure to properly scope the investigation or an attempt to introduce irrelevant information to support an unsupported conclusion. \n Upon review of the referenced page ( Page XXXX ), the document reflects a Memo Inquiry dated XX/XX/XXXX, with an activity range spanning XX/XX/XXXX through XX/XX/XXXX XXXX XXXX XXXX XXXX XXXX XXXX This page appears to document a timeline of account activity, including my contact with Wells Fargo on XX/XX/XXXX, regarding the reported financial fraud. It further references a change in card status and the issuance of a replacement card, which is consistent with post-incident remediation. However, the document also contains several material deficiencies that undermine its evidentiary value. Specifically, it references a XXXX XXXX XXXX without identifying the source account, destination account, or any transactional details necessary to verify or assess the activity. Additionally, it notes that Account Linkage was both removed and added, yet fails to specify the external accounts, platforms, or entities involved in such linkage changes. The absence of these critical details renders the information incomplete, non-transparent, and insufficient for investigative or evidentiary purposes. Without clear identification of counterparties, account endpoints, or authorization records, these entries can not be reasonably relied upon to support any determination regarding the alleged authorized activity that I XXXX XXXX has not authorized any monitory transfers, movements, or withdraws \n Upon review of the referenced page ( Page XXXX ), titled Token Detail Information, it is evident that the document contains extensive redactions of critical data elements necessary for a meaningful evaluation of the alleged authorized activity. Specifically, Wells Fargo has redacted the Merchant Name, Device Location, Transmission Date, Retrieval Number, and associated XXXX XXXX XXXX. The omission of these key identifiers materially limits the ability to assess the origin, authorization, and legitimacy of the transaction ( XXXX ) in question. Without this information, the document lacks transparency and can not be reasonably relied upon as substantive evidence in support of any investigative findings or determinations. Additionally, the information presented is dated XX/XX/XXXX, which falls outside the defined incident period of XX/XX/XXXX through XX/XX/XXXX. As such, it bears no direct temporal relevance to the reported identity theft and financial fraud and provides no meaningful basis upon which to support a denial or adverse conclusion. \nUpon review of the referenced page ( Page XXXX ), titled XXXX XXXX XXXX, the documentation is dated XX/XX/XXXX and contains multiple data points that raise significant concerns regarding both relevance and investigative handling. The document identifies a device location of XXXX / XXXX. Upon verification, these coordinates correspond to a location in the state of Kentucky. This location is materially inconsistent with my actual location in XXXX XXXX ( XXXX, XXXX ) during the relevant timeframe. This geographic discrepancy should have been a clear indicator to investigators of potential unauthorized access, including but not limited to device cloning, token compromise, or account takeover activity. Further, the document lists an IP address of XXXX, which is associated with an internet allocation managed by the XXXX XXXX for Internet Numbers ( XXXX ). This IP address does not match my known residential router IP address or any device-associated IP address under my control. The presence of an unrecognized IP further supports the unauthorized access. Additionally, the document reflects a timestamp of XX/XX/XXXX at XXXX, which falls well outside the defined incident period of XX/XX/XXXX through XX/XX/XXXX. As such, this information is not contemporaneous with the reported fraud event and lacks direct relevance to the matter under investigation. Taken together, the out-of-state device location, non-matching IP address, and non-contemporaneous timestamp strongly indicate suspicious and potentially fraudulent activity. At a minimum, these indicators warranted heightened scrutiny and escalation by Wells Fargo during its investigation. The apparent failure to properly interpret or act upon these red flags calls into question the adequacy and good faith of the institutions review.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation