Consumer complaint received 2026-05-07 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Banking errors
Company: U.S. BANCORP
State: AR

Complaint narrative:
XX/XX/XXXX Consumer Financial Protection Bureau XXXXXXXX XXXX XXXX Washington , DC XXXX ( Submission contemplated via consumerfinance.gov/complaint with this letter and the enclosures attached as supporting documents. ) Re : Complaint Against U.S. Bank National Association Inadequate Investigation, Inadequate Customer Communication, and Failure to Reimburse {$53000.00} in Unauthorized ACH Transactions ( Account ending in XXXX ) Dear Consumer Financial Protection Bureau : XXXX XXXX XXXX XXXX XXXX ( formerly XXXX XXXX XXXX XXXX XXXX ) ( XXXX ), an Arkansas business, submits this complaint against U.S. Bank National Association ( U.S. Bank ). XXXX account is a commercial deposit account, and XXXX acknowledges that some of the consumer-protection statutes and regulations the Bureau ordinarily enforces including Regulation E do not apply to commercial accounts. XXXX nonetheless brings this complaint to the Bureau because the conduct described below an inadequate fraud investigation, an unsubstantiated denial of reimbursement, a closing communication that contained no findings, and a formal response that mischaracterizes the customers contact implicates U.S. Banks customer-communications and dispute-handling practices generally, and because the Bureaus public complaint database serves an important function in documenting patterns of conduct by federally regulated financial institutions. Complainant and Subject Institution Complainant : XXXX XXXX XXXX XXXX XXXX ( formerly XXXX XXXX XXXX XXXX XXXX ) Address : XXXX XXXX XXXX, XXXX XXXXXXXX XXXX XXXXXXXX Authorized representative : XXXX XXXX, XXXX ( XXXX ) Subject institution : U.S. Bank National Association Account : U.S. Bank commercial deposit account ending in XXXX, accessed through the U.S. Bank XXXX ( commercial online banking ) platform. Summary of the Complaint On XX/XX/XXXX, an impersonator obtained XXXX XXXX credentials by means of a phishing telephone call that displayed a U.S. Bank-branded caller-ID and email communications sent from XXXX, U.S. Banks legitimate SinglePoint customer-service email address. XXXX XXXX promptly notified U.S. Bank by email and telephone the same day. On the XXXX Customer Service call, U.S. Bank told XXXX the Account had been flagged with the Fraud Department and that all transactions would be reviewed before execution. Approximately twenty hours later, U.S. Bank executed three of four unauthorized ACH payment orders that had been submitted by the impersonator using the compromised credentials, diverting {$53000.00}. U.S. Bank closed its case on XX/XX/XXXX without findings, by way of a brief email from a local-branch employee that itself acknowledged the open question of what actions took place concerning the fraud conversation on XX/XX/XXXX with customer service. U.S. Banks formal response of XX/XX/XXXX from the banks XXXX XXXX XXXX, signed by XXXX XXXX declined reimbursement, characterized XXXX XX/XX/XXXX notice as merely an access issue, and pointed XXXX to the Security provisions of the Deposit Account Agreement. The response did not address or even acknowledge the central facts : the 20-hour notice window, the verbal assurance from the banks representative, and the banks execution of the orders despite that assurance. Chronology of Events On the morning of XX/XX/XXXX, XXXX XXXX, an Accounts Payable employee of XXXX, received a telephone call. The caller-ID displayed U.S. Bank as the source of the call. The caller represented himself or herself to be a U.S. Bank employee, told XXXX XXXX that XXXX account had been the subject of fraudulent activity, and asked for login information to address the situation. During the call the caller also sent XXXX XXXX PIN-related emails purporting to come from XXXX the U.S. Bank XXXX customer-service email address. Believing the call to be legitimate, XXXX XXXX provided XXXX XXXX login credentials. At XXXX XXXX CST on XX/XX/XXXX, XXXX XXXX, XXXX XXXX, emailed XXXX XXXX and XXXX XXXX U.S. Bank personnel known to her at U.S. Banks XXXX branches to alert U.S. Bank to the suspicious activity. At XXXX XXXX CST on XX/XX/XXXX, XXXX XXXX also called U.S. Banks XXXX Customer Service line at XXXX. During that call, the U.S. Bank representative confirmed that the earlier call received by XXXX XXXX was an impersonator and informed XXXX XXXX that the U.S. Bank Fraud Department had flagged XXXX account and would review all of XXXX transactions before execution. At XXXX XXXX CST on XX/XX/XXXX, during the same call, the U.S. Bank representative emailed XXXX XXXX instructions to change XXXX password. XXXX XXXX did so immediately. At XXXX XXXX CST on XX/XX/XXXX four minutes after XXXX XXXX call to XXXX XXXX XXXX began an unauthorized actor used the previously-obtained XXXX credentials to submit four ACH payment orders totaling {$68000.00} against XXXX account . The orders were not scheduled to execute that day ; they were scheduled for execution the following business day, XX/XX/XXXX. At XXXX XXXX CST on XX/XX/XXXX, XXXX XXXX of the local U.S. Bank branch responded to XXXX XXXX XXXX XXXX email, instructing her to call the XXXX Customer Service number a step XXXX XXXX had already independently taken six minutes earlier. At XXXX XXXX CST on XX/XX/XXXX, XXXX XXXX received written confirmation from U.S. Bank that XXXX account credentials had been reset. As of this point in the timeline, U.S. Bank had : ( i ) been notified by email of the suspicious activity, ( ii ) been notified by telephone of the suspicious activity, ( iii ) confirmed by telephone that the originating call was an impersonator, ( iv ) represented that the Fraud Department had flagged the account and would review all transactions before execution, and ( v ) reset XXXX account credentials. The four unauthorized payment orders sat in the banks queue overnight, scheduled for execution the next business day. Notwithstanding all of the foregoing, on the morning of XX/XX/XXXX, U.S. Bank executed three of the four unauthorized payment orders, resulting in the diversion of {$53000.00} from XXXX account. The fourth order, in the amount of {$15000.00} payable to XXXX XXXX, was not completed because the receiving account had been closed. XXXX XXXX was monitoring the account on the morning of XX/XX/XXXX and saw the executions as they posted. At approximately XXXX XXXX CST on XX/XX/XXXX, she contacted U.S. Bank to report the unauthorized executions. U.S. Bank assigned ticket number XXXX and instructed her to wait for a call from the Fraud Department . No such call was received. At approximately XXXX XXXX CST on XX/XX/XXXX, XXXX XXXX called U.S. Bank again and spoke with XXXX XXXX, who informed her for the first time that XXXX needed to submit an ACH Service Request Adjustment Form. XXXX XXXX completed and submitted the form the same day. Approximately one hour later, U.S. Bank confirmed by email that the {$15000.00} transfer to XXXX XXXX had not gone through because the receiving account had been closed ; the bank stated it was attempting to retrieve the remaining funds from the receiving banks. From XX/XX/XXXX forward, XXXX XXXX and XXXX XXXX ( then XXXX Chief Executive Officer ; XXXX XXXX transitioned to a consultant role effective XX/XX/XXXX, at which time XXXX XXXX became President of the company ) contacted U.S. Bank on at least ten occasions seeking information on the recovery effort and reimbursement of the diverted funds. At XXXX XXXX on XX/XX/XXXX, XXXX XXXX of the local U.S. Bank branch emailed XXXX XXXX to inform XXXX that U.S. Bank had been unable to recover the diverted funds. XXXX XXXX email stated : the ACH fraud department has closed the case. In the same email, XXXX XXXX also wrote : So, I guess the question is what actions took place concerning the fraud conversation on XX/XX/XXXX with customer service. That sentence from a U.S. Bank employee reflects the central unanswered question that frames this complaint. On XX/XX/XXXX, XXXX sent U.S. Bank a formal demand letter via certified mail and email, addressed to the Vice President of the XXXX Branch, the XXXX XXXX XXXX, and the General Counsel. The letter set out the chronology, demanded reimbursement of {$53000.00} within fourteen days, and put U.S. Bank on notice to preserve all related documents and communications. On XX/XX/XXXX, U.S. Bank responded by letter signed by XXXX XXXX, Senior Vice President and Head of Enterprise Complaints. The response declined reimbursement, characterized XXXX XXXX XX/XX/XXXX contact as merely an access issue, categorized the loss as an account takeover, and pointed XXXX to the Security provisions of the Deposit Account Agreement. The response did not address or even acknowledge ( i ) the approximately 20-hour notice period before the unauthorized executions, ( ii ) the bank representatives confirmation that the account had been flagged and would be subject to transaction review, or ( iii ) the banks execution of the orders despite that representation. Note on the recovery facts : U.S. Banks XX/XX/XXXX letter states that one transaction in the amount of {$15000.00} was successfully reversed and credited. XXXX contemporaneous record reflected both in U.S. Banks own emails to XXXX XXXX on XX/XX/XXXX and in XXXX XX/XX/XXXX letter is that this transaction was never completed because the receiving bank account had been closed. The accounts of why {$15000.00} was not lost differ ; the operative fact for purposes of this complaint is that {$53000.00} remains unreimbursed. Bureau-Relevant Aspects of the Complaint Smiths respectfully draws the Bureaus attention to the following aspects of U.S. Banks conduct that bear on the Bureaus general supervisory interest in consumer-facing communications and dispute-handling practices, even though the underlying account is commercial : ( a ) Inadequate investigation findings communicated to the customer. U.S. Banks XX/XX/XXXX closure communication contained no findings, no description of the banks investigative steps, and no explanation of the banks decision even as the banks own employee acknowledged in that communication that the relationship between the customers XX/XX/XXXX notice and the banks subsequent execution of the orders was an unanswered question. ( b ) Mischaracterization of the customers notice in the formal response. The banks XX/XX/XXXX response describes XXXX XX/XX/XXXX contact as merely an access issue, which is inconsistent with the banks own contemporaneous conduct of flagging the account with the Fraud Department. Banks do not flag access issues with their fraud departments. The mischaracterization is the kind of dispute-response framing that the Bureaus complaint database is well-suited to document. ( c ) Use of the banks own customer-facing communications channels in the fraud. The fraud was effected through the impersonation of U.S. Banks caller-ID and the use of XXXX ( an actual U.S. Bank customer-service address ) to send PIN-related material to the customer. The Bureaus scrutiny of bank communications practices is well-served by examining whether U.S. Bank has adequate controls over the impersonation of its own outbound channels. ( d ) Public-database documentation. Even if the Bureau ultimately concludes that direct intervention is not appropriate for this commercial-account dispute, the Bureaus public complaint database serves an important function in documenting institutional conduct. XXXX respectfully requests that this complaint be accepted and made available in the database to that end. Resolution Requested XXXX XXXX XXXX respectfully requests that the Consumer Financial Protection Bureau consider the following actions : ( a ) Open a formal complaint matter with U.S. Bank and require the bank to provide a written response that addresses the specific factual allegations summarized above, including the 20-hour notice window, the verbal assurance regarding transaction review , and the basis for executing the payment orders after the account had been flagged. ( b ) Request, as part of the agencys review, that U.S. Bank produce or preserve ( i ) the audio recording and any transcript of the XXXX XXXX CST on XX/XX/XXXX XXXX XXXX XXXX call, ( ii ) internal records reflecting the flagging of XXXX account by the Fraud Department, and ( iii ) records reflecting why the four unauthorized payment orders were executed despite the flag. ( c ) Facilitate a review of U.S. Banks reimbursement decision so that, on the merits and on a complete record, the bank may reconsider its denial of reimbursement of the {$53000.00} diverted from XXXX account. ( d ) Such other action as the agency considers appropriate based on its review of the matter. Enclosures The following supporting documents are submitted with this complaint : 1. Letter from XXXX XXXX XXXX XXXX XXXX to U.S. Bank dated XX/XX/XXXX ( the original demand letter, with full chronology and document-preservation request ) ; 2. Letter from U.S. Bank to XXXX XXXX XXXX dated XX/XX/XXXX ( signed by XXXX XXXX, Senior Vice President and Head of Enterprise Complaints, denying reimbursement ) ; 3. Letter from TXXXX XXXX XXXX to U.S. Bank dated XX/XX/XXXX ( formal rejection of the banks position, renewed demand for reimbursement, and notice of these regulatory filings ). Conclusion XXXX submits this complaint to the Bureau and is filing parallel complaints with the Office of the Comptroller of the Currency ( U.S. Banks primary federal regulator ) and the Arkansas State Bank Department. XXXX is also contemporaneously transmitting to U.S. Bank a formal letter rejecting the banks XX/XX/XXXX position and renewing the demand for reimbursement of {$53000.00}. Should the Bureau require additional documentation or wish to communicate with XXXX, please contact XXXX XXXX at XXXX. Respectfully submitted, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX. XXXX XXXX XXXX XXXX, XXXX XXXX XXXX XXXX

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation