Consumer complaint received 2026-04-29 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem using a debit or ATM card
Company: CAPITAL ONE FINANCIAL CORPORATION
State: PA

Complaint narrative:
I am filing this complaint against XXXX XXXX regarding 132 unauthorized XXXX payment transactions withdrawn from my XXXX Online Savings Account ending in XXXX between XX/XX/year> and XX/XX/year>. XXXX has denied my claim multiple times, including after reinvestigation and CFPB review. XXXX denial letters state that XXXX relied on multiple levels of verification, including authentication codes and login information, and concluded that there was no evidence of account takeover and no indication of unusual online account activity. However, XXXX has not provided a meaningful explanation or supporting records showing that I personally authorized these transactions, that I knew the XXXX recipients, that I benefited from the transfers, or that I had any relationship with the recipients. XXXX own correspondence confirms that I disputed 132 XXXX payment transactions and that I asserted these transactions were processed fraudulently and without my knowledge. XXXX also confirmed that it closed the account ending in XXXX and issued a replacement account ending in XXXX as a precaution. Despite that, XXXX continues to deny reimbursement based largely on authentication activity, without addressing the possibility that my account, device, credentials, XXXX access, phone, or authentication process was compromised. I continue to dispute these transactions as unauthorized electronic funds transfers under the Electronic Fund Transfer Act and Regulation E. To the best of my knowledge : XXXX. I did not authorize the 132 disputed XXXX transfers. XXXX. I did not give anyone permission to make these transfers. XXXX. I do not know or recognize the XXXX recipients. XXXX. I did not receive any goods, services, repayment, benefit, or value from these transfers. XXXX. These transfers were not made for my personal benefit. XXXX. I did not intentionally send money to these recipients. XXXX. I believe my account, device, phone, credentials, XXXX access, or authentication process was compromised. XXXX. The fact that login information or authentication codes were used does not prove that I personally authorized the transfers. XXXX. XXXX has not provided the records it relied on to prove that I authorized the transactions. XXXX. XXXX has not adequately explained why 132 XXXX transfers over a short period did not constitute suspicious, unusual, or potentially fraudulent activity. My main concern is that XXXX is treating successful authentication as the same thing as authorization. That is not sufficient. If a fraudster gained access to my phone, account, credentials, one-time passcodes, device, SIM, email, or other authentication method, then authentication could have occurred without my authorization. XXXX denial does not meaningfully address this issue. XXXX response also does not explain : XXXX Who the XXXX recipients were ; XXXX. Whether the recipients had any prior relationship with me ; XXXX. Whether these recipients were new recipients ; XXXX. Whether new XXXX recipients, phone numbers, emails, devices, or authentication methods were added ; XXXX. Whether any account profile, phone number, email address, device, password, or XXXX setting was changed before or during the transfers ; XXXX. What IP addresses, devices, locations, browser fingerprints, or sessions were used ; XXXX. Whether the activity matched my normal account usage ; XXXX. Whether the transfers occurred in rapid succession ; XXXX. Whether XXXX contacted XXXX or recipient banks to attempt recovery ; XXXX. Whether XXXX preserved recipient bank information and transfer metadata ; XXXX. Whether XXXX reviewed the possibility of device compromise, credential theft, SIM compromise, social engineering, malware, remote access, or other account-takeover methods ; XXXX. Whether XXXX reviewed call recordings, fraud alerts, login records, and internal fraud-scoring data ; XXXX. Whether XXXX considered the total pattern of 132 transfers as suspicious, even if individual authentication steps were completed. I am requesting that XXXX be required to conduct a meaningful Regulation E reinvestigation and reimburse the full amount of the unauthorized transfers. I also request that XXXX provide all documents and records relied upon in denying my claim, including but not limited to : XXXX. A complete list of all 132 disputed XXXX transactions ; XXXX. Date, time, amount, and recipient information for each transfer ; XXXX. Recipient names, XXXX tokens, email addresses, phone numbers, recipient bank information, and any available account identifiers ; XXXX. Whether each recipient was new or previously used ; XXXX. Records showing when each recipient was added ; XXXX. Records showing any change to my XXXX profile, phone number, email address, device, password, username, security settings, or authentication method ; XXXX. Login history for the relevant period ; XXXX. IP addresses, device IDs, device names, browser fingerprints, geolocation data, and session logs ; XXXX. Records of each one-time passcode or authentication code allegedly validated ; XXXX. Method of delivery for each code, including SMS, email, app notification, or other method ; XXXX. Fraud alerts, fraud scoring, suspicious-activity flags, and internal risk indicators ; XXXX. XXXX internal fraud investigation notes ; XXXX. Call recordings and notes from my communications with XXXX ; XXXX. Communications between XXXX and XXXX ; XXXX. Communications between XXXX and any recipient bank ; XXXX. Any recovery attempts or explanation for why recovery was not attempted ; XXXX. The specific evidence XXXX claims proves that I personally authorized each transfer. XXXX position appears to rely heavily on the fact that authentication codes and login information were validated. But if my device, phone, online access, or authentication process was compromised, then the presence of authentication does not resolve whether the transfers were authorized by me. I am asking regulators to review whether XXXX investigation complied with Regulation E and whether XXXX improperly shifted the burden to me by treating authentication as conclusive proof of authorization. I also believe XXXX conclusion is unreasonable because the activity involved 132 XXXX transfers over a short period. I do not know these recipients, I did not authorize the transactions, and I did not benefit from them. A high volume of XXXX transfers to unknown recipients should have triggered heightened fraud review, not a blanket denial based only on login and code validation. I am requesting the following resolution : XXXX. Full reimbursement of all unauthorized XXXX transfers ; XXXX. Reimbursement of any related fees, penalties, lost interest, or account charges ; XXXX. Production of all documents and records XXXX relied upon in denying my claim ; XXXX. Confirmation of whether XXXX contacted XXXX and/or recipient banks for recovery ; XXXX. Correction of any internal record suggesting that I authorized these transactions ; XXXX. Written explanation of how XXXX determined that 132 XXXX transfers to recipients I do not know were valid and not suspicious ; XXXX. Preservation of all account logs, device data, XXXX records, recipient data, fraud notes, and call recordings. I have repeatedly attempted to resolve this matter with XXXX. XXXX has continued to deny the claim, but its responses have not provided enough evidence to show that I personally authorized the transfers. I respectfully request regulatory review of XXXX handling of this unauthorized EFT claim and its compliance with the Electronic Fund Transfer Act and Regulation E.

Company response to consumer: Closed with explanation