Consumer complaint received 2026-04-17 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem making or receiving payments
Company: FIRST CITIZENS BANCSHARES, INC.
State: CA

Complaint narrative:
* * Issue : * * Unauthorized ACH Transfer Account Takeover I am filing a complaint regarding an unauthorized ACH transfer in the amount of * * {$25000.00} * * from my business checking account at First Citizens Bank on * * XX/XX/2025 * *. On XX/XX/2025, I received bank-generated security alert text messages indicating verification activity and * * immediately contacted the bank * * to report suspicious activity. At the time, I maintain * * two separate business checking accounts held at the bank * *. During the call, I contacted the bank regarding my primary operating account, which has substantial activity. While that account was the focus of the call, I * * explicitly referenced my other business checking account * * while reporting the suspicious activity. During the call, the bank advised that suspicious activity had been detected and instructed me to secure my systems and later complete re-verification and credential resets. I followed these instructions and took immediate steps to secure my accounts. At no point did I approve, authenticate, or authorize the addition of a new ACH recipient or the outgoing ACH transfer. I did not provide any verification codes to any person. After later discovering the unauthorized ACH, I investigated why I had not received any notifications. I determined that my email account had been compromised during the incident period and that an * * unauthorized email rule had been created which diverted messages from the bank out of my inbox without my knowledge * *. As a result, I did not receive or see any email-based authentication or transaction notifications related to this ACH activity. This transaction involved the addition of a new ACH recipient and the initiation of an outbound ACH credit without my knowledge or authorization. The bank has denied my claim but has * * refused to provide any written explanation for the basis of the denial despite multiple requests * *, and has instead directed me to contact a branch to file a complaint, which does not address the substance of the dispute. Additionally, the bank indicated during the investigation that call records were maintained by a third-party vendor and that delays were due to obtaining those records. Despite this, the bank has not confirmed whether the relevant call recording was ultimately obtained or reviewed as part of the investigation. The denial appears to rely on the assertion that I did not report fraud on the affected account. This is incorrect. I reported suspicious activity * * immediately * * upon receiving the security alert and explicitly referenced both accounts during the call. The bank has not confirmed whether the call recording was reviewed or addressed this point. At the time of the incident, authentication for high-risk actions relied in part on an email-based channel, which was compromised and suppressed without my knowledge. I understand that authentication methods have since been updated, which reinforces that the original method was not sufficiently secure for this type of transaction. * * Desired Resolution : * * I am requesting reimbursement of the unauthorized ACH transfer in the amount of * * {$25000.00} * *, as this transaction was the result of an * * account takeover and compromised authentication channel * *, not customer authorization. I also request a full written explanation of the banks investigation findings, including the authentication methods relied upon, whether call records were reviewed, and how the reported suspicious activity was evaluated. I have documentation supporting : * Immediate call to the bank following the alert * Reference to both accounts during that call * Lack of authorization for the transaction * Evidence of email compromise and message suppression * Multiple requests for a written explanation of the denial I respectfully request that this matter be reviewed and resolved. Thank you.

Company response to consumer: Closed with explanation