Consumer complaint received 2025-10-23 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem making or receiving payments
Company: SOFI TECHNOLOGIES, INC.
State: NY

Complaint narrative:
On XX/XX/XXXX, at around XXXX XXXX  EST, someone hacked into my home desktop computer using what I believe was XXXX XXXX  Software. They were able to exploit an open port on my router using what I would assume is a Brute Force attack and were able to remotely control my computer. I am not sure who did this, but this is the information I have gathered based on my own research online. I did not download any program and did not supply anybody with any passwords or codes that would allow them access to my computer. Since the attack, I have closed any open ports on my computer and router and run a virus scan. The virus scan did not show any issues. 

With this remote access, they logged into my bank, SoFi, and stole money from my account by sending themselves {$900.00} via the XXXX platform, which is integrated with SoFi. This hacker logged into my other financial institutions and banking websites as well, but no money was lost. I have already taken the steps to safeguard all of my accounts, such as setting up new passwords and ensuring two-factor authentication. The only money that I have lost was with XXXXSoFi. 

The hacker sent themselves money at around XXXX XXXX Eastern standard time, and I reported the fraudulent transaction to Sofi at around XXXX XXXX. Eastern standard time. Later in the day, at around XXXXXXXX XXXX. I contacted my local police department and spoke to an officer to report the hack of my computer and the fraudulent transaction on my bank account. On XX/XX/XXXX, I received a call from the Sofi XXXX  department requesting more information, and I told them that my computer was hacked via remote access software from an unknown party. About an hour after the call, I got an email from Sofi that they had denied my claim. The email contained no evidence which shows that I was at fault for sending the money. 

I sent an email back to Sofi on XX/XX/XXXX, citing specifically Regulation E of the Electronic Funds Transfer Act ( EFTA ) and the reasons why I should not be liable for this unauthorized transaction. This transaction was reported promptly on XX/XX/XXXX, about an hour after the transaction, well within the 60-day window under Regulation E ( 1005.11 ( b ) ( 1 ) ), and I received no benefit from it. As such, it qualifies as an unauthorized transfer under 1005.2 ( m ), and my liability is limited to {$0.00} {$50.00} depending on reporting timing ( 1005.6 ( b ) ). The attached denial letter [ XXXX ] does not adequately explain the basis for this decision, as required by 1005.11 ( d ) ( 2 ). Under Reg E, the bank must provide a written explanation of its findings, including the amount and date of the transfer, the investigation steps taken, and the reasoning for denial. 

After I appealed to them, I received a second response, which I have attached [ XXXX ], which shows that based on my geolocation, login behavior, and Device and IP address consistency, there was no evidence of unauthorized access. I sent them another email on XX/XX/XXXX, stating that the reason for the geolocation, device, and IP address consistency is that the hacker used remote access software to control my computer, and that was why it appears as if I was doing this transaction. In the same response to them, I asked them to provide evidence of two-factor Authentication, also known as 2FA. Sofi requires 2FA to log on to the XXXX platform. I included evidence from my phone, which shows that I did not receive any 2FA codes for the XXXX transaction on the morning of XX/XX/XXXX. Secondly, during the time that the hacker was in my Sofi account, the person attempted to take out a personal loan in my name, which I canceled a couple of hours after the attack on XX/XX/XXXX. Opening up a personal loan is something I would never do. Third, I asked them to investigate the recipient of the XXXX transfer, as I have no knowledge of the recipient, and I wanted to know if the recipient accounts bank account was investigated for fraud. Additionally, I have never used XXXX since I have been with Sofi. Fourth, Sofi claims that the time of the attack was " normal login behavior '' when I had never logged into my bank before XXXX XXXX, when I have a normal XXXX XXXX XXXX XXXX XXXX  job, and do not check my bank at that time. Sofi did not provide me with any evidence of my login patterns. I included in that email that I would escalate this to the CFBP if they were not able to come to a proper resolution and provide evidence of what I have listed above. 

I received the last email response from Sofi on XX/XX/XXXX, [ XXXX ], which once again contains a simple paragraph response saying that my appeal has been denied and that I am not going to be refunded the {$900.00}. Additionally, I received a letter in the mail from Sofi saying that the fraudulent transactions on my credit card were refunded, as they also attempted to make purchases with my credit card. I am very surprised at this outcome because that should flag their system that this XXXX transfer was not authorized by me. My issue with the bank is that they have not compiled enough evidence that prove that I am at fault when I did not receive any 2FA code. The hacker did not have my phone, so this looks like gross negligence on the part of Sofi.

If SoFi or the CFPB needs additional documentation or evidence, I can provide screenshots of my computer showing timestamps of the webpages the hacker went into on SoFi, SMS messages from my phone, as well as other emails from SoFi and other websites showing fraudulent activity.

Company response to consumer: Closed with explanation