Consumer complaint received 2026-03-05 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: NAVY FEDERAL CREDIT UNION
State: NC

Complaint narrative:
On the weekend of XX/XX/year>, I clicked on a XXXX Update icon and got hacked. The hacker entered my computer and took over. I saw this happening in real time, my husband saw it. I shut off the computer as quickly as I could. My husband and I went to his computer to check what might have happened and discovered that the hacker had taken out {$2000.00} from my NFCU checking account. Within XXXX minutes of the incident, we contacted NFCU 's rep and told her what happened. She reimbursed our account immediately. A few days later, I got a notice from NFCU stating that they were recalling the money they'd reimbursed into my account. In that email they listed an account that had nothing to do wi th the account that'd been hacked. In other words, they investigated the wrong account. NFCU says that acct number in their message was a typo, but NFCU later said they were not going to reimburse my money because of something in my VISA account, which was also the wrong account. They should have been checking my checking account and not other accounts. This was highly confusing because each time they sent me a message about not reimbursing my account, they used a 'different " account name or number and were not checking the hacked checking acct. According to the law, NFCU must reimburse the funds. At the very least, the law says that because my husband and I called NFCU within minutes of the hack, I should only be liable for {$50.00}. But NFCU insists that someone associated with my VISA accoung may have used XXXX to get into my other accounts. This wasn't explained fully to me and every time I tried to get an explanation, NFCU claimed their information was 'propietary ' and they couldn't share it. More and more, it's looking like NFCU is attempting to grasp at straws to find some reason that they can used NOT to reimburse the funds. I never had a XXXX acct, for example. But it was suggested to me by one of the NFCU reps that the whole hack was my fault, that the hacker had my phone number and that phone number was somehow used to access my XXXX card and then transfer funds. But funds from our accounts never changed just prior to the hack. They never changed after the hack with the exception of the missing {$2000.00} from my checking account. In other words, all this nebulous transfer of funds surreptitiously never happened. A straight transaction by someone with this email address : XXXX, sent money straight from my checking account to some company that may be in Florida called XXXX XXXX XXXX XXXXXXXX. I recited the law to NFCU as I understand it. That is to say, it doesn't matter how the hacker got into my account or through what venue or how he did it, I didn't give authorization for the transfer of that {$2000.00}. Period! And that's what NFCU should be concerned about. Instead, one of their reps grilled me about my computer, how I'd used it, how much time had the computer been on before I turned it off so the hacker couldn't proceed. I told that rep that I had turned the computer off immediatly, within seconds. My husband and I then, as stated, reported the stolen money to NFCU within about 10 minutes. I saw all of this happening. NFCU has closed ranks and continues to refuse to reimburse the money, trying to find any way that they can to make me at fault or somehow connected to approving the transfer of funds to that XXXX XXXX XXXX XXXX company that I've never heard of. NFCU refused to tell me how/why they came to their conclusions. I have repeatedly told them that they must PROVE that I authorized the tranfer of those funds and they can not because i never approved anything, nor did my husband and we are the only two people who have legal access to our banking accounts. Now, NFCU wants me to return that {$2000.00} by XX/XX/year>, or they're going to take it. I don't have those funds in my accounts. The money... OUR MONEY... was used to pay our mortgage. And the law clearly states under federal banking regulations that the bank should refund our money. They don't want to. And their trying to find any way they can to keep from doing so by implying and the outright stating that I allowed that transfer so it's my fault. I don't know who the hacker was, I have never heard of him/her or the mechanical company and I am NOT going to pay back funds that the law says I don't have to pay. At one point, NFCU stated that because the hacker had my phone number, I clearly gave him/her permissiont to make that withdrawal. I replied that, because someone has my phone number ( a number they hacked out of the computer they also hacked ) this doesn't mean that I gave anyone permission to get into my checking account an hack it. That's like saying that, if you give my your business card with your phone number on it, using NFCU 's logic, you're giving me permission to hack your account by handing over that business card. I explained how hacking works to one rep and how 'RATS ' work ... A Remote Access Trojan ( RAT ) is a type of malicious software ( malware ) designed to provide a threat actor with full, unauthorized, and covert control over a computer or device from a remote location. Unlike traditional viruses that often damage or delete files, a RAT is designed to remain hidden, acting as a " backdoor '' that allows hackers to spy on users and use the compromised machine for illegal activities. NFCU doesn't seem to care that all my infor they 'claim ' the hacker has was obtained through the hacking and that I didn't 'give ' it to the hacker for the purposes of hacking my own account. The fact that NFCU investigated two accounts that had nothing to do with the hacking has me concerned. It's like they are crawling around, ready to 'make something up ' just to keep from having to pay the reimbursement to me. I am highly skeptical of the lack of professionalism in investigating not only the wrong account numbers, but in their attitude ( speaking of NFCU ) when telling me this is my fault. As state, they actually said this at one point and I don't know what to do now. I have filed a report with the FBI, I told NFCU this. They don't care.

Company public response: Company believes it acted appropriately as authorized by contract or law
Company response to consumer: Closed with explanation