Consumer complaint received 2025-10-22 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: SOFI TECHNOLOGIES, INC.
State: MA

Complaint narrative:
My SoFi Bank account was accessed by an unauthorized individual despite having two-factor authentication enabled. This person changed my mailing address, requested a new debit card to be sent to them, and transferred more than {$5000.00} from my SoFi savings account into a SoFi checking account, which they then used to pay personal bills. They also withdrew approximately {$8000.00} from my linked external checking account and spent $ XXXX paying additional bills. In total a hacker was able to steal over {$10000.00} from me, due to SoFi 's very lax security.

After immediately alerting the company of fraud, they took no steps to secure my account. The next day it was evident to me that someone was still trying to access my account. Despite being assured that dispute claims were being filed for each of the 9 transactions I later received 9 emails ( example attached ) telling me that rather than disputes they had filed research tickets for stop payments. Several hours later on the phone, I was told multiple conflicting answers, that I hadn't in fact reported fraud, that the person that took my call made an error and needed more training, and that, it was the correct process to follow. There is no ability to email or call anyone directly. It appears that the response team is trained in misleading customers and wearing them down, transferring, long hold times, disconnected calls, and ultimately no answers and zero accountability.

I have filed a police report. I have the address the person that did this was trying to send the new debit card to and have provided that information to the police.

At no point was I notified by SoFi of : The suspicious login or account takeover, The address change, The new debit card request, or The large and unus
ual withdrawals.

These are significant red flags that SoFis systems should have detected and flagged for review or customer verification. After discovering the fraud, I immediately reported it to SoFis cust
omer support and fraud department. Despite multiple calls and hours on the phone with different departments, SoFi has not provided any provisional credit or resolution, nor have they acknowledged responsibility for the security breach. 

This incident has caused major financial and emotional distress, and the lack of communication and accountability from SoFi has made the situation worse. Regulations SoFi May Have Violated : Regulation E ( Electronic Fund Tr
ansfer Act, 12 CFR 1005.11 ) Failure to provide provisional credit within 10 business days of my report.

Failure to investigate promptly and communicate written results within 45 days.

Failure to protect me from liability for unauthorized electronic transfers.

Gramm-Leach-Bliley Act ( GLBA ) & FTC Safeguards Rule Failure to maintain commercially reasonable procedures to protect customer data and authenticate logins, even with two-factor authentication enabled. 
Bank Secrecy Act / Anti-Money Laundering ( BSA/AML ) Failure to detect or respond to suspicious account activity involving large transfers and address changes.

NACHA Operating Rules/ Regulation E Processing unauthorized ACH withdrawals from my linked external checking account without verification or
notice.

What I am requesting : Immediate provisional credit and full reimbursement of all unauthorized withdrawals.

A written explanation of SoFis security failure and why I was not notified of major account changes.

Confirmation that SoFi has strengthened its fraud detection and customer notification controls to prevent similar incidents.

Company response to consumer: Closed with explanation