Consumer complaint received 2025-10-17 00:00:00
Product: Checking or savings account — Other banking product or service
Issue: Managing an account — Problem accessing account
Company: JPMORGAN CHASE & CO.
State: CT

Complaint narrative:
1. My complaint starts when I received a letter from Chase stating my account was closing. Chase stated there was concerning activity and I was instructed by Chase in writing to destroy all cards and checks associated with the accounts ( attached ). 

A. The concerning activity I attempted to appeal this decision through the CFPB to get directly in contact with the XXXX XXXX but was met with a response that their decision was remaining the same. In their response, I noticed they revised their original statement referring to it as unexpected activity when responding to my appeal ( attached ). I would like clarification on this inconsistency, as the original terminology used is associated with accusations, which brings me to the next part of my complaint ; When a Chase XXXX representative previously accused me of money laundering when discussing my personal transfers. This was documented as a complaint with Chase, and after making them aware of that statement, two Chase managers called me directly about the issue, attempting to discuss the statement that was made. Now I have received a letter from Chase, after a transfer that was performed, dated the same day, providing notice that my accounts will be closing. A transfer that was performed in accordance with Chases published guidance, and yet Chase ultimately blamed me for activity being concerning that it itself directed and encouraged.. I will be attaching Chases own How to Avoid a Fee terms ( attached ). 

B. Credit Card Fraud and Possible Identity Theft I followed the instructions in the letter directly as stated, then discarded all the material. On XX/XX/XXXX at XXXX XXXX   EST, a Chase representative contacted me to verify transaction activity and I then realized I fell victim to fraud. I explained the letter I received and having trouble destroying a metal card, but ultimately followed the instructions on the letter. The representative claims she has no idea what I was talking about and intimidated me for following instructions by Chase then later stated during the call that my Social Security number and personal data may have been compromised due my actions the very outcome that resulted from following Chases own written instructions. 

- This sequence of events reflects negligence and a deceptive practice under the Unfair, Deceptive, or Abusive Acts or Practices ( UDAAP ) provisions of the Dodd-Frank Act ( 12 U.S.C. 5531, 5536 ). Furthermore, because Chases instructions directly created a risk of unauthorized use of my account and personal data, this also implicates Regulation E ( 12 C.F.R. 1005.6 ), which governs consumer liability and bank obligations following unauthorized transactions.

2. Chases failure to deliver communications, including my account statements, through my authorized electronic communication channel, and the unauthorized disclosure of sensitive financial information 1. I was enrolled in Chase Banks paperless statements program, which required me to provide an email address for electronic communications.

2. My original email address was later compromised, so I updated my email address in Chase Banks online system. Chase acknowledged and confirmed the updated email, and communications have been successfully sent to the new email since then. My old email was removed from my account profile and is no longer authorized. 

- When I updated my email address, this update served as an express revocation of consent for Chase to send any further electronic communications or statements to my previous email address. Chase acknowledged this change, and the old address no longer appeared in my online banking profile.

3. After this update, I opened a new account with Chase, using the updated email address on the application. However, Chase sent communications, including statements, for this accountincluding account type, product type, balances, due dates, statement details, and the last 4 digits of my cardto my old, unauthorized email address. An address never provided for this account.

4. I did not receive certain communications and statements at any authorized communication channel, preventing me from monitoring my accounts and accessing financial records I am entitled to. 

Legal and Regulatory Basis for Complaint 1. E-SIGN Act / Paperless Agreement Violation : Under the E-SIGN Act, electronic records must be delivered in a manner that ensures the customer can reliably access them. Chase failed to deliver statements to my authorized email, violating my rights under the paperless agreement.

2. UDAAP Unfair and Abusive Practices ( Dodd-Frank Act 5531, 5536 ) : - Unfair : Chases failure to send statements to my authorized email caused substantial harm by preventing access to account information necessary for financial management.

- Deceptive : Chase represented that my email information had been updated and that all paperless statements would be sent to my authorized address, which did not occur. - Abusive : Sending sensitive account information to an old, unauthorized
email interfered with my ability to manage my finances and exposed me to potential fraud risk.

Legal basis for revoked consent A. E-SIGN Act Under 15 U.S.C. 7001 ( c ) ( 1 ) ( C ) ( ii ), consumers have the right to withdraw consent for electronic delivery at any time, and the institution must honor that withdrawal within a reasonable period.

By sending statements to the revoked address, Chase : * Ignored a withdrawn consent, and * Failed to provide effective electronic delivery as required by E-SIGN.

Under 15 U.S.C. 7001 ( c ) ( 1 ) ( C ) ( ii ), I had the right to withdraw or modify my consent to receive records at a specific electronic address. My email update and Chases acknowledgment constituted withdrawal of consent for the prior email address. By continuing to send records to that revoked address, Chase failed to comply with the E-SIGN Acts consumer consent and withdrawal provisions. 

B. Regulation P ( GLBA, 12 C.F.R. 1016.13 ) Regulation P also ties consent and authorization to nonpublic personal information sharing. Once you revoke consent, the bank must stop sending or disclosing information to that contact channel.

Under 12 C.F.R. 1016.13, financial institutions must respect consumer directions regarding disclosure and delivery of nonpublic personal information. My revocation of consent for th
e prior email address made any further disclosures to that channel unauthorized under Regulation P.

3. Violation of the Gramm-Leach-Bliley Act ( GLBA ) and Regulation P ( 15 U.S.C. 68016809 ; 12 C.F.R. Part 1016 ) - The GLBA and Regulation P require financial institutions to protect the confidentiality of nonpublic personal information ( NPI ) and to ensure that disclosures are made only to authorized recipients.

- Chases continued transmission of account statements containing personal and financial details to an unauthorized, compromised email address constitutes a failure to safeguard NPI and an unauthorized disclosure under these provisions.

4. Violation of the FTC Safeguards Rule ( 16 C.F.R. Part 314 ) - The Safeguards Rule, issued under the GLBA, requires financial institutions to maintain appropriate procedures to protect customer information from unauthorized access or disclosure.

- Chases failure to prevent statements from being sent to an unauthorized email shows a breakdown in internal safeguards and information-security controls.

5. Potential Violation of the Electronic Communications Privacy Act ( ECPA 18 U.S.C. 2511 ) - The ECPA prohibits the intentional transmission of electronic communications containing personal data to unauthorized or unintended recipients. By sending confidential statements to a deauthorized, compromised email address, Chase may have violated the ECPAs prohibition against the unauthorized disclosure of protected electronic communications.

1. Following the account closure, I contacted Chase to request copies of my account statements, since I never received them through any authorized channel which banks are federally required to retain and make available. The representative named XXXX stated on a recorded line that I would need to step into a branch to receive my statements, despite me explaining that I was outside the country and unable to appear in person. When I informed her that such a requirement obstructs my rights as a consumer, she replied that it was procedure and then abruptly ended the call. 

At the time my accounts were active, I was enrolled in paperless statements and regularly accessed them through Chase Online Banking. Since the closure, Chase has revoked my ability to view past statements electronically and now refuses to issue them physically by mail, thereby denying me access by both methods. This is not only unreasonable it is directly inconsistent with federal regulations requiring that consumers be able to access or reproduce their own account records within the retention period. 

Chases refusal to provide statements through a reasonable and accessible means constitutes a violation of multiple consumer protection and recordkeeping laws, including : * 12 C.F.R. 1005.9 ( Regulation E ) and 12 C.F.R. 1030.6 ( Regulation DD ) Failure to provide periodic statement information as required for consumer accounts * 12 U.S.C. 5531 ( UDAAP ) Unfair restriction of access to financial records that causes harm the consumer can not reasonably avoid * 15 U.S.C. 7001 et seq. ( E-SIGN Act ) Denial of continued access to electronic disclosures and statements after consent was established Limiting statement access only to an in-branch process especially when the customer can not physically appear and previously received paperless electronic disclosures is an unfair and obstructive practice under federal law. It prevents the consumer from reviewing transactions, filing disputes, and maintaining accurate financial records, all of which constitute substantial harm. 

Compounding these issues, these incidents form a clear pattern of poor data handling, noncompliance, and consumer harm. I followed Chases instructions in good faith from discarding my cards and checks as directed, to maintaining updated contact information in my profile. Each time, Chases own actions resulted in harm, exposure, and blame directed at the customer. 

The incident involving Chases unauthorized use of an old, compromised email address demonstrates that the customer had no control over the banks communications or internal processes, reinforcing that Chase not the customer is responsible for these failures. This sequence of events illustrates a systemic failure in Chases compliance, data protection, and customer communication practices, all of which place consumers at risk and violate federal privacy, banking, and consumer protection laws.

Company response to consumer: Closed with explanation