Consumer complaint received 2026-03-10 00:00:00
Product: Checking or savings account — Checking account
Issue: Problem with a lender or other company charging your account — Can't stop withdrawals from your account
Company: Atlantic Union Bankshares, Inc.
State: VA

Complaint narrative:
I am submitting this complaint to formally document a series of events involving unauthorized ACH debits, merchant processing security failures, and the handling of a fraud investigation by both XXXX XXXX XXXX XXXX XXXX XXXX XXXX and Atlantic Union Bank. This complaint concerns the merchant account used by my business, XXXX XXXX XXXX XXXX XXXXXXXX XXXX, and the business operating account maintained with Atlantic Union Bank.The purpose of this complaint is to request regulatory review of the actions and non-actions of the parties involved, the handling of reported fraudulent transactions, and the failure to provide adequate investigation transparency or remediation.Beginning XX/XX/XXXX, I began preparing my accounting and tax practice for the XXXX tax filing season. This preparation included acquiring tax preparation software, accounting systems, payment processing infrastructure, and operational workflow systems required to serve clients. As a small woman-owned business operating in the tax and accounting field, the majority of annual revenue is generated during the tax season. XXXX for that season required approximately XXXX hours per week between XX/XX/XXXX and XX/XX/XXXX, representing roughly XXXX hours of operational preparation.Beginning XX/XX/XXXX, multiple debits associated with XXXX XXXX XXXX began appearing in the operating account connected to my business. These transactions included withdrawals of {$610.00} on XX/XX/XXXX ; {$600.00} on XX/XX/XXXX ; {$600.00} on XX/XX/XXXX ; {$98.00} on XX/XX/XXXX ; {$600.00} and {$600.00} on XX/XX/XXXX ; {$600.00} on XX/XX/XXXX ; and a chargeback debit of {$840.00} on XX/XX/XXXX. These withdrawals were not authorized by me.The fraudulent activity was verbally reported to Atlantic Union Bank on XX/XX/XXXX via phone and I was told the XXXX would return my calls. I reported the incident multiple times fromJan XXXX, XXXX through XX/XX/XXXX before it was acted upon.This date should represent the date of notice that the account had been compromised. A Written Statement of Unauthorized Debit was later submitted on XX/XX/XXXX, XXXX XXXX XXXX subsequently acknowledged in writing that fraudulent activity occurred on the merchant account. Communications from their fraud investigation team indicated that the fraudulent transactions were associated with exposure of an API key connected to the merchant account through a third-party vendor environment associated with the payment processing system.Despite this acknowledgement from the payment processor that the account credentials were compromised, Atlantic Union Bank later informed me that my fraud claims were denied.During a phone call with Atlantic Union Bank to discuss the matter, I requested confirmation of the status of the fraud investigation. I was informed that two cases existed : Case number XXXX for an amount of {$3700.00} and Case number XXXX for an amount of {$840.00}. I was told that both cases were closed and denied.I requested the name of the investigator responsible for the investigation and the department that handled the matter. I was informed that the bank could not provide the name of the investigator or identify the department responsible.I also requested confirmation of the investigation timeline and the date the investigation had been completed. I was informed that the investigation was completed on XX/XX/XXXX ; however, I was not notified of that determination when it occurred.During the same call I asked why additional transactions were allowed to process after the fraud had been reported on XX/XX/XXXX. I also asked what protective measures had been taken by the bank to prevent further debits after the fraud was reported, including XXXX blocks or merchant debit restrictions. The representative stated that these questions would be passed on to the dispute team but could not provide answers.I also asked whether the bank would reimburse overdraft fees and related charges that resulted from the unauthorized debits and the resulting negative account balance. The representative again stated that this question would be forwarded to the dispute team.The fraudulent activity and the resulting dispute occurred immediately before and during the beginning of tax season. Because the merchant processing system could no longer be trusted, I was forced to transition to a new payment processor and new software systems during the busiest period of the year for my business.In addition to the financial withdrawals themselves, I have spent approximately XXXX hours investigating the incident, compiling documentation, communicating with both XXXX and Atlantic Union Bank, filing a police report documenting the fraud, and reconstructing financial records.The unauthorized debits and the subsequent handling of the investigation caused significant operational disruption to my business during tax season and contributed to the operating account becoming negative. I also received notice indicating that the account could potentially be closed, despite the fact that the negative balance resulted from the disputed fraudulent transactions.I am requesting that the appropriate regulatory authorities review the actions and responses of both XXXX XXXX XXXX XXXX XXXX XXXX XXXX and Atlantic Union Bank with respect to the handling of this matter. Specifically, I request review of the following issues : The security incident involving exposure of merchant API credentials associated with XXXX XXXX XXXX.The unauthorized debits processed through the merchant account infrastructure.The handling of the fraud investigation by Atlantic Union Bank following notice of the fraud on XX/XX/XXXX, XXXX denial of the fraud claims despite the payment processors acknowledgement that the account credentials were compromised.The failure to provide transparency regarding the investigator responsible for the determination.The failure to provide timely notice of the investigation outcome.The operational and financial harm resulting from the incident and the delayed resolution.I respectfully request that this matter be reviewed and that any appropriate corrective actions or enforcement measures be taken.Thank you for your time and consideration. Attachment Re : Notice of Evidence Preservation and Litigation Hold / XXXX XXXX XXXX XXXX XXXX // XXXX to XXXX XXXX XXXX and Atlantic Union Bank.eml added.Conversation opened. 1 read message. Skip to content Using XXXX with screen readers in : sent XXXX of XXXX Re : Notice XXXX XXXX XXXX and XXXX XXXX / XXXX XXXX XXXX XXXX XXXX // XXXX to XXXX XXXX XXXX and Atlantic Union Bank XXXX XXXX XXXX XXXX XXXX XXXXe XXXX XXXX ( XXXX minutes ago ) to Legal.Escalations, XXXX, XXXX To the Legal Department XXXX This correspondence constitutes a formal notice of claim and demand for remediation concerning fraudulent activity processed through the merchant account associated with XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX. The account was established through XXXX XXXX XXXX, XXXX, a subsidiary of XXXX XXXX XXXX, and was linked to the business operating account maintained at Atlantic Union Bank. The purpose of this notice is to formally document the facts surrounding the incident, provide notice of resulting damages, request preservation of evidence, and provide an opportunity for resolution prior to further regulatory or legal action. Background and Relationship Heartland Payment Systems services were introduced to the account holder through an Atlantic Union Bank referral relationship beginning in XX/XX/XXXX. Through that referral, XXXX provided merchant payment processing services to XXXX XXXX XXXX XXXX XXXXXXXX XXXX, XXXX. Beginning XX/XX/XXXX, the firm began preparing operational systems for the upcoming XXXX tax filing season. These preparations included acquisition of tax software, accounting software, payment processing infrastructure, and operational workflow systems required to serve tax clients. Approximately XXXX hours per week were devoted to operational preparation between XX/XX/XXXX and XX/XX/XXXX, representing approximately XXXX hours of preparation. These preparations were designed to allow the firm to operate at full capacity during the XXXX tax filing season, which represents the primary revenue period for the business. Unauthorized Activity Beginning XX/XX/XXXX, multiple unauthorized debits associated with XXXX merchant processing activity appeared in the operating account held at Atlantic Union Bank. The transactions include, but are not limited to, the following debits reflected in the account history : XX/XX/XXXX {$610.00} XX/XX/XXXX {$600.00} XX/XX/XXXX {$600.00} XX/XX/XXXX {$98.00} XX/XX/XXXX {$600.00} XX/XX/XXXX {$600.00} XX/XX/XXXX {$600.00} XX/XX/XXXX {$840.00} chargeback These withdrawals were not authorized by the merchant. On XX/XX/XXXX, XXXX XXXX XXXX XXXX XXXX acknowledged that fraudulent transactions had occurred on the account. Subsequent correspondence on XX/XX/XXXX further indicated that the fraudulent transactions were believed to have resulted from exposure of an API key associated with the merchant account through a third-party technology vendor connected to the XXXX / XXXX XXXX infrastructure. The merchant did not provide API credentials to any third party and did not operate any online payment portal capable of exposing such credentials. Operational Impact The fraudulent activity occurred immediately before and during the beginning of the XXXX tax filing season. As a direct result of the incident, the firm was forced to discontinue use of the XXXX XXXX processing system and migrate to a new payment processor and software infrastructure during tax season. This migration required emergency operational changes that significantly disrupted the firms ability to invoice clients and receive payments. In addition, the account holder has spent approximately XXXX hours investigating the incident, communicating with financial institutions, compiling documentation, filing reports, consulting cybersecurity professionals, and reconstructing financial records. The disruption occurred during the primary operational period for the business and materially interfered with the firms ability to operate during tax season. Police Report and XXXX XXXX A police report has been filed documenting the fraudulent activity affecting the business account. The unauthorized withdrawals, related chargebacks, overdraft fees, operational disruption, and forced migration of payment systems caused significant financial harm to the business and placed the operating account in a negative condition. The total financial impact of the incident is currently being reconstructed through a detailed forensic accounting analysis and is expected to exceed the direct transaction amounts reflected above due to operational disruption, lost revenue, and professional time devoted to the investigation. Demand for Remediation Accordingly, Make Cents Bookkeeping and XXXX XXXX, XXXX demands the following actions from XXXX XXXX XXXX, XXXX and XXXX XXXX XXXX : Immediate reimbursement of unauthorized debits and related chargebacks. Reimbursement of bank fees and costs incurred as a direct result of the unauthorized activity. Written explanation of the security incident involving exposure of the merchant API key and the identity of the third-party vendor referenced in your XX/XX/XXXX correspondence. Confirmation that the merchant account has been permanently secured and that no further debits will occur. Written confirmation that the merchant will not be held liable for fraudulent transactions resulting from the processors infrastructure or vendor environment. Preservation of Evidence You are hereby instructed to preserve all documents, communications, system logs, transaction records, audit logs, API credential records, vendor security reviews, and internal investigative materials related to this incident. This preservation request includes communications involving XXXX XXXX XXXX, XXXX XXXX XXXX, third-party vendors, and any internal security or fraud investigation teams. Reservation of Rights Nothing in this letter constitutes a waiver of any rights or remedies available to XXXX XXXX XXXX XXXX XXXXXXXX XXXX, XXXX. If the matter can not be resolved promptly, the account holder reserves the right to pursue all available remedies including regulatory complaints, civil claims, and recovery of damages associated with the fraudulent activity and resulting operational harm. Please provide a written response within XXXX ( XXXX ) days of receipt of this letter. Sincerely, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX ( XXXX ) XXXX XXXX Registered XXXX | XXXX : XXXX On Fri, XX/XX/XXXX at XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX wrote : XXXX XXXX Managing XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX XXXX XXXX ( XXXX ) XXXX XXXX Registered XXXX | XXXX XXXX XXXX On Fri, XX/XX/XXXX at XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX wrote : Thank you, I will do that. Especially because you have the nerve TO PUT XXXX XXXX DOLLARS THAT I NEVER GOT ON MY XXXX AS IF THE MONEY THAT WAS TAKEN OUT WAS NOT TAKEN OUT XXXX XXXX Managing Member XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX ( XXXX ) XXXX XXXX Registered XXXX | XXXX : XXXX On Thu, XX/XX/XXXX, XXXX XXXX XXXX XXXX wrote : Hello, I understand you will be seeking legal consult. Please send all further communication to XXXX. XXXX XXXX, XXXX Risk XXXX XXXX : A XXXX XXXX XXXX XXXX XXXX work from home # XXXX XXXX Customer Service : XXXX XXXX Customer Service : XXXX XXXX Customer Service : XXXX XXXX XXXX XXXX # logos From : XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX Sent : Wednesday, XX/XX/XXXX XXXX PM To : XXXX XXXX XXXX Subject : Re : XXXX XXXX XXXX XXXX XXXX // XXXX image.png Hello XXXX, Thank XXXX for your response. However, your message does not resolve the core issues that have been repeatedly raised, nor does it account for the ongoing and significant financial harm your companys actions have caused to my business and personal livelihood. As of today, my business account remains negative in the amount of approximately {$390.00}, as reflected in the attached account screenshot. This negative balance is not the result of any dereliction of duty on my part. It is the direct result of XXXX XXXX failure to properly secure, monitor, and respond to fraudulent activity on the payment terminal associated with my account. Your companys negligence in safeguarding merchant credentials, monitoring suspicious activity, and timely resolving the resulting chargebacks has caused measurable financial damage to my business. Despite my repeated communications, requests for clarification, and attempts to resolve this matter in good faith, there has been no meaningful movement toward a full and proper resolution. You have stated that : {$3600.00} is being applied to XXXX rejects resulting from fraud-related chargebacks No further transactions can occur due to terminal deactivation A formal meeting is not required However, this does not address the fact that : XXXX. My account remains in a negative balance due to XXXX operational failures. XXXX. The ACH rejections were the result of fraudulent activity, not merchant misuse or misconduct. XXXX. My original requests for clear resolution, proper reimbursement, and accountability were ignored for an extended period. XXXX. Your companys internal handling of this matter has placed the financial burden of fraud on my business. At every stage of this process, XXXX XXXX has focused primarily on protecting its own financial position rather than addressing the full scope of harm caused to my business and household. The emphasis has consistently been on how your company would reconcile the issue internally, rather than how I would be made whole for the losses, disruption, and operational impact caused by your negligence. The financial impact of this situation has been severe. All of my personal funds have been depleted as a direct result of this matter. I am currently unable to afford even basic necessities, including essential groceries such as milk. This hardship is not the result of mismanagement on my part it is the result of unresolved fraud, improper account handling, and delayed remediation by your company. Additionally, the continued negative balance on my account has created further operational harm. My financial institution has informed me that I can not fully utilize my new business account until this matter is resolved, meaning your companys failure to correct this issue is actively restricting my ability to conduct business and stabilize my finances. For the record : I responded promptly to your initial request for a meeting. No response was provided to my follow-up communications. A sales representative later contacted me with inconsistent information. No credit or adjustment was posted when promised. My account remains negative as a direct result of XXXX actions. At this point, I have retained legal counsel. All further communications will be reviewed accordingly. Please consider this email formal notice that I will be proceeding with regulatory filings and documentation with the following agencies : Federal Trade Commission ( FTC XXXX Consumer Financial Protection Bureau ( CFPB ) XXXX Attorney General XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX ) Applicable payment network and compliance oversight entities In addition to my own experience, there are numerous publicly available complaints and reviews describing fraud-related activity, unauthorized charges, account misuse, delayed responses, and unresolved disputes involving your company. These reports raise serious concerns about internal controls, monitoring systems, and response procedures related to fraudulent activity and merchant account protection. While I am not asserting wrongdoing beyond my own documented experience, the consistency of these reports suggests a need for closer regulatory and legal scrutiny regarding how fraud is detected, managed, and remedied across your organization. I am requesting, one final time, written confirmation of : 1. When my account will be restored to a non-negative balance, which should have already been completed. 2. That no additional debits or fees will occur. 3. That all fraud-related financial impacts will be fully reconciled in my account, not merely accounted for internally by your company. 4. A final accounting of all charges, credits, and ACH activity. 5. A formal written report emailed to me by this time tomorrow. If this matter is not fully resolved, including both financial correction and accountability, it will proceed through formal legal and regulatory channels. Sincerely, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX ( XXXX ) XXXX XXXX Registered XXXX | XXXX : XXXX On Wed, XX/XX/XXXX at XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX wrote : I will have my lawyer get in touch soon. XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX XXXX ( XXXX ) XXXX XXXX Registered XXXX | XXXX : XXXX On Wed, XX/XX/XXXX, XXXX XXXX XXXX XXXX wrote : Hello, Please see response to your questions : The exact amount being refunded or credited - {$3600.00} The date the adjustment will be posted - As previously mentioned, there are ACH rejects on the account from the fraud sales that did chargeback so these funds will be used to cover those rejects. Confirmation that no additional charges will occur - The terminal that the fraud activity occurred on was deactivated so no further transactions can go through. Whether a formal meeting is still required - I do not believe a formal meeting is needed. XXXX XXXX, XXXX XXXX XXXX XXXX : A XXXX XXXX XXXX XXXX XXXX work from home # XXXX XXXX Customer Service : XXXX XXXX Customer Service : XXXX XXXX Customer Service : XXXX XXXX XXXX XXXX # logos From : XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX Sent : Wednesday, XX/XX/XXXX XXXX PM To : XXXX XXXX XXXX Subject : Re : XXXX XXXX XXXX XXXX XXXX // XXXX Hello XXXX, I am following up again regarding this matter. After your initial email requesting that I schedule a meeting, I responded promptly. Since that time, there has been absolutely no movement on the resolution I requested, and my follow-up communications have gone unanswered. Instead, I received a call from XXXX stating the amount would be reduced to {$390.00}. However, as of today, no adjustment or credit has been posted to my account. At this point, all of my prior requests for clarification and resolution have been ignored, and this process has gone well beyond what I originally asked for. Please provide a written update immediately addressing the following : The exact amount being refunded or credited The date the adjustment will be posted Confirmation that no additional charges will occur Whether a formal meeting is still required If I do not receive a timely response, I will proceed with formal escalation and documentation through regulatory and legal channels. Thank you, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX ( XXXX ) XXXX XXXX Registered XXXX | XXXX : XXXX On Sat, XX/XX/XXXX at XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX wrote : Dear XXXX XXXX, Thank you for your continued correspondence regarding the fraudulent activity on my XXXX XXXX XXXX XXXX XXXX account XXXX I am writing to formally document the facts, preserve my legal rights, and demand immediate, complete, and lawful remediation for the financial, operational, and reputational harm caused by this incident. Here are some key facts for the record ) My business, XXXX XXXX XXXX XXXX XXXX XXXX XXXX, does not have any online payment portal, checkout system, or API integration accessible through my website or public platforms. I did not provide terminal credentials or API keys to any third party. My bank, Atlantic Union Bank, has confirmed that the compromise did not originate from their systems. XXXX / XXXX Payments creates, issues, manages, stores, and controls all API keys associated with merchant accounts. Atlantic Union Bank and XXXX XXXX XXXX XXXX XXXX XXXX do not. You have stated in writing that this fraud resulted from exposure of an API key through a third-party technology vendor servicing merchant accounts. I do not have any relationships with third-party vendors. My only financial service providers are XXXX XXXX XXXX XXXX and Atlantic Union Bank. A qualified computer and cybersecurity professional has reviewed my systems and confirmed that the breach did not originate from any of my devices, email accounts, website, or internal systems. I entrusted XXXX / XXXX Payments with my businesss financial operations, payment processing, and transactional security. That trust was a material and reasonable part of our business relationship. The exposure of API credentials through a vendor operating under your platforms control represents a breach of that trust, a failure to safeguard my businesss financial infrastructure, and a deviation from reasonable commercial security standards. As a direct and foreseeable result of this incident, my business incurred multiple overdraft and NSF fees, experienced operational disruption, risk to my tax software integrations, delayed client payments, administrative burden, and reputational harm within my community as a professional financial services provider. Importantly, my business has only recently opened and is just beginning to gain significant client traction and a good reputation with the community. This incident interfered with my ability to serve new clients, process payments, and establish trust during a critical early growth phase. The goodwill credit offered does NOT adequately compensate for the financial and operational losses, my time investment and administrative burden ( s ), the companys reputational damage, business growth interference and loss of goodwill and client confidence in XXXX XXXX XXXX XXXX XXXX XXXX. Under established commercial and tort law principles, business interruption, reputational harm, and loss of goodwill are recognized as categories of recoverable damages when a service providers security failure foreseeably harms a business. As a direct result of this incident, I have spent a substantial number of professional hours addressing unauthorized transactions, communicating with your organization, coordinating with my bank, consulting technical experts, securing my systems, and mitigating harm to my business operations. During this time, I was unable to fully serve my clients or focus on revenue-generating work. Accordingly, I will be issuing a formal invoice for the reasonable value of my professional time, administrative burden, and business interruption caused by this incident. These costs are separate from, and in addition to, any goodwill credit offered and are recoverable as consequential damages under principles of negligence, breach of duty, and business interruption. Further, while I have cooperated with your internal investigation process in good faith, I am not legally bound by your internal determinations, policies, or discretionary procedures. Any resolution to this matter must be based on applicable law, not solely on internal company findings or unilateral decisions. I reserve the right to reject any determination that does not fully and fairly compensate my business for the totality of the harm suffered. It is not reasonable, appropriate, or legally justified to expect my small business to absorb any portion of the harm caused by a security failure that did not originate from my systems, credentials, website, or bank. Under principles of negligence, breach of duty, and reasonable reliance, a service provider that undertakes to secure sensitive financial access must exercise appropriate care. When that duty is breached and damages result, the responsible party must bear the cost of remediation. Accordingly : I expect the full goodwill credit to be issued to my account within XXXX ( XXXX ) business day without reduction. I expect XXXX / XXXX XXXX to absorb all additional costs associated with this incident, including all bank and NSF fees, chargeback-related losses, administrative and recovery costs, business interruption ( s ), and reputational harm Given the scope of the harm, the disruption to my early-stage business, and the breach of trust involved, the goodwill credit should be increased, not reduced. I therefore, demand that you provide the total amount of the original goodwill credit and provide confirmation that it will be issued in full, a breakdown of any chargebacks and why they are being charged back to me with laws that justify this action, written confirmation that no further debits will occur, and lastly, confirmation that all additional costs will be absorbed by XXXX XXXX XXXX XXXX. The damage to my professional reputation within the local business community is having a measurable impact on client trust and business growth. As part of full remediation, and consistent with recognized remedies for loss of goodwill and reputational injury, I am requesting that XXXX / XXXX Payments fund a local marketing and reputation-restoration campaign to help rebuild confidence in my business, including : XXXX. Local digital advertising XXXX. Community-based marketing XXXX. Client communication support XXXX. Brand reputation restoration efforts Because this incident involved unauthorized access associated with my merchant account credentials, and because exposure to such credentials creates an ongoing risk of misuse, I am requesting : Business identity-theft protection services for my company, including monitoring for fraudulent use of my business name and financial information. XXXX of any reasonable costs associated with protecting, repairing, or restoring my business identity. If reputational or security concerns require a business name change, coverage of the associated legal, administrative, branding, and filing costs. These measures are consistent with reasonable mitigation and remediation obligations following a credential-related security failure. Under XXXX and XXXX law, payment processors have a legal duty to protect merchant accounts, credentials, and transaction systems, and to handle unauthorized activity fairly, transparently, and responsibly. XXXX XXXX XXXX XXXX ( UDAP Va. Code 59.1-196 et seq. ) : XXXX law prohibits unfair or deceptive acts or practices in connection with consumer and business services. This includes misrepresenting security protection, failing to disclose material risks, or shifting responsibility to customers for internal or vendor-related security failures. Businesses harmed by such practices may seek damages, attorney fees, and other statutory remedies. Uniform Commercial Code ( UCC ) Articles 3 & 4 : Merchants are not responsible for unauthorized transactions they did not approve. In this case, I did not authorize the transactions, did not provide access credentials, and did not operate any online payment system through which such access could have occurred. https : XXXX and https : XXXX Federal Trade Commission XXXX : Companies may not misrepresent security protections or unfairly shift responsibility to customers when failures o

Company response to consumer: Closed with explanation