Consumer complaint received 2025-12-29 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement — Card was charged for something you did not purchase with the card
Company: SYNCHRONY FINANCIAL
State: IN

Complaint narrative:
I am submitting this rebuttal because Synchrony Banks response is factually incorrect, incomplete, and contradicted by their own systemgenerated evidence. 

1. Synchrony claims no unauthorized access occurred.

This is disproven by multiple systemgenerated emails from Synchrony showing repeated attempts to add the fraudulent PayPal Credit Card to XXXX XXXX. These provisioning attempts occurred on : XX/XX/XXXX XX/XX/XXXX XX/XX/XXXX XX/XX/XXXX XX/XX/XXXX at XXXX XXXX  ( document attached ) These emails are not marketing messages. They are accountservicing alerts triggered only when someone initiates adding the card to XXXX XXXX. I do not use XXXX XXXX, do not own XXXX devices, and did not authorize any provisioning attempts. These events constitute ongoing unauthorized access. 
2. Synchrony failed to provide required fraud investigation records. 
Despite repeated requests, Synchrony has not provided : Device identifiers used in the provisioning attempts IP addresses Token request logs Authentication method used Whether the device passed issuer verification Whether the device was previously associated with my identity These records are required under : FCRA ( reasonable investigation ) Reg Z ( fraud liability and investigation standards ) XXXX rules for digital wallet tokenization Synchronys own cardholder agreement Synchrony can not claim a reasonable investigation while withholding the very logs that determine whether access was authorized. 
3. Synchronys statements contradict their own system activity. 
Their response claims no unauthorized activity occurred, yet their system repeatedly attempted to provision the card to XXXX XXXX at earlymorning hours. This is incompatible with their claim that the account was secure or that no unauthorized party accessed it. 
4. The fraudulent account remains an active identitytheft risk. 
The XX/XX/XXXX provisioning attempt shows that the issue is ongoing, not historical. Synchrony has not taken steps to secure the account or prevent further misuse. 
Requested Action : I request that the CFPB require Synchrony Bank to : 1. Provide the full fraud investigation logs listed above. 
2. Correct all inaccurate credit reporting associated with this fraudulent account.

3. Confirm closure of the fraudulent account and block further provisioning attempts.

4. Provide a corrected response that does not contradict their own systemgenerated evidence. 

Beginning on XX/XX/2025, I started receiving multiple systemgenerated emails from Synchrony stating that my card was being added to XXXX XXXX. These emails are not marketing messages ; they are triggered only when someone initiates a digital wallet provisioning attempt. Additional provisioning attempts occurred on XX/XX/XXXX, XX/XX/XXXX, XX/XX/XXXX, and XX/XX/XXXX at XXXX XXXX. These repeated attempts show ongoing unauthorized access to the fraudulent account. 
I reported the fraud to Synchrony and disputed the unauthorized charge. I also requested the fraud investigation records, including device identifiers, IP addresses, XXXX XXXX provisioning logs, token request metadata, and the authentication method used. Synchrony did not provide this information and instead claimed that no unauthorized access occurred, which contradicts their own systemgenerated provisioning emails. 
The fraudulent account remains a risk because someone repeatedly attempted to add the card to XXXX XXXX at earlymorning hours. Synchrony has not provided the required investigation documentation, has not explained the unauthorized provisioning attempts, and has not resolved the unauthorized charge. 
I am requesting that the CFPB require Synchrony to provide the full fraud investigation records, correct any inaccurate reporting, close the fraudulent account, and address the unauthorized transaction and repeated unauthorized access events.

Company response to consumer: Closed with explanation