I’ve used Capital One as my primary ‘brick and mortar’ bank for many years now. Never had an issue with them until recently. A few months ago I logged in to find that in addition to my own bank accounts, I mysteriously had access to 3 new bank accounts with a total of over $100,000.00. This was very concerning because I wasn’t sure if in turn, someone else had access to my accounts. I immediately drove to my Capital One location. They said they would escalate to their security division. The problem was never resolved. A month ago I called their security division for another update. They said that they didn’t have record of this issue (ugh), but they would resolve it within 2 weeks. It has now been over 2 weeks and the issue has not been resolved. I literally have access to other people’s money and they don’t seem to be taking this issue seriously?! I need some guidance on this. I’m scared of identity theft and this smells rotten…
Update 1: I’ve been on the phone with Capital One for the last hour, being transferred from department to department. I do think they are starting to take this seriously though. I really appreciate everyone’s guidance. Thank you! I am also in the process of transferring money out of MY accounts into my secondary bank as a precaution. Capital One has assured me that the other people do NOT have access to my accounts, but I want to play it safe. Many of y’all have joked about messing with the other accounts, but I won’t do that because I don’t like playing with fire. I’ll post another update if I get anywhere with Capital One today. Otherwise, I will post a complaint with the several regulatory bodies you guys have suggested.
Update 2: I was finally escalated to someone in their ‘management staff’ whatever that means. They said this type of issue typically takes 20 business days to resolve from the time the case was officially opened. He said I should expect the issue to be resolved in the next few days and that I would hear back from them directly once it is closed. I did document the Case Number as well as the names and departments of the two primary people I spoke with. I will go ahead and file a complain with the OCC and/or CFPB.
Update 3: I filed a complaint with the OCC.
Update 4: I filed a complaint with the CFPB. I need to step away from my computer for a while, so no more updates until I hear something from someone. Thank you all for your guidance!
Update 5: A lot of you have asked whether I can see the other people’s PII. The answer is yes. I can open up each of those accounts, see their names, their address, their spending history, and even look at pictures of their cashed checks with their signatures on them.
Update 6: **Final Update** Looks like this got sufficient attention and Capital One’s ‘Escalated Solutions Team’ called me this evening confirming everything has been resolved. I have checked my account online and everything looks good. Apparently the primary account holder for these mystery accounts named me as the Power of Attorney. Supposedly I share the same name as the person they actually intended on naming as the Power of Attorney. This is crazy considering I have a very rare name. Apparently I’ve had access to these accounts for much longer than I realized, but they assured me that no one ever had access to my accounts. Per the person I spoke with, their legal team also notified the primary account holders. Boy, I would have loved to be a fly on that wall. I have also taken fastidious notes about this whole process and requested a formal letter from Capital One explaining all of this and the final resolution. I’m just glad this is hopefully all behind me. You can’t imagine the amount of time I spent on the phone with Capital One today.
File a complaint with the bank’s regulatory body.
Hijacking top comment to say this. If you believe your account is compromised and the bank is not doing anything, file a claim with the CFPB
The banks are very scared of these complaints.
Story time. Chase Bank kept screwed up so many things. I talked to the boss, the bosses boss, the bosses bosses boss over the course of 7 months to no avail. Finally filed a complaint with the CFPB and it was resolved in 30 hours.
A few years ago Capital One sent me unsolicited checks for cash advances out of my credit card.
I never asked for these checks and never knew they were coming. Nobody warned me about these checks.
Then of course, somebody stole my mail, cashed the checks and maxed out my credit card. I don’t even use the card, so the only way I noticed was when I started making minimum payments on it.
Of course I called them and sorted it all out, but there is no way in hell I would ever trust capital one with my actual money, if they are so careless with their own money. This, also I would consider registering this with the Police as this would help if any legal ramifications crop up.
Record the phone calls, let them know you’re doing it. I don’t know what state you’re in, but I promise you reps would be a bit extra careful knowing you’re recording the conversation for quality and playback service.
Yea, that’s especially concerning since accounts are generally linked to online banking via social security numbers. Is it possible that a family member added you as a joint account holder? If not, someone either entered their SSN wrong and entered yours, is using your SSN or something is very wrong with Cap One’s tech. Either way, I would continue to call back and impress the urgency upon them.
Definitely not anyone I know. I can see the two primary account holders and they share the same last name, but they are people I don’t know. I even asked all my relatives if they knew these people and no one has knowledge of them. I googled the names and there is someone in Florida and someone in Brazil with that name. It isn’t a very common last name.
I work for a bank and have an extensive career in banking, both in management on the customer facing side and on the compliance end.
First off, based on your edits, you did the right thing with a cfpb complaint. Ignore the people saying talk to the police, a lawyer, or the fbi. This is almost certainly a case of human error and not fraud. Most likely, these accounts were opened legitimately as joint accounts recently. One of the joint account holders likely has a similar (or identical) piece of demographic information as you, probably name. The banker who opened the account probably searched this information, pulled up your profile, and didn’t check other info (DOB, TIN, etc.). Thus, the accounts were opened under your name and not the legitimate joint account holders, which also linked the accounts to your online profile.
Here’s what boggles my mind: yes, most entry level customer service at banks is relatively poor. But there is no excuse for this not at least partially being resolved at the first notification. While changing the demographic info to the correct customer may take time, they should be able to instantly remove the accounts from your online profile. The fact that this wasn’t done, and appears to still not be done, speaks volumes. This is a serious breach of privacy and honesty, I have fired bankers for much less in my time.
Action to take:
Double check the addresses and contact info listed on your valid accounts. It’s possible when the accounts were opened they did a full update to your profile and changed info there.
Normally I wouldn’t recommend closing your accounts for something like this, as there is no indication that anyone else has access to them, but given the gross incompetence shown so far, I wouldn’t be horribly surprised if they end up ‘fixing’ it by changing all of your profile information to match the other customers information, as opposed to creating a new profile for this. This course of action WOULD give that other individual access to your accounts.
As everyone else here said, don’t touch the other accounts that aren’t yours.
I second this. Having worked at banks as well, it’s more likely a clerical error than anything nefarious. And it’s rare enough so front line agents aren’t savvy enough to know how to resolve it. Also, the issue is more of a technology one than a security one. Of course you’ll have to deal with the fallout of a stranger being able to view your info and maybe they’ll offer credit monitoring for a year or something like that. But to fix the issue with the accounts being linked you’ll likely need someone on their technology team to unlink it on the back end. You’ve done everything correctly. Unfortunately you’ll have to keep on them to get it corrected.