Suncoast Credit Union Allowed Cybercriminals to Open Fake Accounts with Stolen Data, Class Action Claims

New to ClassAction.org? Read our Newswire Disclaimer

A proposed class action alleges Suncoast Credit Union has negligently allowed cybercriminals to open fake bank accounts in consumers’ names via its online banking platform.

Want to stay in the loop on class actions that matter to you? Sign up for ClassAction.org’s free weekly newsletter here.

The 24-page lawsuit says that unauthorized third parties have exploited the credit union’s “loose” and “unsound” security authentication protocols and used stolen information to open fraudulent accounts through the SunNet Online Banking platform, where new accounts can be created “in just a few minutes” and with “minimal security requirements.”

The suit alleges that Suncoast, one of the 10 largest credit unions in the U.S., has failed to adequately authenticate and protect the personal information of thousands of consumers who now suffer the repercussions of identity theft and fraud.

According to the filing, negligence on the part of Suncoast has since at least last year allowed fraudulent accounts to be opened “on a large scale” throughout Florida, with many residents surprised to receive welcome letters, checks, debit cards or bank statements from the defendant despite having never applied for an account. In fact, the “vast majority of the victims” have never banked with Suncoast at all, the lawsuit relays.

Despite representing that “[keeping] financial information secure” is a “priority,” Suncoast’s online banking portal allows consumers and cybercriminals alike to open checking or savings accounts by submitting an individual’s personal data “without any further verification or authentication on the part of Suncoast,” the lawsuit alleges. Per the complaint, the company makes no attempt to contact a consumer to verify their identity before creating a new account.

The suit argues that Suncoast’s failure to promptly detect and notify consumers that their personal information has been used to open an unauthorized account reveals the credit union’s “nonchalant approach” to security and “disregard for data protection.”

Further, despite the ease with which cybercriminals can open unauthorized accounts, getting Suncoast to close them is apparently much more difficult, the case shares. In the event the credit union promises to “open an investigation” into a fraud report, Suncoast will then purportedly cease all communication with a victim, who’s then forced to hound the company for updates on their case, the complaint claims.

The plaintiff, a Florida resident, received by mail in October 2022 a new debit card and letters from Suncoast, thanking her for opening two new accounts—a regular savings account and a “Smart” checking account, the filing describes. The woman had never banked with Suncoast and did not authorize the creation of the accounts in her name, the lawsuit says.

Per the suit, the plaintiff immediately began the “burdensome” process of closing the fake accounts, and after reporting the fraud and filing an identity theft report with Suncoast, the woman did not hear from the company until she called again in January of this year. The plaintiff was then told that the unauthorized accounts had been closed in mid-December but was given no explanation as to how they were opened or where the data thief had obtained her information in the first place, the case relays.

The lawsuit looks to represent anyone residing in Florida who had a checking or savings account opened under their identity by Suncoast via the SunNet Online Banking platform, without authorization and using personal information.

Get class action lawsuit news sent to your inbox – sign up for ClassAction.org’s free weekly newsletter here.