Wells Fargo Bank-Impersonation Vishing and 2FA Bypass: $100,000 Wire (2022 fraud; 2023 lawsuit)

What happened

On October 24, 2022, a Wells Fargo customer had a legitimate call with a Wells Fargo premier banker at 1:10 p.m. Nine minutes later, at 1:23 p.m., she received a call whose caller ID spoofed Wells Fargo's genuine 800 number. The caller, impersonating the bank, claimed her account was compromised, sent her a two-factor authentication code, and asked her to read it back, which she did. Using that code, the fraudster changed her online banking password, enrolled her account in a wire-transfer feature ("Wires Basic"), and initiated a $100,000 wire to a payee named "Savage Car Wash" in Miami, Florida, double the bank's alleged standard $50,000 online-wire limit. While still on the phone with the scammer over an hour later, the customer went to a Wells Fargo branch, where an employee said it sounded like a scam and that the wire was in process; a call-center rep told her the wire had been recalled and gave her a confirmation number, but the wire was never actually stopped and the money was sent. Per the complaint, Wells Fargo credited her $50 as a "courtesy." The customer sued in Los Angeles (LA Superior Court case 23STCV18422, filed Aug. 3, 2023; related federal complaint C.D. Cal. 2:23-cv-07321-SPG-PD, dated Nov. 22, 2023), and discovery produced a recorded call in which the Wells Fargo wire-verification representative, whom the complaint describes as unidentified, told the fraudster the amount was "an unusual amount of money," that this was why the account "had been flagged," and that a "second review" was required, then approved and released the wire anyway. Wells Fargo's online banking agreement contains a standard arbitration clause, and the federal docket confirms the bank invoked it here: Wells Fargo moved to compel arbitration on December 13, 2023, and Judge Sherilyn Peace Garnett granted that motion on February 22, 2024, dismissing the first amended complaint without prejudice. Arbitration proceedings and awards are not public, so no merits judgment or settlement figure exists on the public record.

How it worked

Per the complaint: at 1:10 p.m. on Oct 24, 2022, the customer had a legitimate call with her Wells Fargo premier banker/advisor and declined proposed investments. At 1:23 p.m., nine minutes later, she received an inbound call whose caller ID displayed the same Wells Fargo 800 number she normally saw, a spoofed call from a fraudster impersonating the bank. The caller claimed her account was compromised and, using Wells Fargo's own customer-facing verification convention, sent her a two-factor authentication code and asked her to read it back to "verify her identity." The customer complied, believing it consistent with the bank's normal process (and primed by having just spoken to a real Wells Fargo employee minutes earlier). Using the harvested 2FA code, the fraudster allegedly changed her online banking password, enrolled her account in a "Wires Basic" wire-transfer feature, and initiated a $100,000 wire to a payee called "Savage Car Wash" in Miami, Florida, an amount double Wells Fargo's alleged standard $50,000 online wire limit. While still on the phone with the fraudster (over an hour into the call), the customer grew suspicious and walked into a Wells Fargo branch, where a branch employee told her it sounded like a scam and that a fraudulent $100,000 wire was already in process. She then called the Wells Fargo call center; a representative told her the wire had been recalled and gave her a confirmation number. The next day she learned the wire had not been recalled: the $100,000 had gone to Savage Car Wash. Discovery later produced a recorded call between the fraudster and the Wells Fargo employee on the wire-verification line, whose identity the complaint states could not be ascertained. On that recording, per the complaint, he told the fraudster the $100,000 request was "an unusual amount of money" and that this was why the account "had been flagged," that any transfer above $50,000 required a "second review," and that a delay of 24 to 48 hours could occur, then said "But no worries I'm going to release this wire transfer transaction and transfer it today," and released it.

The lure and the tell

The lure: an inbound call arriving just 9 minutes after a real Wells Fargo advisor call, displaying the bank's genuine, familiar 800 number on caller ID, from someone who already knew enough context to sound legitimate and who used the bank's own "read back your verification code" convention, the same convention the customer said Wells Fargo itself normally used with her. The tell (in hindsight, and flagged instantly by a human once involved): the request to read back a 2FA/OTP code over an inbound call is never legitimate no matter what the caller ID shows, since real banks generate the code for outbound-initiated verification, not to be "confirmed" to an inbound caller; additionally, a wire request that exceeds a bank's own stated review threshold, arriving on the heels of a suspicious 2FA event, is a textbook fraud pattern that the bank's own wire-verification representative explicitly recognized and verbalized (an "unusual amount of money," an account that "had been flagged," a required "second review") before releasing the wire anyway, meaning the institutional tell existed and was verbally acknowledged, but not acted upon.

Outcome

Per the complaint, Wells Fargo credited the customer $50 as a "courtesy." None of the $100,000 came back: the recall failed and the funds reached the payee, so the pleaded net loss is $99,950. She filed suit (LA Superior Court case 23STCV18422, filed Aug 3, 2023; also captioned in removed/related federal filing C.D. Cal. 2:23-cv-07321-SPG-PD, complaint dated Nov 22, 2023) alleging state-law claims including UCC/Commercial Code security-procedure violations and intentional infliction of emotional distress. Wells Fargo never answered the complaint on the merits. The federal docket records how it ended procedurally. Wells Fargo moved to compel arbitration on December 13, 2023 under its standard online-banking arbitration clause, and Judge Sherilyn Peace Garnett granted the motion on February 22, 2024, dismissing the first amended complaint without prejudice. Because arbitration is private, no merits judgment, award, or settlement amount is on the public record. Treat this as a dispute routed into private arbitration, not as a verdict for either side.

Why it matters

This case is unusually well-documented because litigation discovery produced the bank's own internal recorded verification call, giving rare, verbatim evidence of a real-time human control (the $50,000 wire threshold and its second-review requirement) being recognized aloud and then not applied. The complaint does not allege complicity: its own theory is that the fraudster "duped" the representative, and it separately calls him incompetent. It also illustrates a structural weakness in the verification convention itself: banks that ask customers to "read back a code we just sent you" as routine identity verification are using the identical script a scammer needs, so customers cannot distinguish a legitimate verification call from a spoofed one by process alone. The suspicious 9-minute gap between a real advisor call and the fraudulent call also raises (unproven) concerns about possible information leakage enabling more convincing, better-timed social engineering.

Defenses

Documented failure modes exposed by this case: (1) banks that use "read back the code we texted you" as an identity-verification ritual train customers to comply with exactly the request a vishing scammer will make; (2) caller ID is not authentication: spoofing a bank's real published 800 number is trivial and customers have no way to distinguish it from a real call; (3) dollar-threshold controls (Wells Fargo's alleged $50,000 online-wire limit requiring a "second review" and a delay of 24 to 48 hours) are only as strong as the human enforcing them: the complaint alleges the representative verbally acknowledged the threshold, the flag and the review requirement, then released the wire anyway; (4) a recorded-line policy for high-value wire verification is a good control only if supervisors audit the recordings in real time or near-real time, not just after a customer complaint triggers discovery; (5) post-incident whistleblowing to a branch employee who could see the wire in process shows some fraud-detection worked, but the recall failed and, per the complaint, was misrepresented to the customer, who was then told, again per the complaint, that the bank would not help her recover the funds unless she first admitted in writing that she had authorized the wire. Recommended practices for consumers/institutions: banks should never ask customers to read back a one-time code over the phone as a verification step; customers should independently call back a number from a statement/card rather than trust an inbound caller-ID match, especially within minutes of another bank call; institutions should treat wire-limit overrides as requiring documented supervisory sign-off, not a single rep's discretion; recorded verification calls should be sampled/audited proactively, not just pulled in discovery.