4nt1p4tt3rn 🏴☠ Appalachistan Wolf Lodge #47@4nt1p4tt3rn
While everyone's once again on the whole "USAA is garbage" warpath (they are), it's time once again for me to share a little story from 2013:
As some of you know, I do computer security stuff. Not just professionally, but for fun.
One day in December 2013, I got some spam email. It was a phish. Purporting to be from USAA. Since I was taking 2 years off from working (voluntarily; I'd just gotten married and wanted to focus on me for a while), I had ample time on my hands.
So, I started digging.
Long story short: I located the threat actor -- full name, address, photo, front door, and all his infrastructure. I infiltrated that, and obtained full details of every USAA customer he's successfully tricked into handing over everything: PII, credentials, account details, credit/debit card info, the works. Along with his other campaigns running, pretending to be other banks.
I packaged this all up professionally and approached the appropriate people in USAA about it. Explained who I was, that I'd done this professionally for decades, that I'd been a long-standing customer of USAA, etc.
I was told, in no uncertain terms -- in fact, in these exact words -- "It's our policy not to pursue fraud".
I was a bit taken aback. I had to have them repeat, and then explain that. I couldn't've possibly heard that right.
Here I was, a security professional, handing them a fairly large threat actor on a silver platter, along with a decent-sized list of USAA customers that either had been victims of fraud, or were about to be.
And they not only said they weren't interested, but that they intended to do quite literally nothing. Absolutely nothing.
Earlier that year they'd stopped underwriting motorcycle policies, so I had already pulled my auto and bike insurance from them.
So, I spent Christmas Eve night that year (because I wasn't about to wait) sitting in the office of a local bank opening new accounts, transferring everything out of USAA.
The following week we took it to the State Police. They were interested, but had no idea what to do with the information, even after I politely suggested various avenues to pursue. And I was talking with the officer who was in charge of "all the computer stuff".
The report remains on file.
The threat actor remains at large.
His victims remain screwed.
USAA doesn't give two shits about you, and hasn't for quite some time.
