Pay Flex review: HSA health savings account

I am filing a fraud complaint and claim against Pay Flex, the FSA administrator for the $9,500 transferred out of my account from November 3 to 13. I found out I ran out of funds when I went to Walgreens to pick up a prescription with a $100 copay, and my card balance was only $47.49 with an account balance of $9,547.49. I knew immediately that my account had been hacked. I logged into my account as soon as I arrived home and saw the multiple funds transfers amounting to $9,500; one amount for $3,000 was debited and then corrected only to be debited again; looks to me like an inside job. I called Pay Flex and spoke to a Security Team member in the Philippines who reviewed my account and confirmed that the account to which the funds were transferred (ending in 6666) did not match the account number in my profile ending in 7526. I was told the matter would be escalated, so I was expecting to receive a call from Pay Flex this morning, but no, no one called.

I called this morning, was rerouted to the Philippines again and asked to be transferred to the US to highlight the severity of the issue; the first person I spoke to kept repeating that Pay Flex is not responsible for the management of our funds, not sure what they think the word “Administrator” means. In the end the call was dropped, so I called back and this time spoke to Rhiannon and Jason who explained to me that the escalation process takes about five business days, that they are not a financial institution, so in other words, Pay Flex is managing billions of dollars in funds, yet they do not feel obligated to secure our assets. I kept asking them how their security process works reiterating that in this day and age of identity theft and scammers, all they need to do is send their customers a text message to authenticate the request; a text message is the most reliable authentication method because a scammer can steal my identity but not my cell phone, so I still do not understand why after the account number was apparently changed and money funneled out of my account the security did not notice it. One has to wonder what security check they are performing; a good security team manages by exception, if there is really one at PayFlex, why were such egregious transactions missed? These activities were outside the reimbursement process and yet did not raise any red flags: first a bank account number is altered, then funds are withdrawn immediately afterwards depleting the account to zero, and no one notices! What kind of organization is the government entrusting our money to? Something needs to be done. My research shows that Aetna’s systems were breached, yet I never received any correspondence; Aetna manages the Pay Flex debit card.

I also strongly believe, this was an inside job, why? I tried to access account last night, and never received the code (security check, right?), via text, it was not until I requested it via email that I received it. I know from previous experience that within an organization, a cell phone can be blocked from receiving text messages. I am asking that Pay Flex reimburse me as soon as possible and be investigated for their bad processes, negligence and complete lack of security as they clearly do not believe they are responsible for safeguarding our assets. I demand my funds be reimbursed as soon as possible. Pay Flex must be held accountable for their negligence. This appears to be an inside job, Pay Flex needs to explain the $3,000 correction.