A Jacksonville woman says scammers posing as her credit union convinced her to surrender her debit card, then drained roughly $42,000 from three of her accounts in a matter of days.
Now Mary E. Maier is suing VyStar Credit Union, arguing that warning signs appeared before she ever received the impersonation call and that the credit union later failed to properly investigate her fraud claim.
The lawsuit, filed Aug. 14 in federal court in Jacksonville, says unknown people gained unauthorized access to Maier’s online banking on Nov. 13, 2025, changed her password and later called her while pretending to represent VyStar, according to News4JAX.
Over the next week, the complaint says money moved out of Maier’s checking, savings and money market accounts through internal transfers, ATM withdrawals and purchases stretching from Jacksonville into South Florida.
The Scammers Told Her to Give Her Debit Card to a Courier
According to the lawsuit, an unauthorized device accessed Maier’s online accounts at about 1:06 p.m. on Nov. 13. Her password was then changed without her permission.
Hours later, she received a phone call from people claiming to be VyStar representatives. The callers persuaded her to turn over her debit card to a courier, and someone later arrived to collect it.
The lawsuit emphasizes that the unauthorized online access and password change occurred before Maier spoke with the impersonators or surrendered her card. Her attorneys argue that signs of an account takeover were already present before the scammers obtained the physical debit card.
About $42,000 Disappeared Over Seven Days
Between Nov. 13 and Nov. 20, the complaint says the scammers drained approximately $42,000 from Maier’s accounts. The transactions included ATM withdrawals along with purchases worth hundreds or thousands of dollars at Best Buy, Target, the Apple Store, GameStop and several high-end retailers.
Some ATM withdrawals occurred in Broward and Palm Beach counties. Maier’s lawsuit says she remained in Jacksonville during that period and that the sudden geographic and spending pattern was inconsistent with her normal account activity.
The complaint says the money came from her checking, savings and money market accounts, with internal transfers allegedly helping make funds available for the withdrawals and purchases.
Her Lawsuit Says Fraud Alerts Should Have Stopped the Spending
Maier’s attorneys accuse VyStar of failing to respond properly as unusual account activity accumulated. The complaint alleges that certain security controls had been disabled for marketing reasons and that fraud alerts should have resulted in the accounts being locked.
Maier reported the disputed activity to VyStar on Nov. 20. According to the complaint, the credit union denied her claim and told her the losses occurred because she had surrendered her debit card and shared account information.
The lawsuit says VyStar did not provide the written explanation Maier contends was required after the denial or give her documents she requested concerning the investigation.
Regulation E Specifically Addresses Access Devices Obtained Through Fraud
The fact that Maier physically surrendered her debit card does not, by itself, resolve the legal dispute over whether the resulting transactions qualify as unauthorized electronic fund transfers.
Under Regulation E’s official interpretation, an unauthorized electronic fund transfer generally involves a transfer initiated by someone other than the consumer without actual authority and from which the consumer receives no benefit. The Consumer Financial Protection Bureau’s official commentary specifically says an unauthorized transfer includes one initiated by a person who obtained the consumer’s access device “through fraud or robbery.”
Questions about what information she provided, how individual transactions were authenticated, what authority the scammers had and how VyStar investigated the claim remain matters for the litigation.
She Says the Fight Continued After She Reported the Fraud
The lawsuit says Maier received provisional credit for less than the full disputed amount but was later prevented from accessing that money. She sent another notice of error and a formal request for documents by certified mail in June 2026. Her attorneys say VyStar received the correspondence but failed to investigate or respond within the deadlines required by the Electronic Fund Transfer Act and Regulation E.
Regulation E generally requires a financial institution to investigate a qualifying electronic-transfer error and determine whether an error occurred within 10 business days.
If the institution cannot complete the investigation within that period, it can generally take additional time if it provisionally credits the disputed amount within the required timeframe and gives the consumer use of those funds while the investigation continues.
If an institution concludes that no error occurred, federal rules require it to report its findings and provide a written explanation. Consumers also have a right to request the documents the institution relied upon in reaching its determination.
VyStar Says It Investigates Fraud Cases Thoroughly
VyStar declined to discuss the specific allegations because the litigation is pending but defended its fraud-prevention and investigation procedures.
The credit union told News4JAX that its systems include real-time text and telephone alerts asking customers to confirm or deny suspicious activity. VyStar said accounts are immediately locked when members respond that a transaction is fraudulent.
VyStar also said financial institutions are seeing an increase in scams in which victims are persuaded to provide debit card numbers, PINs and one-time security codes.
Those credentials can make fraudulent transactions appear properly authenticated even when technical security measures are operating as designed, the credit union said. The institution said it takes fraud seriously and investigates cases thoroughly and fairly in accordance with applicable law.
Police Are Investigating Similar Cases
The lawsuit says the Jacksonville Sheriff’s Office Economic Crimes Division has an open criminal investigation involving Maier’s case and other similar cases affecting VyStar customers. The complaint also says suspects have been identified.
JSO confirmed to News4JAX that the investigation remains active but declined to provide further details. Maier is seeking actual damages, statutory damages, attorneys’ fees and treble damages under the Electronic Fund Transfer Act. VyStar has not been found liable, and the allegations in Maier’s complaint remain unresolved.
Never Hand Your Debit Card, PIN or Security Code to Someone Who Calls You
The FDIC warns about bank impersonation scams in which criminals claim suspicious activity has occurred and ask victims for debit card numbers, passwords or other sensitive information. Consumers should end the unexpected contact and call their financial institution using a trusted number, such as the one printed on the back of the card or published on the institution’s official website.
A legitimate fraud investigation should not require a customer to hand a debit card to a stranger sent to the home. PINs, online-banking passwords and one-time passcodes should likewise not be supplied to an unexpected caller, even when that person already knows the customer’s name, account details or recent transaction information.
If a card or banking credentials have already been given to a scammer, contact the bank or credit union immediately. Ask for the card and compromised credentials to be disabled, change online-banking passwords from a trusted device and review all accounts for transfers or purchases that are not recognized. The CFPB advises consumers to report unauthorized electronic transactions promptly.