FINRA has fined SoFi USD 1.1 million due to alleged consumer identification flaws across its cash management brokerage service enabling fraudsters to take funds approximating USD 2.5 million. According to a filing made with the Financial Industry Regulatory Authority (FINRA), SoFi had failed to establish and maintain an effective customer identification programme or a written identity theft prevention programme for its SoFi Money unit.

Instead, SoFi depended on a largely automated process which, from December 2018 to April 2019, it utilised to authorise the opening of approximately 800 accounts within the service for third parties. The regulator claims that this method was not adequately designed to authenticate the customers' identity, thus making it susceptible to fraud committed by third parties utilising fake or stolen identities. Navigating its fraud challenges Financial Industry Regulatory Authority (FINRA) 's concern appears validated by the matter that fraudsters used SoFi Money accounts to seize approximately USD 8.6 million in funds over the allotted period from the accounts of customers at other financial institutions without authorisation.

From this sum, around USD 2.5 million was then withdrawn by the third parties through ACH transfers, ATM withdrawals and debit card purchases, all while exploiting the alleged flaws in SoFi’s CIP and ITPP frameworks. The filing acknowledges that SoFi itself identified these shortcomings, prompting the fintech to take remediation efforts. These efforts include intensifying staff training and bolstering its fraud identification processes and customer verification logic.

Additionally, SoFi is reported to have collaborated with third-party consultants to tackle the volume of fraud alerts following the public introduction of SoFi Money in February 2019. .