TAMPA, Fla. — Fiserv is pushing back against allegations by FiCare Federal Credit Union that weaknesses in the financial technology company’s fraud-prevention systems have exposed members to fraudulent card transactions, arguing in two federal court filings that the credit union has misrepresented how its security systems operate and is attempting to turn a longstanding contractual dispute into an emergency.
As the CU Daily has reported, FiCare FCU is one of a number of credit unions and now one community bank that have filed lawsuits alleging security weaknesses at Fiserv.
In filings Sept. 28 and Oct. 5 in the U.S. District Court for the Middle District of Florida, Fiserv urged the court to reject FiCare’s requests for expedited discovery and a temporary restraining order that would require changes to the company’s procedures for authenticating cardholders who contact its fraud prevention call center.
Fiserv also disclosed that it activated an additional authentication feature for FiCare on Oct. 2, after the credit union requested the security measure.
Response to Allegations
The filings represent Fiserv’s response to allegations by FiCare that fraudsters have been able to circumvent identity-verification procedures, remove restrictions on potentially compromised payment cards and conduct unauthorized transactions.
FiCare has alleged that at least 18 fraudulent transactions occurred in August and that weaknesses in Fiserv’s procedures create continuing risks for the credit union and its members.
Fiserv disputes the allegations, contending that its systems use multiple layers of authentication and that FiCare has not provided sufficient information to establish that the reported transactions resulted from deficiencies in Fiserv’s services.
The company also alleges FiCare is using repeated emergency motions to gain leverage in litigation rather than resolve technical concerns through discussions between the two organizations.
Fiserv Disputes Alleged Security Weakness
At the center of the latest dispute is Fiserv’s EnFact interactive voice response system, which handles calls from cardholders whose transactions have been flagged as potentially fraudulent.
According to Fiserv’s Oct. 5 filing, FiCare has asserted that an unauthorized caller could use a cardholder’s telephone number and Social Security number to pass authentication checks and remove a fraud restriction without speaking to a live representative.
Fiserv said that characterization is incorrect.
The company maintains there are no circumstances in which its automated EnFact system will authenticate a caller and resolve a potentially fraudulent transaction using only those two pieces of information.
Fiserv acknowledged that its attorneys initially provided FiCare with an inaccurate description of part of the authentication process in a Sept. 24 communication.
The company said it corrected that information Sept. 30 and subsequently provided a sworn declaration from a company representative explaining the procedures.
Additional Security Cited
Fiserv also said its call center offers an additional security feature involving one-time passcodes delivered by text message, email or telephone.
According to the filings, FiCare had not previously elected to activate that feature despite its availability for several years.
After Fiserv brought the option to the credit union’s attention, FiCare requested its activation, and Fiserv said the feature was enabled Oct. 2.
Fiserv maintains that the change addresses FiCare’s stated concerns about authentication at the contact center, although the credit union continued to pursue emergency court relief.
Fiserv Challenges Request for Emergency Relief
In its Oct. 5 filing, Fiserv argued that FiCare has failed to demonstrate the imminent and irreparable harm necessary to justify a temporary restraining order.
The company said FiCare is effectively asking the court to rewrite the parties’ contractual relationship by requiring Fiserv to change authentication procedures it has used for years.
Fiserv and FiCare have operated under a master services agreement since 2013.
According to Fiserv, that agreement requires the company to assist FiCare in preventing fraudulent activity and recovering losses but does not guarantee that fraud will never occur.
Fiserv also argued that any financial losses resulting from fraudulent transactions could be addressed through monetary damages rather than emergency injunctive relief.
The company said the changes FiCare is seeking would require extensive programming, testing and coordination with third-party vendors.
Fiserv estimated that its contact center will handle approximately 40 million calls related to debit and credit cards in 2026, including about 6 million calls involving its EnFact automated system.
Creating a separate authentication process for FiCare could take months rather than days or weeks, Fiserv said, and could create operational risks for other customers.
The company maintained that FiCare has not demonstrated that the potential harm it faces outweighs the burdens that the requested injunction would impose.
Dispute Over Expedited Discovery
In its Sept. 28 filing, Fiserv separately challenged FiCare’s request to accelerate the exchange of information related to the alleged security weaknesses.
FiCare submitted four interrogatories, seven requests for production and eight requests for admission on Sept. 17.
Fiserv said it agreed to investigate the allegations and share information informally but declined to commit to the accelerated discovery schedule requested by the credit union.
The company said FiCare filed its emergency discovery motion Sept. 22, two days before Fiserv provided its initial findings.
Fiserv also accused FiCare’s attorneys of failing to comply with a federal court rule requiring attorneys to confer in good faith before seeking judicial intervention in discovery disputes.
The company argued that FiCare had not demonstrated sufficient cause to depart from the court’s ordinary discovery schedule.
Fiserv further maintained that the call center allegations are not part of FiCare’s second amended complaint, which includes claims involving breach of contract, fraud and trade secret misappropriation.
The company said the lawsuit’s existing claims concern other products and security features.
Earlier Security Disputes Cited
Fiserv’s filings also describe a series of previous disagreements with FiCare over security features and alleged fraud incidents.
Among the incidents and exchanges cited by Fiserv were:
- July 2025: FiCare sent a demand letter alleging that certain Fiserv products lacked multifactor authentication and threatening emergency legal action unless the company agreed to specified changes.
- January 2026: FiCare filed its lawsuit and subsequently sought Fiserv’s agreement to expedited discovery in anticipation of a possible preliminary injunction motion.
- March 2026: FiCare reported that a member had suffered an alleged $8,000 loss following a security incident. Fiserv said it requested additional information and provided findings in April.
- April and May 2026: FiCare made additional demands involving security concerns and possible emergency injunctive relief, according to Fiserv.
- September 2026: FiCare raised new allegations involving the removal of fraud restrictions from payment cards, prompting the latest discovery and emergency injunction motions.
Fiserv contended that it repeatedly offered to address the concerns through direct discussions between technical and business representatives but that FiCare declined those opportunities.
The company also disputed FiCare’s assertions that it had failed to provide findings concerning earlier security incidents, saying it had furnished information about incidents in 2024 and 2025.
These accounts are Fiserv’s characterizations of the parties’ exchanges and remain disputed allegations in the litigation.
Other Credit Union Lawsuits Referenced
Fiserv also pointed to separate litigation involving Self-Help Credit Union and Cencap Federal Credit Union, both of which have pursued claims against the company involving alleged security deficiencies.
According to Fiserv, federal courts rejected requests for temporary restraining orders in those cases.
The company said FiCare’s legal counsel also represents the credit unions in those proceedings and argued that the litigation follows a similar pattern of demands for emergency relief.
Fiserv further alleged that FiCare’s attorneys have sent more than 20 demand letters on behalf of various credit unions since May 2025.
The company characterized the litigation strategy as an attempt to impose additional costs and obtain negotiating leverage, allegations that have not been established by the court in the FiCare case.
What Happens Next
Fiserv is asking the federal court to deny both FiCare’s request for expedited discovery and its motion for a temporary restraining order.
The company also opposes establishing an accelerated schedule for preliminary injunction proceedings.
According to the Oct. 5 filing, fact discovery in the underlying lawsuit is scheduled to continue until May 2027.
Fiserv maintains that the dispute should proceed under the court’s existing case management schedule rather than through emergency proceedings.
The two filings are arguments submitted by Fiserv, not judicial findings. Neither document establishes that the court has ruled on the latest motions or resolved the underlying allegations concerning Fiserv’s security systems.
