Product: Credit card or prepaid card

As part of the State of Californias employment development program I received a debit card issued by Bank of America. I have used it on and off since 2010. This winter XXXX sent a notice to all California employees ( dont know if these are only those currently working or looking for work or they include past employees ) that, due to problems incurred during the pandemic and economic stimulus, individuals were applying for payments who did not have valid documentation to receive it. I was asked to submit my XXXX or evidence of self-employment to ensure I qualified. I did so. 
In mid XXXX I noticed a series of withdrawals from the debit card that I had not made. They started in XXXX and continued until XX/XX/XXXX. I contacted the bank and they quickly said they had to cancel my card and issue a new one as this could be a breach of the banks security. I then was directed to the fraud division to file a report. The representative was able to see my account, the withdrawals, when they occurred and apparently who authorized them. When I checked my account the authorizations were identified as the State of California, Department of Economic Development. I filed a report. 
On XX/XX/XXXX I received a terse letter from the bank stating that the bank had determined that no error has occurred in this instance. That was it. 
I contacted XXXX and talked to a representative and a lawyer, both of whom declined to identify themselves. I was told XXXX doesnt remove money from individuals accounts. If an overpayment occurs XXXX sends a letter so stating and depending on the letter, a form is filed and a payment plan is initiated to recover the funds. 
I was also told Bank of America has been involved in a number of inappropriate actions, such as denying account holders access to their funds and seizing funds. The bank is subject to a number of lawsuits, including XXXX class action suit. 
XXXX stated that they had delivered all funds that were available and appropriate to my account. The State is not responsible for the handling of those funds after that ; the bank does. I asked what I could do the retrieve the XXXX moneys, the lawyer felt he could not advise me, but I should pursue greater information from the bank and talk to an individual who was more senior than those I had talked to. The representative said she understood the XXXX XXXX was looking into this and was concerned about the banks behavior. 
I found, through online research that the bank has been trying to vacate the contract with the XXXX, but the XXXX will not permit the contract to be broken. 
Not only does the bank refuse to acknowledge any role in this ; but the reason for the removal of money from my debit account keeps changing, indicating to me that the bank is just looking for an excuse that will stick. First it was that I authorized the transaction. I asked how did they know it was I? Another letter arrived stating that no posting error occurred. But they will not state who made the withdrawals or where the money was deposited. 
Through a weak firewall in the banks Web site, theft was allowed to persist for over a month with no awareness on the banks account. The hack was correctly caught once and the funds returned. Why didnt that alert the bank to in intrusion and cause a response, even if only to me to guard my account and change the password? 
The hacking and identify theft occurred on the banks Web site, not in my email. I do not communicate with the bank by email ; however, the bank does sometimes notify me of modifications to my account by email. Its all XXXX way. 
I dont use online banking. If you look at the banks records and the page concerning the activity in my account in question, you will see that the only thing I use the XXXX account for is paying my mortgage. Money comes in intermittently from the federal government. I take the card, with my drivers license, to the bank and pay the mortgage from the account. Thats all Ive used it for the last XXXX years. 
The state of California feels the bank is trying to avoid responsibility. The XXXX Police feel the same. The bank knows what the identity of the receiving bank is and what that account is, but instead of pursuing what is clearly fraud, it gave me excuses and intimated its my doing. I havent had any problem with this account since I got, until recently, indicating an aberration, not standard practice. The state has indicated the bank has thousands of claims against it, lawsuits and a class action identified by XXXX XXXX in a XXXX XXXX on XXXX. 
The bank has {$1.00} XXXX dollars under active management and has insurance to protect against this sort of event.