Product: Credit card or prepaid card

On XX/XX/2021 I logged into my Bank of America online account to check my credit card balance to see what payment was due. I noticed an odd transaction called ACH payment refund for {$2000.00} on XX/XX/XXXX. When I called customer service, I was told that this was a refund of my XX/XX/XXXX statement payment that was requested over the phone. I told the customer service representative that I did not request any such thing and she said my information must have been compromised. She said I would not be liable for the charge, closed the card and reissued me a new card. My issue with Bank of America is that I want to know how such a transaction occurred without extra security such as a text message verification code, or email verification code, due to the large and unusual nature of requesting a payment back almost a month later. I have alerts set up that are supposed to send me texts whenever a charge happens, but I did not see any kind of alert that specifically says to notify me when a payment gets refunded. I believe I have the name of the customer service representative who took the call from the impersonator, XXXX, because when I re-checked my email yesterday to make sure I did not miss an email with a code from BofA from XX/XX/XXXX, I saw an email on XX/XX/XXXX from BofA requesting feedback on my recent call with XXXX, when no such call was placed by me. I was also told BofA keeps transcripts of calls with customer service reps. I spoke to various customer service representatives over a few hour period on the XXXX including the fraud department. I was told there has been an uptick in this type of fraud over the last month. I tried various times to find out what specific information this impersonator would have had to provide to get this transaction enacted, with no answers. I didn't ask for the specific soc, drivers license id, etc, just wanted to know what questions should be asked. I would like this information so I know if I need to request a new social security number, driver 's license number, etc. I'm extremely concerned about the security of my bank accounts there, since it seemed easier for this impersonator to get money vs me get answers on what generic questions someone would need to ask to enact this transaction. A huge flag should have been that the impersonator asked for the money to be refunded to a completely different account than I had paid the bill from. If BofA has noticed an uptick in this fraud, any payment refunds should go back to the original account the amount was paid from, in this case my Bank of America checking account, which is always where I pay this bill from. Then I could decide to move the funds elsewhere. There are always data breaches going on, so just because a person can say a social security number, address, date of birth, does not mean that such an odd transaction is legitimate. If I had been called or texted to my cell, this never would have occurred. I also had a verbal passcode on my account and am curious if the person was asked for that. I was not asked for mine yesterday. I have since updated the code and required it to do any transactions over the phone. Perhaps BofA should have other security questions to ask when odd transactions that have never happened come up especially over the phone, since fraudsters are more than likely going to have a soc, date of birth, etc. I'm very disappointed in the seemingly poor security measures of huge financial institution as BofA and their lack to help tell me what information has been compromised.