Product: Credit card or prepaid card

I received unemployment insurance compensation in the State of California. CA loads the benefits onto a Bank of America prepaid card. BofA has an online portal to activate the card, check balances, and transfer money to your bank account. The card and portal worked well for over a year. I had not used the portal to transfer money as I was satisfied using the prepaid card, but on XX/XX/XXXX a thief was able to gain access the BofA portal and change the p/w, email, & bank account and then transfer XXXX to their bank account. The BofA portal does not offer 2-factor authorization and BofA only alerted me after the transfer was completed. I called the BofA Fraud Claims XXXX and they opened Claim # XXXX and they assured me that they could see that it was fraud and the money would be restored to my account. I asked that all the money left in the account ( XXXX ) be sent to me in a check and even after talking to a supervisor they said it was not possible ( an incorrect statement ). I asked for the portal to be taken offline so the thief could not access it again and they said it was not possible but the supervisor changed my email, password, security questions and sent out a new debit card and I was told that if I did not activate the new card there could be no access to the funds in the portal. Before I received the new card the thief activated it changed the email, p/w, security questions, & added their bank account and immediately transferred another XXXX to their account on XX/XX/XXXX. I called the Fraud # and set up another claim # XXXX. We again changed the credentials with the fraud dept. and again I asked that the portal be removed but was told it could not be done. I spent 6 hours on the phone that day demanding that the remaining balance be sent to me via check and I was finally sent to the Funds Transfer Department and the issued a check for the balance of funds ( XXXX ). I now had a 0 balance in the portal but had 2 outstanding fraud claims totaling XXXX. I spoke with the Fraud protection supervisors and they assured me that the claims would be processed in my favor as it was clear fraud and that the portal could not be accessed by anyone including me because they noted that the card had been compromised/stolen. On XX/XX/XXXX claim # XXXX was completed and XXXX was credited to my account in the portal that I had no access to. A letter was mailed to me which I received on XX/XX/XXXX and I immediately called the Funds Transfer department to have the money sent to me but the thief had already transferred/stolen XXXX ( a new weekly limit BofA had initiated for their portal ). They sent a check for the XXXX balance and opened a new claim # XXXX for the XXXX that was just stolen on XX/XX/XXXX. Even though I had no active card or access to the portal and obviously a thief had full access, BofA refused to shut down the online portal. So now I have 2 open claims for a total of XXXX as follows XXXX for XXXX & XXXX for XXXX. Both of these claims have been denied 4 times now. The only explanation given for the denial is we have determined that no error has occurred and consider this claim resolved. I have spent 10 hours with the Fraud Department opening the claims back up for Reconsideration. Each time I speak with a supervisor who will take copious notes and assure me that they can see that this is obvious fraud and that it will get resolved. When I press to speak with the department that is denying the claims I am told it is impossible but that I can send them a fax ( I have faxed them 15 times with no response ). I have asked 6 times for documentation on the denial of the claims and have only received a statement that shows charges that were made by me as well as the transfer that went to the thief and no other explanation. I have spent over 23 hours dealing with BofA and at this point they just parrot we need to let the research department do their job and there is nothing more we can do, the problem is that the Research Department keeps denying the claims and the Claims Department keeps sending it back to the Research Department for reconsideration in an endless loop ( over 100 days now ). My situation is not unique as XXXX XXXX XXXX XXXX has done a story on the fact that the bankofamerica.comXXXX website is not secure, has no 2-factor authorization, & millions of dollars have been stolen from consumers with no resolution from BofA.