Consumer complaint received 2022-02-23
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CA
Product: Credit card or prepaid card
Sub-product: Government benefit card
Issue: Problem with a purchase or transfer
Sub-issue: Charged for a purchase or transfer you did not make with the card

Complaint:
B of A Fraud Claim - {$5000.00} I am once again reaching out to the CFPB requesting assistance on my {$5000.00} fraud claim. Bank of America continues to deny this claim with the only stated reason being no posting error has occurred. I feel strongly that B of A is in violation of Regulation E with regards to this claim and possibly many other similar claims. I ask that the CFPB review the facts of this claim, and similar outstanding and unresolved claims against B of A and consider appropriate enforcement action. At least one prior class action claim confirmed that B of A has been negligent in their handling of similar claims and I ask that the CFPB hold them accountable as they continue to disregard their customers rights and their own responsibilities as custodian of our accounts. 
The facts of my claim are as follows : On Friday, XX/XX/2021, a {$5000.00} transfer was initiated by someone unknown to me to an account at another bank also unknown to me. I had not provided my card, PIN, or password, to any other person and had not authorized any person to use my card or initiate a transaction. This transaction on XX/XX/2021, was the first of two unauthorized transfers initiated on this account. 
On Sunday, XX/XX/2021, I discovered the fraudulent transfer and notified B of A of the details at about XXXX XXXX that day, less than two full business days after the transaction was initiated. I was able to provide the bank representative with the routing number and last 4 digits of the account number the {$5000.00} was transferred to. I was confident that the bank could stop the transfer and possibly take action against the perpetrator as the funds would not have been deposited to the receiving account until at least Monday, XX/XX/2021. It appears that the bank did nothing to stop this transfer or identify the person/account that received those funds. 
On XX/XX/2021, there was a second transfer initiated for {$1900.00}. I fortunately discovered that transfer on the same day it was initiated. I contacted B of A and the receiving bank, based on the routing number, and alerted both banks of the fraudulent transfer in process. In the end, that second fraudulent transfer attempt failed with no loss to me. 
Based on the details I could see that the two transactions were identical in how they were processed. In both cases the bank transfer data screen in my account was somehow populated with a routing number and account number without my knowledge and apparently without triggering any alerts at B of A. In both cases the transfers were initiated two days after larger than normal credits had been posted to the account resulting in a larger than usual current balance. The person initiating these transfers must have had access to transaction level detail in order to time the transfers accurately and for amounts that largely depleted the account. The perpetrator also either had access to the bank system or in some way was able to access my account without my knowledge. There were no signs such as changes to my password or other information that indicated someone had stolen my account or identity. The only irregularities were the two transfers initiated on XX/XX/2021, and XX/XX/2021. Based on the number of similar complaints reported to the CFPB by other cardholders it is clear this was not an isolated issue. Shortly after XX/XX/2021, B of A issued me a replacement card that included increased security such as chip technology. I believe B of A made this change, increasing card security, due to the high volume of fraudulent activity they were experiencing on similar accounts. There has been no suspicious activity on this account since that updated card was issued. 
Over the months between XX/XX/2021, and today I have had numerous interactions with B of A customer service representatives. While they always had to refer the issue to the Fraud Department they were, without exception, sympathetic regarding my loss and indicated that they were dealing with a high volume of fraudulent claims. During an XX/XX/2021, call the B of A representative explained that my claim had initially been incorrectly coded by the bank. She requested that I change the email and security information on my account, which I did while on the phone, and she then confirmed to me that the claim would be treated as fraudulent and the {$5000.00} would be returned to my account. The bank did not honor that commitment. 
In XXXX a different bank representative asked that I file a police report with the local police department as it would add further support in characterizing the claim as fraudulent. I did file a report at B of As request and forwarded it to the bank. Once again the bank did nothing as far as I can tell. 

B of A is in violation of Regulation E.

Regulation E Section 1005.2 ( m ) defines an unauthorized transfer as : ( m ) Unauthorized electronic fund transfer means an electronic fund transfer from a consumer 's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit. 

This exactly describes the transaction that resulted in my {$5000.00} loss. It was a transfer from my account initiated by someone other than me that did not have authority to initiate the transfer and I have received no benefit from the transfer.

Regulation E Section 1005.6 addresses consumer liability : 1005.6 Liability of consumer for unauthorized transfers. 
( b ) Limitations on amount of liability. A consumer 's liability for an unauthorized electronic fund transfer or a series of related unauthorized transfers shall be determined as follows : 1. Application of liability provisions. There are three possible tiers of consumer liability for unauthorized EFTs depending on the situation. A consumer may be liable for : ( 1 ) up to {$50.00} ; ( 2 ) up to {$500.00} ; or ( 3 ) an unlimited amount depending on when the unauthorized EFT occurs. More than one tier may apply to a given situation because each corresponds to a different ( sometimes overlapping ) time period or set of conditions.

2. Consumer negligence. Negligence by the consumer can not be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer 's liability for unauthorized transfers. ( However, refer to comment 2 ( m ) -2 regarding termination of the authority of given by the consumer to another person. ) 3. Limits on liability. The extent of the consumer 's liability is determined solely by the consumer 's promptness in reporting the loss or theft of an access device. Similarly, no agreement between the consumer and an institution may impose greater liability on the consumer for an unauthorized transfer than the limits provided in Regulation E.

1 ) Timely notice given. If the consumer notifies the financial institution within two business days after learning of the loss or theft of the access device, the consumer 's liability shall not exceed the lesser of {$50.00} or the amount of unauthorized transfers that occur before notice to the financial institution. 

I notified B of A on Sunday, XX/XX/2021, of the unauthorized transfer initiated on XX/XX/2021. This is less than two business days from the transaction date and on the same business day that I learned of the transaction. My loss should not exceed {$50.00} per Regulation E.

B of As stated reason for denying my claim is no posting error has occurred on your account. I suppose they could say that they were simply following the transfer instructions initiated on XX/XX/2021. While this might be true, they are ignoring the fact that those instructions were fraudulent and not initiated or approved by me and not for the benefit of me or anyone connected to me. Perhaps they see this as no error but that is not the point. They processed a transaction that was fraudulent from the start, reported as fraudulent, and reported in a timely fashion per regulation E. The errors that did occur were errors committed by the bank. Their system allowed a person to access my account and initiate this transfer. And then, once notified, there is no evidence that the bank took any steps to stop or suspend the transfer or to identify the perpetrator of this fraud. It appears that the bank did nothing, abdicating their responsibility as a service provider and custodian of my account. So yes, there were errors related to this transaction, errors by the bank. 
In reviewing CFPB complaints filed against B of A for similar accounts and transactions from XX/XX/2021 through XX/XX/2021 I find a list of 98 complaints from California customers. In reviewing the detail I see that many are virtually identical to the fact pattern of my claim. That is a claim that someone unknown to the account holder somehow initiated a transfer to another bank account. These are not isolated problems. In reading the complaints I see that the bank is often accused of treating the customer as the criminal. I feel the same way. Being a responsible professional over a long career it is insulting for the bank to accuse me of submitting a false claim. I can see that many other cardholders feel the same. I can not think of a better example of horrible customer service which results in frustration along with a significant financial loss to the customer.

I believe the bank is fully aware of all these issues but is unwilling to accept responsibility for their shortcomings as far as account security to prevent fraudulent activity and then their failure to follow up when fraud is reported. I suppose to do so, to take responsibility, would be too costly and to take the low road, claiming no posting error has occurred on your account is the best response they could come up with. 

I request the bank reopen my claim for review. I request the {$5000.00} be returned to my account that was stolen via an unauthorized transfer on XX/XX/2021. If the bank is unwilling to return the stolen funds, as required by Regulation E, I request a full report and documentation supporting their conclusion. I specifically request information as to the identity of the recipient of the funds, which the bank should have access to, and actions taken by the bank during the week of XX/XX/2021, to investigate and stop this fraudulent transfer. 
I also ask the CFPB consider looking into B of As handling of this complaint as well as the many other similar complaints as this appears to be a recurring, systematic problem. It is your stated mission to make sure banks, lenders, and other financial institutions treat us fairly. Please do renew your commitment to that mission and make sure that B of A is treating its customers fairly.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation