Consumer complaint received 2019-05-12
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: MD
Product: Credit card or prepaid card
Sub-product: General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement
Sub-issue: Card was charged for something you did not purchase with the card

Complaint:
In XX/XX/2019I received a letter from Bank of America ( BoA ) saying that my credit card may have been involved in a merchant data breach and while they have not identified any fraud on my account, they would be cancelling my current credit card and sending me a new one just to be safe. The new card, along with ten ( 10 ) others that I was issued in the following two months were all stolen in a matter of days. Most of the card numbers were used online before I received the physical card and on at least one occasion a new card number was used within 12 hours of BoA cancelling the previous number. After the 11th card, I asked BoA to stop reissuing me cards as I was shredding them upon receipt. 

I have transaction alerts set up so I receive an email every time a transaction is made on my account. I called BoA immediately after each unauthorized transaction. Over the next two months we ruled many possibilities such as someone having access to my online account, mail tampering, having my identity stolen, the old card number being allowed to process under a new number, and my spouse is stealing my card number. A BoA fraud specialist suggested the last one. Each time I made sure to ask BoA what card number was submitted to initiate the transaction and I was assured that it was the NEW card number. Someone is getting and using my new card numbers/account credentials each time. 

The other topic that the BoA fraud department kept bringing up was XXXX XXXX XXXX XXXX XXXX XXXX  I was informed repeatedly by BoA that merchants, whom I have authorized to make recurring charges, can obtain updated account information when my card number is changed. However, there were unauthorized transactions at XXXX clothing store, XXXX XXXX  ( like XXXX XXXX, XXXX department store, XXXX XXXX XXXX, and others and 1 ) I had not done business with these merchants previously, and 2 ) the charges did not appear to be for recurring/subscription type purchases. These were first-time, one-off transactions. I found several other CFPB complaints ( XXXX, XXXX, XXXX, XXXX, XXXX, XXXX, XXXX, XXXX, XXXX, XXXX, XXXX ) related to XXXX but all of these cases do involve repeated charges from a single merchant. In my case, my new numbers are being used at new merchants for the first time. 

Im submitting this complaint for two reasons. First, I want an answer to the following question. How is it that someone is repeatedly gaining access to my updated account information and using it to initiate NON-recurring transactions with merchants I have not done business with previously? 

And second, my experience with BoA in trying to resolve this issue has been awful. I have called BoA fraud servicing dozens of times and spent at least 30 hours of my own time ( mostly during my work day that I had to make up ) to report fraudulent activity and explain the situation to the new person each time. I was never reconnected with someone familiar with my situation. Also, no one from BoA ever called me back to ask for additional information or clarification. This is acceptable if they have all the information they need to solve the problem, but after 11 stolen credit cards and four months of being unable to determine how my card is repeatedly being stolen, they obviously do not. 

It is nowXX/XX/XXXX, four months after I initially called BoA, and I recently received a voicemail from BoA stating that they have submitted a request to XXXX to remove my account from XXXX. This course of action is unsatisfactory because it means either that BoA is taking a throw something at the wall and see if it sticks approach or that there is a serious security vulnerability with XXXX. Recall, I have not been having difficulty with a recurring charge from a specific merchant. XXXX should not explain my situation. And if XXXX is the source of the problem it means that someone has identified a vulnerability in XXXX and is exploiting it to get updated account credentials and use them to initiate non-recurring transactions at non-recurring merchants.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with non-monetary relief