Consumer complaint received 2019-06-11
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: WA
Product: Money transfer, virtual currency, or money service
Sub-product: Domestic (US) money transfer
Issue: Other transaction problem

Complaint:
This complaint is about Bank of America ( BofA ). Claim # XXXX On XX/XX/19 two of my bank accounts ( XXXX XXXX and Bank of America ), as well as XXXX account, was compromised in the form of unauthorized outbound transfers. I filed claims with all companies. XXXX and XXXX conducted investigations and concluded within a few days that it was unauthorized and returned the money. 

BofA informed me on XX/XX/19 that the claim was denied as it was consistent with the pattern of my previous logins given the two-factor authentication code provided matched. See attachment. 

on XX/XX/19 I appealed to Bofa with additional documentation explaining that " Upon closer investigation, we found out that our home network and computer ( a XXXX ) was hacked into and remotely controlled which is how the hacker was able to succeed with these unauthorized transfers money. The hacker was able to overcome two-factor authentication process by using the XXXX desktop application that was running on the desktop computer. This allowed them to intercept the text messages for two-step authentication process ( which would be received on my phone and the desktop app ), use the code, and delete the message ( which would then delete it on my phone as well ) after using without me realizing. Since the attack was done during night time this made it harder for us to notice. '' On XX/XX/19 I received a call from a BofA reviewer, named XXXX, who clearly had not reviewed the additional documentation or did not understand them as I had to explain everything again and after explaining she told me that it seems things are resolved and that she is going to close the case. I explained then that the claim is not resolved as what was resolved was with the other two companies and BofA has not returned the stolen money that was transferred to a completely unknown to me XXXX account ( XXXX ). She then asked if the computer I used had a virus and I told her that the virus scanner did not show any trace of any virus or malware. She explained that then she can not do anything without me proving that there was at least a virus on the computer. I tried to explain to her that a simple XXXX search shows that there are multiple ways a computer can be hacked into and taken over without a virus/malware present. She gave me a fax number in case I could produce documentation that the computer was infected with Virus at which point she would be able to review that. 

I am at a loss about next steps as I am left with burden of proof that I was hacked through a virus, which I can not do and yet the fact that I have not authorized these transactions do not seem to matter to BofA and it appears that by using this method BofA can clear themselves of any responsibility of protecting their customers which is unacceptable. I have taken several steps to reduce the risk of this happening by replacing our router and desktop computer, as well as disabling XXXX app on the new desktop.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief