Consumer complaint received 2023-01-07
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: MD
Product: Credit card or prepaid card
Sub-product: General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement
Sub-issue: Card was charged for something you did not purchase with the card

Complaint:
I am a victim of credit card fraud and or identity theft. In XXXXXXXX XXXX an account with Bank of America was opened in my name. I am not a customer of BoA, and have no business relationships with the company. My bank is XXXX. I found out about the account with BoA in my name today because I have a fraud monitoring service with XXXX. XXXX had some alerts about the BoA account being XXXX days past due, and some fraudulent addresses associated with my name and social security number. Once I examined the alerts, I called into the XXXX Fraud Line and reported the issue. I talked over some of the facts with the XXXX rep. I had frozen my credit file with all three credit organizations in XX/XX/2022, along with those of my wife because I wanted to protect myself against fraud ahead of the holiday season. ( I am a cybersecurity professional by trade ). The fraudulent BoA account was opened prior to my freezing our credit files. 
My belief is that a cyber crime organization poisoned the credit verification service that my car dealership used to check my credit prior to my purchasing a car last year ( ~sometime around XX/XX/XXXX ). I applied for credit online through the link the local dealership sent me. The online credit verification service appeared to be in XXXX. When I was applying, I noticed a flashing screen, like you would see when your transmission is being re-directed to a new server. ( I am familiar with these techniques as a result of my military service ). This only lasted a few seconds. I performed the standard checks at the time : I verified the link was the same address/vendor as XXXX sent by my dealership ; I observed the " lock '' in the address line confirming the connection was to a site with secure registry ( https ). I confirmed my firewall was active, configured correctly, and ran a quick scan to confirm their were no obvious viruses downloaded on my device. With these checks confirmed, I proceeded. As a result, all of the data required for a cyber criminal to open a new account with a third party organization would be obtained by the poisoned site. 
I called and reported the fraud to BoA today through their hotline. They were very helpful, and seemed to understand that this was fraud pretty quickly. The scammers had associated XXXX address with my name and SSN for the purposes of their theft which were fraudulent. One is in XXXX, XXXX, and the other is in XXXX. I reside in XXXX and have no real connections to those states either by myself or through family. I actually called XXXX in late XXXX and had them remove the XXXX  address from my credit report, because it was degrading my credit score. Apparently the scammers supplied a new address to BoA from XXXX. 
Prior to these experiences, I had received numerous phishing attempts to my email address allegedly from BoA. These were clearly phishing, and so I just placed them into my spam. I did not think anything of this because I was receiving consistent spam with lots of third party organizations ( XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX ) which I have no business relationship with. It was obvious that the criminals were merely guessing. I have been trained to look for these give-aways. I forwarded the phishing attempts to XXXX Fraud alerts ( XXXX ) for their review. I sent them about XXXX  XXXX different phishing samples hoping XXXX would at least " bad list the addresses or contact the network owners of the compromised accounts. I don't know if they did this. I also received phishing attempts via text, and voice mail from some people claiming to be from BoA. I ignored them because as I said I have no business with BoA and it was so obvious they were phishing attempts. I believe I can supply some of these phishing samples for forensic analysis from my sent box if needed or desired. 
The damages appear to be about {$9800.00} in fraudulent charges, and the damage to my credit file ( it has lost XXXX points in XXXX days ). The loss appears to be against BoA right now, as I keep a close eye on my financial accounts. I am concerned that my wife may be affected, as we applied for credit jointly for the new car. I have not been able to investigate that as of this report.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation