Consumer complaint received 2022-02-01
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CA
Product: Mortgage
Sub-product: Conventional home mortgage
Issue: Applying for a mortgage or refinancing an existing mortgage

Complaint:
To Whom it May Concern : I am a California resident and applying for a mortgage with Bank of America. However, I have not been allowed to redact part of my bank account numbers on my statements just to reflect at least the last 4 digits or more. I am concerned about the potential for fraud and privacy concerns.

Furthermore, I am concerned that this information will be used, sold or disclosed to third parties for marketing or other purposes.

As background, I am in the middle of applying for a loan. The bank has requested historical statements to show funds available. I had previously uploaded the statements redacting the account number except for the last four digits. They rejected it as unacceptable because it causes the statement to become unauthentic. 

Additionally, for at least one account, my bank showed it as combined with other accounts not listed or offered as assets to be verified on the loan application. I only have historial statements that have combined information with other accounts. My bank is unable to segregate the accounts out on a historical basis and provide statements on just that single account. ( I have notified them of this problem and going forward they have indicated separate statements will be provided just not historically ). As such, I redacted the other bank account numbers not listed on the loan application, and thus not used as assets for the purpose of obtaining the loan and uploaded those documents. Again, the documents were rejected by the bank as unauthentic and that the lender needed to see all accounts even the irrelevant ones not listed on the application. 

The banks agents indicated that the banks policy is to only accept documents with the full account number and unredacted. Any other form would be not considered authentic or altered. However, the selling guide at XXXX XXXX indicates that bank statements with at least the last 4 digits is acceptable. See link below. 

XXXX XXXX XXXXXXXX Furthermore, the redacted accounted number would not interfere with the underwriters ability to verify the beginning bank balance, ending bank balance or intervening bank transactions. Thus, the redaction would not hinder the underwriting and verification of information or authenticity of the documents for lending purposes. 

Lastly, the courts have also accepted redacted statements and recognized that redaction does not impair the authenticity of that document. 

Even lawyers redact documents for privilege and recognize that redaction does not impair the authenticity of the document. 

The redaction, however, would preserve the privacy of the consumer, prevent fraud and prevent the disclosure of such information further down in the lending, sharing or marketing process. This is especially critical given that the consumers name, DOB, SSN and other sensitive PII are included in those same documents and in the wake of cybersecurity attacks. 

I am frustrated by this process because it forces me to unreasonably give up the right to my financial privacy to information that is not fully needed ( ie. full account number is not needed only partial is necessary ) and to information that is not relevant ( ie. accounts not listed on my loan application ) when a compromise ( such as partial redaction of account number or full redaction of the accounts not listed on the loan app ) could be had and is fully acceptable even by other institutions such as XXXX XXXX. 

You also do not disclose upfront to potential applicants that a verification of deposit is another acceptable form of documentation even under your own policy. I wish you had told me upfront rather than after several pushbacks on the issue. Thus, query whether the redacted account number is an acceptable alternative but simply not disclosed as an option or not evenly applied to all customers.

Even under Reg E, the Fed has recognized the significant risk that the full account number on ATM receipts pose and has required it to be truncated to just the last 4 digits. Why is a bank statement that is required to be provided to another party for a consumer product any different?

Redaction of the account number except for the last four digits is such an easy fix and would further reduce the risk of identity theft and consumer fraud committed against the consumer, as well as any sale or disclosure of such information by banks to third parties.

From a consumer perspective, I do not know if there are any CFPB or other federal regulations currently in place that address this particular issue and the significant risk in the mortgage process that would protect consumers from being forced to give up full account numbers without being able to at least redact the account number to reflect at least the last 4 digits.

If there are such regulations in place, I ask that you please disclose this or at least give me the option to redact my account number to just the last 4 digits as well as fully redact account numbers that are not offered as assets to be verified as part of this loan application listed on combined bank statements.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation