Consumer complaint received 2022-06-26
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: MA
Product: Money transfer, virtual currency, or money service
Sub-product: Domestic (US) money transfer
Issue: Fraud or scam

Complaint:
To whom it may concern, Bank of America not Investigating Fraud. 

I am writing to bring to your attention and ask for any help that you can provide to expose the pervasive fraudulent activities affecting BOA customers including myself. I am also respectfully asking for help resolving my fraudulent claim ( {$8000.00} ) which BOA has denied with little to no Investigation. From my personal experience BOA is aware of these fraudulent activities and has provided very little help to no help to customers. From my experience with BOA the past few months, I have come to the following conclusions. The availability of my personal information to the fraudster implies an undisclosed data breach of customer information, secondly the circumvention of BOA procedures that allowed the fraud to happen implies a fraud ring has internal access point, or possibly there are elements within BOA that contribute to or commit these fraudulent acts, and the failure and lack of investigation of the fraud including BOA accounts that my stolen money was transferred into which BOA neglected to tell be and refuse to investigate leads me to conclude that BOA is likely aware and are covering up. I appreciate your time and I hope you can help. 
Respectfully XXXX XXXX _____________________________________________________________________ Below you will find a summary of our concerns and details of the fraudulent activities leading to fraud claims filed through Bank of America on XX/XX/XXXX and XX/XX/XXXX and XXXX, XXXX. We formally request the Bank of America take into account the full details and properly investigate the fraud claims. The details provided in section XXXX, and referenced and summarized in Section XXXX were provided when the claim was made, but are being provided hear in our words as opposed to being transcribed by BOA systems. Further due to the nature of the claims, it appears that we would be protected under regulation E and that our claim has been incorrectly denied. As long-standing BOA clients we deserve better treatment. 


Section XXXX : Timeline and Details of Fraudulent Events On XX/XX/XXXX, I noticed a payment refund of {$2900.00} on my Bank of America ( BOA ) credit card on XX/XX/XXXX. This was a refund I had not authorized, and the money was not being refunded back to any of my bank accounts. I called BOA to inquire about the refund. I was informed that BOA received a call from someone who said they were me and requested that {$2900.00} of a {$4000.00} credit card payment that I had made on XX/XX/XXXX be refunded to another account that did not bear my name and was not the account the payment originated from, however BOA still authorized that transaction and sent my money to and unknown recipient. They had me file a claim on XX/XX/XXXX, when I followed up XXXX weeks later on XX/XX/XXXX, I was told the claim was not filed, despite me being on hold for over XXXX hr while the claim was filed. The agent I spoke to filed another claim on my behalf. I then followed up a week later because the money still had not been returned to me. I was told that the investigation could take up to 45 days, but it only took BOA a few minutes to allow for the fraudulent withdrawal of funds from a payment posted XX/XX/XXXX. As we are well aware credit card payments are not refundable, and when particularly when you are carrying a balance. Based on the events, in order for this to happen, the person who requested the refund would have had to know ( or was told ) that I had made a {$4000.00} payment over a month ago and/or had access to my account. Other than BOA, who else could have known and circumvented BoAs policies to allow for this transaction? 
A month had passed since I first made the inquiry, and I was still unable to get information on the status or when I would be credited. On a follow-up call an employee mentioned that this had to be an internal joband then caught themselves, I was thinking the same. 
On XX/XX/XXXX I made multiple attempts to get the issue resolved, after being assessed interested charges, not receiving a credit and not hearing back from BOA. I contacted BOA through XXXX, XXXX and by phone, I receive a notification from BOAs official XXXX and XXXX accounts that someone from BOA will be contacting me to review my issue. Not long after that message, I received a call that I could not pick up that was identified on caller id as Bank of America. I called back and it was answered by an automated prompt that said This call is being recorded... Welcome Bank of America and then after a few seconds a gentleman, XXXX answered and identified himself as a BOA representative. Naturally, I was skeptical, but the person knew my contact information, details about my BOA accounts, including how many accounts and the last XXXX of my checking account ( none of which I had disclosed of in my message to BOAs verified social accounts ), in addition to the details about the fraud claim. I had only provided some details of the fraud claim in the private message on XXXX, but not any of my banking information and I have retained the messages. Since I called and we went through the verification process, he knew the last XXXX digits of my account number, the date of the transfer on the fraud claim, the date of the initial payment, I thought I was speaking to a BOA in XXXXXXXX XXXX, who had knowledge of the different kinds of accounts I have at BOA and the fraud claim I made, I provided the authorization codes he sent to my cell phone ( XXXX XXXX ). 
When the person on the phoned asked me to verify my social security number, I disconnected immediately and my wife called BOA through the App. I was put on hold, whiles on hold I tried to log into my BOA account, but my credentials had been changed and my cell phone number had been replaced by another and I could not login. Since my wifes accounts and mine were linked she was able to log in and she found XXXX XXXX payments on that day totaling {$3500.00} ( XXXX for {$1500.00} and XXXX for {$2000.00} ) and an online transfer of {$4500.00} to another account at BOA in processing ( which she tried to stop but BoA response times were too slow to stop it ). While on the phone with BOA, another {$5000.00} transfer was initiated and was in process of being attempted. She immediately transferred all our remaining balances into her separate savings account and took steps to secure our account while we tried to reach BOA fraud. My wife and I both called BOA and as usual we were on hold for over an hour, when we finally spoke to someone in the fraud department, we were told that although the payments were still being processed, and we, the owners of the account had called indicating that the transfers were fraudulent, an investigation needs to be completed first to determine fraud and that they could not stop or reverse the transaction until the fraud claim was investigated. In the hour we were routed around to different agents and on hold, BOA could have interceded and paused the transactions to recover our funds. However, it is clear that BOA does not have the proper systems in place to deal with the fraudulent banking activity in an efficient manner, despite the known rise in fraud involving BOA accounts. Upon review, we were able to see that the {$4500.00} transaction was an internal transfer to an unknown BOA account bearing the name XXXX XXXX ending in XXXX. This is the same account owner the XXXX transactions were made to. We also found there was another account added ending in XXXX. These were clearly added by the rep acting as a rep of BOA. 
We concluded the call with the claim being filed, but learned on Saturday, XX/XX/XXXX when we followed up after providing id verification at our local bank, the claim was not actually filed and we had to file again. This is twice a BOA fraud rep had failed to carry out their duties and properly file a claim. 
On XX/XX/XXXX, I called to check the status of my claims filed XX/XX/XXXX, XX/XX/XXXX and XX/XX/XXXX and I was notified that my first claim, the unauthorized refund transfer from my credit card had been resolved and the money returned. No explanation of what happened and how that could have happened was given. I was also informed that my XXXX other claims totaling {$8000.00} were rejected because the authorization code was given for those transactions and no fraud has been detected, despite me informing BOA of the account rep that contacted me to investigate my claim and that it was not me who had logged in and made those transactions. I was also informed BOA would not be investigating the accounts my money was fraudulently transferred to. Despite the account being a BOA account, I was informed BOA would not attempt to recover my funds. 
Section 2 : Concerns Bank of America concluded there was no fraud although we reported on the same day it was discovered that the person I thought was a representative of BoA was attempting to defraud us. We were able to confirm this when the BoA rep provided us with the full phone number the primary contact number had been changed to, and it was the same number the Bank of America rep called from. The phone number did NOT belong to me or my wife. 
As was stated when the claim was filed, although the verification code was provided, it was under the pretense of investigating my credit card fraud claim for the transfer of money to another account I do not own ( again which BOA is solely responsible for ), it was not intended to be for the authorization for the transfer of funds and was done under false pretenses. Additionally, there were multiple accounts added that are unknown to me but are Bank of America accounts and BOA could investigate, but as we were told by the BOA rep on XX/XX/XXXX, BOA did not investigate the receiving accounts, and would not because that account owner did not report fraud. 
Further, what remains unclear, is how did this person gain access to my account information and cell phone number. Never did I provide this or was asked to provide my cell phone number, ss #, account #, debit card # or pin #. Further it appears from the sequence of events that either a fraud ring has internal access point or there was an undisclosed breach of account information through Bank of America. We also can not help but to wonder what additional information was provided when someone fraudulently called in and redirected our credit card payment, how did they get access to our account information? We certainly hold BOA culpable for that data security breech, which we have to assume also made it possible for this person to access my banking information and phone number. 
To be clear, a BOA account is added to my account fraudulently, from a login in a state where I do not live and was not in, evident from reviewing a text sent from BOA at the time of the transfers, asking did you just login from Texas, I did not see the text because I was using my wireless headset and my phone was not physically near me ; but I would think that because I did not respond, BOA would not have allowed access to my account or for the transfers to occur. Further, provided the nature of the claim, the fact that BOA can choose not to investigate, and conclude no fraud seems unfair, shows a lack of due diligence, and makes me think BOA is complicit or XXXX. Further, during the investigation, I never received a follow-up call from BOA with any questions ( although we were told someone would call us ), I did not hear back from BOA within XXXX business days, and had we not called today, we would not have known. Frankly, I am not even sure Bank of America investigated the incident, unless they are trying to cover up a failure of the data security systems and that fraudulent bank accounts have been opened at BOA. 
When we initially called BOA to report the incident, it was clear from the reps view point that my online account had been taken over, login credentials changed, my phone number had been replaced by another phone number, and BOA had informed me that my account had been compromised and advised me to freeze and cancel my checking accounts and open new ones, which we did. How is it that no fraud was detected? What is still mind boggling is that in the case of the Online transfer, the money from my account was transferred into another existing BOA account, these funds should be recoverable. But, BOA has refused to investigate that account and has determined there is no fraud although I have informed them that I have not authorized a transfer of funds to that bank of America account ( same person that received the fraudulent XXXX transfers ) and the verification codes was provided under false pretenses. I was informed that an investigation of an account can only be initiated with owner permission, it is not clear if BOA asked XXXX XXXX, despite the obvious connection to the person defrauding me. 
While I could just complain about how unfair this is, my subsequent action was to determine what protections do I have under the law and what resources do I have available to me to XXXX ) share BOAs lack of security protocol and lack of customer support and XXXX ) how to file a federal complaint. 
My research and network led to me to information on Regulation E and several news articles involving BOA and fraudulent XXXX and online transfers. With respect to this claim BOA is not compliant with regulation E from a process stand point and due to the nature of the fraud claim, I would be entitled to have all of my funds returned. 
In summary this entire episode began because BOA allowed someone with visibility to my accounts to initiate a refund to be transferred from my credit card to another account not bearing my name, without my authorization and took over 30 days to resolve. Although the claim was resolved on XX/XX/XXXX, no explanation has been given as to why it happened, how it was allowed to happen or if my personal information was compromised. 
I received a call from someone pretending to be a BOA representative, with intimate details of my personal information, BOA accounts, claims I had put in and the knowledge that I had spoken to a BOA representative earlier on before they called. 
BOA refused to stop a transaction that was being processed although they were notified immediately when the transactions were made ( within hours ), that they were fraudulent transactions and then failed to adequately investigate. 
BOA rejected the fraud claim and refuses to investigate the fact that the fraudulent transfer went to a BOA account which also bears the name of the recipient of the fraudulent XXXX transfers out of my account, despite me following BOA steps to report the fraud. Further, if BOA acted more swiftly, they may have been able to intercede the transaction. 
Although BOA knows that the stolen money was transferred into a BOA account, they refuse to investigate that account because the owner has not requested and investigation. Why would the recipient of a fraudulent transfer request an investigation? 

Based on the timeline of events and the information that that person had posing as a BOA rep, I have no other reason but to conclude that there has been a data breach at Bof A that allowed someone full access to my bank account information to access my online profile and initiate transactions that BOA has not revealed/notified customers about. There was information the agent had that I did not provide and the only way to know would be if they had access to BOA systems and my account. 
It is clear to me that BofA has a system in place that allows fraudulent accounts to be created and fraudulent activity to run rampant in their business. Their refusal to investigate makes me think they are complicit, or they know its internal and are trying to cover it up/As long-standing customers of BOA we deserve better.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief