Consumer complaint received 2023-03-22
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: FL
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Other transaction problem

Complaint:
Office of the Consumer Financial Protection Bureau (CFPB) 1700 G Street NW.,
Washington, DC
DC 20552
This is to complain against the Bank of America
URGENCY: HIGH IMPORTANCE: HIGH
[WITHOUT PREJUDICE]
XXXX XXXX XXXX XXXXXXXX XXXX XXXX.
 I would like to draw your attention to XXXX XXXX XXXX - I had sent my complaint letter to Bank of America, in which I clearly stated how this scam has affected me personally, psychologically and financially.
I am afraid I have had to go through so much "bureaucracy" thus far in order to catch their attention to my concerns. This really doesn't show their complaints department in a good light, to say the least; and certainly, does not contribute tomyoverall satisfaction and peace of mind. My complaint is against the bank that did not do its job properly (could not prevent/foreseen fraud and could not conduct a proper investigation) and not against the vulnerable customer who fell victim and lost all the savings due to the misconduct of the bank.
I feel very distressed and cheated, all because no one took action immediately and
practice their duty of care, therefore I only request what I believe to be rightfully mine, as all institutions were more than negligent in protecting my account and handling the complaints. I comprehensively provided explanations and proof to my claim, even so, Bank of America never acknowledge my complaint, therefore, I have approached you CFPB and I would like to receive your assistance on this matter.
General Obligation:
Commencing on or around XXXX XXXX XXXX I fell victim to two multi-layered scam operations run by hackers which involved me making deposits for a total amount of XXXX XXXX from my Bank of America account to fraudulent investment firms.
When determining whats reasonable and fair, we should focus on the issue of liability; common queries include, but are not limited to, the following (i) whether Bank of America did not take notice of any rule, law, or regulation, and/or possibly missed any material elements of the relevant bylaws or codes of conduct, that may have prevented them from protecting my financial safety; (ii) whether by virtue of Bank of Americas custodianship over my funds or by its control over them, they owed a fiduciary duty to the me and if so, whether that duty was breached; (iii) whether Bank of America promoted the transaction(s) in question despite being aware of the
 
nature of the transaction(s) in question (iv) whether Bank of America was in compliance with its own policies and procedures; (v) whether Bank of America owed duties to myself, what the scope of those duties was, and whether Bank of America did not uphold those duties; (vi) whether Bank of Americas conduct was unfair; and (vii) whether Bank of America has within its power the ability to, and should, compensate me for the harm that has befallen me.
Upon identification of such unusual or suspicious activity, it is crucial that the relevant staff member adequately describe the factors making an activity or transaction suspicious, thoroughly depict the extent and nature of this activity and properly communicate to the customer that such activity meets the relevant criteria of fraud.
In providing its services to a customer, a financial institution is required by law to exercise the care and skill of a diligent, prudent banker. In this case, this means that the payment service provider should not turn a blind eye to known facts pointing to a real possibility that their customer is being scammed. In other words, Bank of America must have had special knowledge of what was occurring or been alerted to a real possibility of fraud taking place. The financial institution must have known or reasonably ought to have known that I was dealing with a scammer.
Granted, there is room for diversity of view insofar as reasonableness is concerned. Indeed, there is a sense in which the standard of care of the reasonable person involves in its application a subjective element.
However, it must be remembered that the correct test is always reasonable care in all circumstances, not average care. The fact that most people behave in a certain way may be good evidence that the conduct is reasonable, but this is not necessarily the case. Although reasonableness is a very fluid concept, all of the evidence suggests that Bank of America did not foresee the fraud and disregarded even the most obvious dangers in this respect.
Situations do tend to repeat themselves and it is advisable to examine previous outcomes to see how the standard of the reasonable person should be applied, and that lessons can be learnt from the errors of the past.
Apropos of the fluidity of the concept of reasonableness, all Bank of America has done in this regard is set up a dichotomy of having or not having the legal obligation under consideration, however, that does not go one-inch toward explaining why various regulatory authorities, has maintained that financial institutions can, and should, protect consumers using their systems, advanced technologies, and rich experience.
Bank of America is obliged to take some action if it is sufficiently aware of a real possibility that a fraud may be being perpetuated. If you don't question its customers instructions or raise the possibility of a scam with the customer in these circumstances, it may be liable if the red flags indicate the customer is:
 particularly vulnerable, or

 if the possibility of fraud was serious or real, not just suspected.
There are some recommendations to organisations for protecting customers from financial harm that might occur as a result of fraud or financial abuse; and gives guidance on how to recognise customers who might be at risk, how to assess the potential risks to the individual and how to take the necessary actions to prevent or minimise financial harm.
These recommendations are established as a general principle, the organisation should deliver a service that:
1) Takes a proactive approach to minimising risks, impact and incidences of financial harm and it sets out systems and tools for the prevention and detection of fraud and financial abuse. As a general point, it says organisations should ensure that all systems are developed using technologies and methodologies that are effective in the prevention of fraud and financial abuse, through authorised and unauthorised payments, thereby minimising the risk of financial harm to customers. As regards to the detection of fraud and financial abuse, it says the organisation:
A) should have measures in place across all payment channels and products to detect suspicious transactions or activities that might indicate fraud or financial abuse. It then lists the following examples of suspicious activity on customer accounts:
a. multiple cheque books;
b. sudden increased spending;
c. transfers to other accounts;
d. multiple password attempts;
e. logins from new devices, multiple geographical locations;
f. sudden changes to the operation of the account; Unusual transactions are transactions whose amount, characteristics and frequency bear no relation to the economic activity of the customer, exceed normal market parameters or have no apparent legal justification.
g. a withdrawal or payment for a large amount;
h. a payment or series of payments to a new payee;
i. financial activity that matches a known method of fraud or financial abuse.
B) organisations should have a process in place to ensure that staff make contact with the customer to verify the financial activity, challenge its authenticity, explain the nature of the suspected or detected fraud and discuss an appropriate plan of action.
I am deeply convinced that the disastrous results that I have previously elaborated upon will continue to ensue if no responsibility is adopted by Bank of America in relation to this matter. I have also thoroughly detailed why they cannot simply dismiss this problem by strictly adhering to legal technicalities which, after careful reflection, struck me as being nothing more than self-
  
interest. Indeed, it seems to me utterly unfair to disregard fragile, sensitive, and vulnerable consumers who are afflicted by such allegedly malevolent acts, thereby keeping an unjust status-quo that is corrupting our society at its core.
Conclusion:
Based on my analysis, and as confirmed by various authorities concerned with such matters, there is abundant evidence that forward-thinking financial institutions ought to take reasonable steps to forestall fraud, or at least mitigate its risk by using an effective risk management system, demonstrating their undisputed ability to responsibly and pre-emptively respond to questionable transactions in the digital arena. The use of such systems, largely based on newly
 
adopted technologies aimed at effectively navigating the evolving threat landscape, is only one of a number of possible endeavours undertaken in this connection, alongside the application of past knowledge and experience related to popular fraudulent practices.
Bank of Americas non-observance of the fundamental principles of justice  that is, to completely overlook and not even remotely try to mitigate the suffering of vulnerable consumers is inexcusable given the size of the establishment and the vast resources at its disposal as the direct result of the patronage of clients like myself.
In summary, I respectively ask your organisation to consider my points, given your personal and companywide obligation to provide a fair and reasonable investigation into the complaint.
I look forward to your input and would gladly cooperate to reach a fair and reasonable outcome. Thank you.
XXXX XXXX
THE REMAINDER OF THIS PAGE IS INTENTIONALLY LEFT BLANK
 
Page 1 of 7
XXXX XXXX XXXX Bank of America XXXX XXXX XXXX XXXX XXXX NC XXXXXXXX XXXX XXXX  Re: Demand Letter
Attn: Claims/Fraud Dept.
Dear Sir/Madam,
For negotiation purposes only, without effect as to any and all rights
  The goal of this letter is twofold: first, it aims to establish that a duty of care was breached, inasmuch as you have failed to perform adequate due diligence or/and not acted in a reasonable and prudent manner to prevent foreseeable substantial damages I suffered as a result of a fraud [ 1]. Second, it shall serve as formal written demand for reimbursement based on the aforementioned grounds, among others.
A very comprehensive analysis of fraud prevention suggests that by processing atypical, non-routine transactions, and/or by being aware of other fraudulent schemes similar to the one alleged herein and/or ignorance of obvious warning signs of fraud, you engaged in/ is a pattern or a practice of a wrongful and negligent conduct which provided substantial assistance to advance the commission of a fraud that resulted in my financial and psychological damages. The facts and details concerning the actions in question are set forth hereunder.
OVERVIEW
 Commencing on or about XXXX XXXX XXXX, I fell victim to a multilayered scam operation orchestrated Hackers (the Scammer), all of which aim at contributing to the goal of robbing and defrauding innocent people.
 Money was transferred from my account via debit card, and through an intermediary named XXXX  in the
total amount of XXXX XXXX utilizing your services.
 This letter shall thrust into the spotlight, inter alia, the increasingly important role financial institutions play in
the fight against financial crime and fraud, and the pressing need for higher levels of supervision and vigilance
within your organization.
 Additionally, it is vital that you will immediately take all actions within your power to remedy the situation,
whether by raising chargeback in respect of the transactions in question or reimburse me and credit my account, for the full amount of these payments, in the total amount of XXXX XXXX
1 FCA: A more effective approach to combatting financial crime XXXX XXXX XXXX 1
   
Page 2 of 7 XXXX XXXX XXXX   Heres an indisputable fact: had you looked at the wider circumstances surrounding the above-referenced transactions, this illicit transfer of wealth could have been prevented.
 Executing transactions without proper authority is not only a severe regulatory offense but also an irresponsible and reckless disregard of the customers financial safety.
 Against this background, and without derogating any of my rights, I hereby hold you liable for financial and emotional harm as well as medical problems relating to this victimization and demand that you reimburse my account in full within 10 days from the date of this letter.
INTRODUCTION
Financial crimes and fraud investigations often involve a high degree of sophistication, complexity, and sensitiveness to detail. Accordingly, this letter aims to address the issue at hand as profoundly and fairly as possible, by taking into consideration contextual regulations, laws, and bylaws, as well as guidance, standards and rules promoted by supervisory authorities, relevant codes of practice and (where suitable) what was good industry practice (GIP) at all times relevant hereto. The allegations contained herein are predicated either upon knowledge with respect to myself and my own experience, or upon facts obtained through investigations conducted by qualified third parties. I strongly believe that substantive evidence in support of the allegations set forth herein will be found after an appropriate opportunity for discovery. Key facts supporting the allegations contained herein are known only to the Scammer or/and are exclusively within their control.
I did not know, and through the exercise of reasonable diligence could not have discovered, the fraud that was being perpetrated upon myself by the Scammer. Fraud is commonly conceptualized as withholding from the weaker party in a financial transaction information which is necessary to make an informed, rational or autonomous decision.
In this regard, even access to adequate information is insufficient to achieve complete autonomy. A complication here is that the weaker party might have trouble analyzing the data at hand sufficiently well to identify fraudulent schemes. A reasonable solution is that financial institutions would be required to promote transparent communication in which they track the understanding of its customers.
The false representations and omissions made by the Scammer have a tendency or capacity to deceive victims, such as myself, into unwittingly providing funds that fueled the Scammers fraudulent scheme and therefore are, by their very nature immoral, unethical, oppressive, unscrupulous, and substantially injurious to consumersall at once.
As a result of the Scammers deceptive practices, I was deceived into transferring my funds to them. The false statements of material facts and omissions as described above; and the sham transactions the Scammer perpetrated upon myself; were unfair, unconscionable, and deceptive practices perpetrated on me which would have likely tricked a reasonable person under the circumstances.
  2

Page 3 of XXXX XXXX XXXX XXXX
SCAMMERS FRAUD SCHEME  ALLEGATIONS
 Please take notice that my funds were transferred through means of coercion and under false pretenses all along! Attached, please find supportive statements, screenshots, and further evidence.
EXPOSING YOUR ORGANIZATIONS MISCONDUCT
I hereby allege that your organization had breached the duty of care that is owed by a financial institution to its clients in circumstances where there are reasonable grounds to suspect that the sole purpose of a payment instruction is to defraud the client. Under such circumstances, you are obliged to refrain from executing the payment instruction until you have been able to satisfy yourself that there is a legitimate basis for the instruction. Once the duty is engaged, the duty takes priority over the usual obligation on a financial institution to execute customer instructions promptly. The duty in question is often referred to as the Quincecare duty, because it was established in the case of Barclays Bank plc v Quincecare Ltd. (the Quincecare duty)
The Quincecare duty is well-established and requires financial institutions to take reasonable care and skill when executing clients instructions. It is recognized as authoritative by leading academic texts [2]. The duty arises in cases where it can be argued that an ordinary prudent staff member of a financial institution would have a reasonable basis for suspicion that a particular payment instruction would result in the misappropriation of the clients funds.
When the duty does arise, it can be discharged simply by refraining from executing the instruction unless and until such time as the financial institution has been able to establish that the instruction relates to a lawful obligation. The financial institution shall seek further information or/and documentation from the client in order to help establish this.
Based on the above, and after conducting a comprehensive review of our communication/interactions, it became glaringly obvious to me that no adequate information or/and documentation were sought by your organization, at best, and at worst no appropriate safeguards were implemented at all.
If a bank executed a customers order to transfer money knowing it to be dishonestly given, shutting its eyes to the obvious fact of the dishonesty or acting recklessly in failing to make such inquiries as an honest and reasonable man would make, it would be in breach of its duty of care, even if the payment was made in accordance with the terms of the mandate and the bank shall be liable to its client for damages in negligence.
Compliance departments should ensure that staff understand the legal requirements and that where there are suspicions, these suspicions must be communicated to all relevant personnel whilst they are investigated.
2 (XXXX XXXX XXXX XXXXXXXX XXXX XXXX XXXX. Ellinger's Modern Banking Law XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX.)
    3

Page 4 of 7 XXXX XXXX XXXX
For the avoidance of doubt, reasonable grounds shall not necessarily be interpreted as proof. On the basis of various signs, you should have assumed that something fishy was going on and suspended transactions until you had made reasonable enquiries to satisfy yourself that the transactions was/were properly to be executed. In other words, I have been a victim of your negligence for facilitating the misappropriation of funds, and doing little to safeguard my financial interests. Any reasonable banker would have realized that there were many obvious, even glaring, signs that I was a fraud victim (Singularis Holdings Limited (in liquidation) v Daiwa Capital Markets Europe Limited [XXXX] UKSC 50) [ 3].
A financial institution which wrongly pays money away when it has no authority to do so will usually be treated as if it had paid using its own funds, not those of its customer. The debits made to my account should be reversed out, and damages to compensate me for any reasonably foreseeable losses incurred as a result of your failure to state the balance of my account accurately and properly. It is also libelous/defamatory to make false statements about someone that adversely affect their credit rating.
When discussing the responsibilities that a bank might incur, it is crucial not to forget the fact that a legitimate complaint by, or cause of action on the part of, a client might generate/give rise to further statutory cause of action or/and additional responsibilities or liabilities owed by a financial institution to the relevant regulatory authority. Obligations/duties owed by a bank to a regulator are distinct from those owed to the customer. On top of that, please remember you may owe liabilities to more than one regulator.
More often than not, such legal duties spring from the very facts that gave rise to the liabilities to your clients in the first place. Similarly to the foregoing, I may also have a cause of action against you for breach of mandate as you have negligently transferred my funds without proper authorization or enquiry.
Instead, you should have been working hard with Artificial Intelligence [4] / Big data technologies to discover automated and effective ways not only to detect fraud but also to prevent it. Furthermore, the tremendous amount of data you possess is by no means self-evident let alone to be overlooked, hence by not utilizing it systematically and effectively to pinpoint irregular and suspicious activities you are misleading your customers, who have taken the leap of faith and placed trust and confidence in your honesty, authority, and competence.
A plausible assumption here would be that the pattern of the above-mentioned transactions was sufficiently suspicious that it should have been flagged and blocked by your staff, even if you have never encountered similar situations.
According to the FCA [5]: XXXXXXXX  could do more to identify fraudulent incoming payments and prevent accounts from being compromised by fraudsters. XXXX fraud is where a fraudster tricks a payer into making an XXXX  to an account controlled by that fraudster under false pretenses, similarly to the above-described victimization.
3 Singularis Holdings Limited (in liquidation) v Daiwa Capital Markets Europe Limited [XXXX] UKSC 50
4 Using AI in the fight against fraud XXXX XXXX XXXX
5 FCA introduces new rules on handling complaints about Authorised Push Payment fraud (XXXX XXXX XXXX)
    4

Page 5 of 7 XXXX XXXX XXXX
Moreover, I argue that you should also make a reasonable estimate on the basis of relevant historical data of my account.
"Given XXXX fraud is currently a XXXX million problem and growing, the potential exposure for banks is very large indeed. This is yet another reason why the banking industry must do all it can to use the data available to it to detect and stop fraud."
Practically speaking, effective steps to prevent bad actors from taking advantage of future victims (or at least to minimize this possibility) are abundant:
 The use of automated and human review of irregular or suspicious transactions and traffic patterns to identify financial crimes in general and common fraudulent schemes in specific;
 Human review of complaints from the public and law enforcement in connection with rapidly-growing, recurring, and popular fraudulent practices as well as suspicious merchants, including creating special channels for such complaints;
 Cross-checking warnings, notices, cautionary announcements, and reports concerning beneficiaries, merchants, associations, or countries often suspected to be associated with cyber-fraud from governments, central banks, regulatory bodies, law enforcement agencies, and watchdogs.
 Artificial Intelligence & XXXX embrace and leverage Machine Learning technologies and Big Data Analytics to identify fraudulent, or potentially fraudulent merchants by scrutinizing publications and reports about such merchants in the digital sphere (e.g. on forums, social media, et cetera.)
 Establishing contact with the recipient institution of fraud victims: any holds in place on new related activities, or similar blockers that prevent rapid rebranding of related/similar merchants.
It would also be wise to consider implementing additional safeguards where the movement of large sums of monies are concerned. For instance, you could specify additional prerequisites for executing the transfer of large sums such as: (1) requiring multiple levels of approval; (2) requesting more information concerning the intended purpose of the transfers and cross-checking for similar patterns of transfer; and (3) checking on my capacity to make such transfers. While such measures entail additional compliance costs, it would be sensible for you to err on the side of caution.
5

Page 6 of 7 XXXX XXXX XXXX  CONCLUSION
 If a full refund is not administered within 10 days from the date of this letter, in addition to a refund amount, a request for reimbursement of attorneys fees, filing fees, and any further costs associated with obtaining the refund amount may be pursued.
In the event of non-compliance with the demand mentioned above, your organization, knowingly or unknowingly, manifestly jeopardize its business through its association with the Criminals: those who are not direct accomplices to the commission of a crime but rather are permissive of the criminal behavior after the crime has been committed can also be charged with a crime. Being permissive, even if not present when the crime was committed, by not reporting the crime to the authorities and not trying to do your part in remedying the situation, makes you an accessory to the crime. If you unknowingly assist criminal behavior and remain impartial after discovering such, you are seen as obstructing justice.
This letter does not realize the full extent of my claims, rights, and remedies against you or any of your affiliates, parents and subsidiary corporations, including, without limitation, your representative managing partners, officers, directors, shareholders, employees, agents, attorneys, assigns, successors, servants, insurers, and representatives, in any matter whatsoever, including the present context of this letter, as that will not detract from my rights and claims in any form or manner whatsoever, or constitute any concessions on my behalf against you and against others.
For more information, please reread.
XXXX XXXX  6

Page 7 of 7
XXXX XXXX XXXX
DEMAND FOR DISCLOSURE
The individuals who directed and enjoyed the fruits of these illegal and unlawful activities shall be exposed in full. This means that any and all contextual documents and/or information at your disposal shall be disclosed in a timely and equitable manner, in a reply to this letter.
Hence, I hereby demand that you disclose the following within 10 days from the date of this letter:
Reports, instructions, transmittal letters, statements, notices, and other documents, related to the relevant participants and beneficiaries, whether involved directly or indirectly, in accordance with the applicable regulations and guidelines. It also includes the correct and true names of the parties to the lawsuit, their ID NO., addresses, and telephone numbers, as well as information and documents of any potential party or of persons having knowledge of relevant facts, and a brief statement of each identified persons connection with the case, including information and documents concerning their beneficiary bank accounts, if available.
 7

To: Bank of America
XXXX XXXX XXXX XXXX XXXX NC XXXXXXXX XXXX XXXX  Subject: XXXX XXXX XXXX  complain to Bank of America
FAO: Bank of Americas complaints dept.
Dear Sir / Madam,
XXXX XXXX XXXX XXXX XXXX XXXX
 This is my subsequent letter pursuant to the original, unanswered disputed letter sent to Bank of America on the XXXX XXXX XXXX
With this letter, I hereby express my utmost dissatisfaction with your lack of reply to the above referenced letter and reiterate key points that were raised and left unanswered previously supporting my request for your cooperation.
As I mentioned I fell victim to a multilayered scam operation orchestrated by hackers (the Company) and innocently lost XXXX XXXX  of my hard-earned life-savings due to your misadministration.
This complex issue has caused substantial harm to me, and if not appropriately addressed, will cause substantial harm to others, we must therefore conduct an in-depth and comprehensive review of all of the contributing factors that have led to an outcome as horrendous as the one described herein.
Due to personal circumstances, I was particularly vulnerable during the victimization period; I was also relatively financially illiterate and very inexperienced in the finance sector which made me a prime target for criminal enterprises in this field.
Financial institutions are well aware of the scope and nature of such crimes and the risks that these pose to their clients, who, in contrast, mostly have limited knowledge of these dangers.
To be clear, people who have been scammed such as myself, are not individuals who have made poor investment decisions. They are people who have been tricked, lied to, deceived and emotionally manipulated. Sophisticated, aggressive sales techniques end up trapping the uninformed and unsuspecting victim who once in the clutches of the scammer cannot get out until most or all of the funds have been lost (stolen) by the scammers. A good comparison is a XXXX who XXXX  his victim whilst at the same time XXXX XXXX  and prevents them from escaping.
Based on my analysis, and as confirmed by various authorities concerned with such matters, there is abundant evidence that forward-thinking financial institutions ought to take reasonable steps to forestall fraud, or at least mitigate its risk by using an effective risk management

system, demonstrating their undisputed ability to responsibly and preemptively respond to questionable transactions in the digital arena. The use of such systems, largely based on newly adopted technologies aimed at effectively navigating the evolving threat landscape, is only one of a number of possible endeavors undertaken in this connection, alongside the application of past knowledge and experience related to popular fraudulent practices.
What can Bank of America do?
Please be noted that I will not in any way quietly tolerate the consequences of your actions (or more precisely, the lack thereof). It is perfectly obvious that you could have, and should have, utilized various risk-based examination procedures and techniques, all of which are within your purview and could have entirely prevented this disastrous outcome.
As previously advised, you should have known, suspected, or had reason to suspect that the transactions (or pattern of transactions):
 involve funds the ultimate purpose of which was to fuel an illegal enterprise;
 is intended to disguise funds the ultimate purpose of which was to fuel an illegal
enterprise, in an attempt to avoid and thus violate regulations;
 is intentionally designed to defraud your customer;
 serves no legitimate or lawful purpose; and
 involve the use of your services to facilitate criminal activity.
There are so many other ways in which measures related to fraud prevention and mitigation could have been useful. Further factors that should have been taken into consideration include, but are not limited to, the following:
 The timing, volume, frequency, and nature of the transactions in question;
 The abnormality of such transactions against the background of your experience with me
as a customer and other entities associated with the transactions (if any);
 The suspicious nature of such transactions based on my overall risk profile including
vulnerability and identification and research of high-risk services/products;
 Systemic filtering mechanisms, whether manual or automatic, for the identification of
unusual activities; and
 Periodic evaluation of the usefulness, appropriateness and effectiveness of anti-fraud
programs, and other associated policies and procedures.
Relevant industry practices at the time of the victimisation:
Your Organization is obliged to take some action if it is sufficiently aware of a real possibility that a fraud may be being perpetuated. If you don't question its customers instructions or raise the possibility of a scam with the customer in these circumstances, it may be liable if the red flags indicate the customer is:
 particularly vulnerable, or
 if the possibility of fraud was serious or real, not just suspected.
There are some recommendations to organisations for protecting

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation