Consumer complaint received 2022-03-27
Product: Credit card or prepaid card — Government benefit card
Issue: Problem with a purchase or transfer — Charged for a purchase or transfer you did not make with the card
Company: BANK OF AMERICA, NATIONAL ASSOCIATION (CA)

Pls refer back the previous complaint ID XXXX. 
-- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- -- - BoA didnt address the initial impersonation occurred in XX/XX/XXXX at all from the previous CFPB report with the complaint ID XXXX. 

According to XXXX XXXX XXXXXXXX BoA Regularity Affair senior personnel ( our phone conversations with her were all recorded ), someone called/phoned in to the BoA card service and impersonated me in XX/XX/XXXX and changed the email associated to the account to his/hers from this phone call. After the change went successful, the person logged in to my account and changed the password and transferred all the money out in XXXX transactions. 

XXXX XXXX, XXXX XXXX XXXX XXXX XXXX XXXX BoA has also agreed ( our phone conversations with him were all recorded ) that XXXX XXXX XXXX does NOT involve two-way verification, meaning people only need to answer security questions and he/she is fully authenticated. Fraudster ( s ) with the hacked information was able to answer a few security questions that allow him/her passed the security screening, and a BoA agent helped him/her to change the email. 

The visa stamps sent earlier shows I was in XXXX taking care of my ill mother with XXXX XXXX from XX/XX/XXXX to XX/XX/XXXX. She was in critical condition in XX/XX/XXXX hence I was at her bed side XXXX. I did not have any access & time to make any international calls. My sim card had been taken out from my phone since I do not have an international calling plan. Our XXXX home nurses, along with XXXX family members, had signed a letter as witnesses showing I did not make any call in XX/XX/XXXX. 

NOTE : This BoA XXXX account was opened in XX/XX/XXXX, the email address has NEVER been changed throughout its lifetime and it has ALWAYS been XXXX. According to XXXXXXXX XXXX  XXXX and XXXX XXXX ( our phone conversations with them were all recorded ), the fraudster called in XX/XX/XXXX and changed it to XXXX. Mine goes with my last name XXXX, but the email used by the fraudster only has a y before the number XXXX. A few other fraud emails were also used throughout the fraudulent activities, the last one being used is XXXX. This information was given by a rep of BoA customer service call center in XX/XX/XXXX when I first found out my account is compromised. 

*** Request BoA to investigate the initial impersonation via the phone to its call center in XX/XX/XXXX *** With the note above, I need BoA to provide the followings regarding what exactly happened in XX/XX/XXXX. This is the very beginning that caused all following XXXX fraud transfers to happen. BoA can NOT just examine the following XXXX fraud transfers done via the web, because the fraudster ( s ) wouldve made sure they could access my account smoothly. They have had the login email and password changed to theirs. The 2nd verification token would have been sent to their email without problems.

1 ) The voice of the person who called. The voice can be used to identify it is not me who called to change the email.

2 ) The phone number of the call came from 3 ) Where did the two-way verification token send to?

4 ) How did he/she get verified/authenticated? From my understanding, my XXXX had already hacked. 

The bottom line is the fraudster knew all the information about me but he/she is NOT me. That is what impersonation mean. BoA needs to address the impersonation issue and reimburse the lost funds. 

I am having a few interviews with some news agencies such as XXXX, XXXX, and a few private news freelancers. Pls do take a look at my evidences. I did not call in XX/XX/XXXX to the card service to change the email, hence do not authorize all of the XXXX fraud transactions. 

Please see the witness statement attached that shows I didnt make the call in XX/XX/XXXX.