Consumer complaint received 09-11-2017 about Checking or savings account (Checking account) with BANK OF AMERICA, NATIONAL ASSOCIATION (MD).
Issue: Managing an account
Sub-issue: Problem using a debit or ATM card

Complaint: Date XXXX/XXXX/XXXX CFPB complaint re. unauthorized transactions on Checking Acct # XXXX and linked savings account. 

My husband and I ( XXXX XXXX XXXX and XXXX XXXX, respectively ) have a joint checking, savings and credit card account with Bank of America and are concerned that the bank does not have proper procedures in place to prevent fraudulent transactions and/or ID Theft and help mitigate further fraud after consumers report fraudulent activity to Bank of America. 

Our checking and savings account were compromised on XXXX XXXX, XXXX. At XXXX we received a low balance email alert on our phones ( attached ). I called the bank to report a fraudulent transfer from our savings to our checking account in the amount of {$280.00} and a XXXX XXXX purchase in the amount of {$3900.00} that were showing as processing. I asked these transactions to be stopped/rejected as fraudulent. The CSR failed to place a balance hold on our account, failed to send us a new card ( until I had to request it the next day ) after opening claim number XXXX for the {$3900.00} charge, failed to have that charge be rejected, failed to issue a provisional credit, and transferred me to a closed online transfers department to file a fraud claim for unauthorized transfer from our savings to our checking. That department remains closed on Sunday XXXX XXXX. On XXXX/XXXX/XXXX at XXXX I called Bank of America again to reach the online department and to report a fraudulent ATM deposit in the amount of {$1900.00} and given claim number XXXX, but that department informed me that the savings to checking transfer was not done online. It was done at an ATM and therfore, the first CSR on XXXX XXXX should have opened an investigation into it. 

I am concerned about the banks handling of my claims. When I reported the fraud on XXXX, the CSR did not lock my account. I had to go online and do so myself. Later that evening further fraudulent transactions were attempted on my checking account but thankfully rejected because I had the foresight to proactively lock my card through online banking after learning of the first fraudulent transaction.
I am upset that the CSR I first reported the fraud to neither closed my account, nor sent a new card on XXXX. Had I not locked the card myself more fraud would have depleted my account. 

On XXXX when the bank opened, I called again and requested that a funds hold be placed on my account to ensure no further fraudulent activity on my checking and savings would take place. I was told the bank will not do that UNTIL a fraudulent ACH transaction takes place on the account. This is preposterous. Why does a consumer need to wait for further fraudulent activity to take place on the account to prevent loss of funds when the bank has notice that fraud is taking place on both the savings and checking account? Why wont the bank help consumers take preventative measures to protect the remaining funds in the account from all types of fraud while recovering from a fraud or ID Theft incident? 

I am also concerned that the third CSR ( XXXX from XXXX call center ) did not take my request for further information about these transactions seriously. She refused to tell me at which ATM the transfer from savings to checking was effectuated. I need the bank to send me more information about 1 ) the fraudulent check that was deposited, 2 ) the subsequent transfer from savings to checking and 3 ) a copy of the signature submitted in the fraudulent XXXX XXXX transaction. I need this information to attach it as support to my ID Theft police report. Please have the bank provide this information immediately. 

I am also concerned that bank representatives unfairly use pressure tactics on consumers reporting Reg E protected fraudulent transactions. According to the CSRs, since according to them a pin was used, therefore, I must have authorized these transactions. I am a consumer protection attorney and XXXXXXXX XXXX XXXX working for a federal agency that protects consumers. Why would I do such a thing as share my pin with anyone? This is beyond insulting. The bank is simply shirking its Reg E, and by extension UDAAP compliance responsibilities, by shifting the risk of harm on to consumers for its own failure to prevent a clear and avoidable incidence of fraud by having catching out-of-norm transactions and having them verified by the account owner via email, phone or text. 

What prevents an ID thief using a fake card and skimmed information ( as I have my debit card in my possession here in Maryland and therefore it can not also be in California at the same time ) from not using pins he or she records at ATMs used by unsuspecting consumers who have no way of knowing that the ATMs are compromised? Under Regulation E, governing unauthorized use of an access device,  consumers are responsible for notifying the bank in a timely manner, as I have done. And it is the banks responsibility to investigate and help prevent the fraud by having an adequate compliance program and fraud detection software which it failed. It failed its responsibilities by neglecting to notify me of an out of norm purchase, refusing to investigate the ACH transfer from savings to checking, and refusing to place a freeze on my account even after my request so that my funds are not further depleted by fraudulent ACH transfers. 

Here even a basic review by a suspicious activity team could have seen that out of geographic area purchases, at a store we have never frequented such as XXXX, and unusual ATM check deposits ( we deposit via our phone app ) would be reasons to raise red flags and prevent these transactions from taking place. Coupled with the fact that the bank also has access to our credit card transaction history and can see there has been no travel to CA and that both my husband and I were making regular purchases over the weekend on our credit card in Maryland should have set off alarm bells to at least have the California transactions verified by us before allowing to process. 

Despite all of these circumstances, the bank refuses to reject the fraudulent charges that are still in process as of today Monday, XXXX/XXXX/XXXX. Instead it is insisting it will first allow them to post before conducting an investigation. Also, it is refusing altogether to conduct an investigation into the unauthorized transfer of {$280.00} from my savings account to my checking account. The CSR ( XXXX from XXXX XXXX stating that Bank of America does not have policies and procedures in place to investigate unauthorized transfers done via an ATM ( see attached evidence ). 

I suggest this woefully inadequate compliance program be examined by the CFPB and OCC for unfair and deceptive practices ( UDAAP ) and Regulation E violations.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief