Consumer complaint received 2025-10-28 00:00:00
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Fraud or scam — 
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CA

Complaint narrative:
I am the owner of a small neighborhood bakery in XXXX XXXX XXXX. On XXXX, XX/XX/XXXX, at approximately XXXXXXXX XXXX an unknown individual stole my payment terminal directly from the counter inside my business. The terminal was linked to my Bank of America Merchant Services account ( XXXX  by XXXX XXXX XXXX XXXX 

Immediately after noticing the theft, I began calling Bank of Americas business support line to report it. I made four separate calls between XXXXXXXX XXXX. and XXXXXXXX XXXX the same day. In each attempt : The automated system redirected me to recorded messages only. 

When choosing the Business option, I was informed that support was only available Monday through Friday during business hours. 

No live representative was available, and no emergency reporting option was provided for after-hours incidents. 


I have records of each of these calls, including timestamps, which demonstrate my attempt to take immediate action. 


XXXX XXXX Unauthorized Activity and Timeline XXXX, XX/XX/XXXXXXXX XXXX XXXX XXXX XXXX I logged into my Bank of America app and discovered a negative transfer of {$10000.00} from my business account. 

I called Bank of America again, this time through the credit card department ( the only department open XXXX ). 

A representative answered but stated that they could not access business accounts. 

I was told to wait until the business department reopened on XXXX. 


XXXX, XX/XX/XXXX XXXXXXXX XXXX  : I received a call from the bank acknowledging unusual account activity. They stated that they would block the machine. However, the representative informed me that the situation was my responsibility, despite my prior calls. 

XXXX, XX/XX/XXXX XXXXXXXX XXXX  : Another unauthorized withdrawal appeared for {$7000.00}. 


In total, over {$17000.00} USD was withdrawn from my account in less than XXXX hours through refunds made on a stolen terminal. 


XXXX XXXX  Key Facts and Irregularities XXXX. Failure to provide after-hours fraud reporting for business customers. 

No emergency or fraud reporting system was available on weekends for merchant accounts, even though the risk of theft or fraud is XXXX 



XXXX. No transaction verification or fraud filters triggered, despite : A sudden pattern of refunds totaling over {$17000.00}. 

My average daily sales are under {$200.00}, and the average individual transaction is under {$20.00}. 

This change in transaction behavior is statistically irregular and should have automatically triggered a fraud or risk hold. 



XXXX. Failure to match refund destinations. 

The fraudulent refunds were not linked to the original sales cards, meaning the system allowed refunds to unrelated accounts or new cards, which violates standard PCI and acquirer-level risk controls. 



XXXX. Failure to verify device status before processing high-value refunds. 

Once I reported ( through multiple calls ) that the terminal was stolen, the system should have required a device check-in or password re-authentication before allowing further transactions. 



XXXX. Delayed fraud mitigation. 

Even after the banks own team called me at XXXXXXXX XXXX XXXX to acknowledge unusual activity, The first fraudulent refund had already occurred XXXX hours earlier. 

Another refund of {$7000.00} occurred XXXX hours after that call, meaning the terminal was never actually blocked when they said it was. 




XXXX. Failure to provide timely human response. 

A financial institution of Bank of Americas size should have a 24/7 fraud line for business clients.

My repeated attempts to report the theft on the same day were ignored due to limited service hours.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation