Consumer complaint received 2025-07-02 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement — Credit card company isn't resolving a dispute about a purchase on your statement
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: NY

Complaint narrative:
The following is the letter I am sending to confirm a formal appeal of their denial : This letter is to confirm that I am formally appealing the denial of a removal of a fraudulent charge from my account. The charge of {$400.00} was made on XX/XX/year> ( posted on XX/XX/year> ) on my Bank of America credit card on my account ending in... XXXX ( the card at the time of incident ending in XXXX ). This is all referenced in the Claim # XXXX. 
The following will be a full account of the circumstances leading up to, and including the timeframe, of the fraudulent charge, with supporting documentation attached. This is comprehensive, as this statement is being filed with the Consumer Financial Protection Bureau, the Federal Trade Commission, the New York State attorney generals office, and the Office of the Comptroller of the Currency. 
On XX/XX/XXXX, malware containing the XXXX software was installed on my computer as I attempted to download my SSA statement. At this point in time, there was much confusion and concern about the Social Security agency and I was trying to get a copy of my statement to have in hand. 
From my XXXX XXXX XXXX ( which I only reviewed after the fact, not on a routine basis ) it shows when the malware was installed and my computer became compromised. 
Again, I was not aware of this at the time, receiving no notification from my computer firewall and anti-malware systems. 
The Event Viewer logs ( see attachment ) show the infiltration times connected with this software, with numerous occurrences of system penetration. These logs show the entire compromise from that initial date through when the XXXX forum team helped me track down and eradicate the intrusion, which occurred on XX/XX/XXXX. 
On XX/XX/XXXX, the infiltrator took control of my computer and made an unauthorized transaction through XXXX, on the Bank of America credit card that was on file. The transaction leading to the fraudulent charge was the purchase of XXXX {$100.00} XXXX gift cards, which were to be sent to an unassociated email address. This email address, XXXX, is not mine, having never used it or had it associated with anything relating to me or my computer system. 
This letter is to confirm that I am formally appealing the denial of a removal of a fraudulent charge from my account. The charge of {$400.00} was made on XX/XX/year> ( posted on XX/XX/year> ) on my Bank of America credit card on my account ending in... XXXX ( the card at the time of incident ending in XXXX ). This is all referenced in the Claim # XXXX. 
The following will be a full account of the circumstances leading up to, and including the timeframe, of the fraudulent charge, with supporting documentation attached. This is comprehensive, as this statement is being filed with the Consumer Financial Protection Bureau, the Federal Trade Commission, the New York State attorney generals office, and the Office of the Comptroller of the Currency. 
On XX/XX/XXXX, malware containing the XXXX software was installed on my computer as I attempted to download my SSA statement. At this point in time, there was much confusion and concern about the Social Security agency and I was trying to get a copy of my statement to have in hand. 
From my XXXX XXXX XXXX ( which I only reviewed after the fact, not on a routine basis ) it shows when the malware was installed and my computer became compromised. 
Again, I was not aware of this at the time, receiving no notification from my computer firewall and anti-malware systems. 
The Event Viewer logs ( see attachment ) show the infiltration times connected with this software, with numerous occurrences of system penetration. These logs show the entire compromise from that initial date through when the XXXX forum team helped me track down and eradicate the intrusion, which occurred on XX/XX/XXXX. 
On XX/XX/XXXX, the infiltrator took control of my computer and made an unauthorized transaction through XXXX, on the Bank of America credit card that was on file. The transaction leading to the fraudulent charge was the purchase of XXXX {$100.00} XXXX gift cards, which were to be sent to an unassociated email address. This email address, XXXX, is not mine, having never used it or had it associated with anything relating to me or my computer system. 
They also discovered the date of the intrusion, which finally lead me to the XXXX XXXX program where the logs are stored. Again, something XXXX dont do, so I hadnt thought to check there. Now I know. 
The purge was successful, and I located the culprit during my search. I was instructed to upload the questionable file to a special site that can safely inspect the package, which is where we confirmed it was the malware that had compromised my system. I did another round of checking for any unauthorized access to my banking and credit cards and it was then that I found the illicit purchase on my Bank of America credit card account. 
I immediately called them to explain what happened, and they initiated an investigation into the incident and credited the amount of the fraudulent charge. At that time they cancelled the existing credit card and issued me a new one. I contacted my other credit card providers ( luckily no fraudulent charges had been made ) to cancel the cards for possible breach and reissue new cards as well.

After about five weeks, Bank of America sent me notice that they had denied my fraud dispute, saying the investigation showed the charge came from my computer! The compelling evidence they sited were similar charges made from my computer that I did not dispute. Of course I didnt
dispute the previous charges. I explained I made those charges, just as I paid for every one of those charges.

Calling about the issue the person in the dispute department noticed the original person I talked to had not filed the claim correctly ( putting it down as a stolen credit card, and not a compromised computer ) and sent it back for re-evaluation, while allowing me to send some of the information about the breach and the recovery steps I was forced to go through. 
About a week and half later, Bank of America sent me notice that they had again denied my claim, saying the merchant provided documentation confirming I received the merchandise. As I stated, I did not receive any merchandise, and BOA did not provide this evidence in their denial. 
The XXXX receipt sent to my trash folder indicated the merchandise was to be sent to an email address ( XXXX ) not owned/operated/or known to me. There is no evidence I could find that this merchandise ( egift cards ) was sent to my computer, phone, or physical address, only the logs showing the purchase was made ( and XXXX receipt received and sent to the trash folder ) within the timeframe when my computer had been commandeered. 
So where was the merchandise received? What device or IP address or geolocation was on the receiving end? What did the investigation uncover with regards to the email the egift cards were sent to? Has this email been used before, and for what purposes? Were the egift cards used? What for, and to what addresses ( email, IP, or physical ) was any merchandise sent to?

Again, yes my compromised computer initiated the unauthorized purchase in question ( as we can all see ) but no, I was not the receiver or beneficiary in any way from the unauthorized transaction. 
BOA stated that numerous other charges had been made on the credit card that were consistent with this charge. None of the other charges I made ( and vouch for ) are remotely consistent with this charge! Most were for physical items shipped to my address. I have never purchased gift cards, and certainly not XXXX cards since I am not in the XXXX ecosystem, using PCs and XXXX  phones. 
I have been a loyal customer of BOA for many years and have purchased many thousands of dollars worth of merchandise and have always paid my account in a timely manner. I have an excellent credit score for a reason, and its preposterous to think I would subject myself to countless hours of remediation work, involving changing dozens of passwords and having all new credit cards issued on all my accounts for any sort of unlawful enrichment. Not for a handful of egift cards for products no one in my household or anyone I know uses. 
This was theft, using access to my system as the means. And the event logs on my computer show this. As does the fact there is no proof I received these egift cards or used them for anything, or benefitted in any way from the unauthorized transaction. If I planned to send someone gift cards ( which any of my credit card histories will show I never have done! ) I would do it the way I always do. Place the order, and pay for the purchase. 
I did not place this order, or receive this merchandise, and am not responsible for these charges. I request the removal of the charge. I am willing to help in any other aspect of any investigation, proceed to arbitration, and am ready to testify under oath to everything I have stated in this letter. 

In the letter, there are screenshots corroborating everything I have testified to in the letter above. I can't attach them in this form, but they are available. 
XXXX XXXX

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief