Consumer complaint received 2025-11-28 00:00:00
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Fraud or scam — 
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CA

Complaint narrative:
I am filing this complaint because Bank of America denied my Regulation E claim for unauthorized XXXX transfers of {$1900.00} after my phone number was fraudulently ported out and my online banking was taken over by a fraudster. 

Two XXXX transfers were made to brand new recipients ( who are unknown to me ) on XX/XX/year> for {$1000.00} and {$990.00}. Immediately afterwards, two more XXXX transfers were attempted and Bank of America 's own fraud detection system blocked the transfers. 

I reported the unauthorized transfers to Bank of America within 24 hours. After the port-out fraud, my phone was offline during the time of the fraud, did not receive the authentication codes, did not authorize any XXXX transfers , and did not benefit from any of the transactions. 

Bank of America denied my claim using the reasoning that a device with the correct phone number completed two-factor authentication. This conclusion is inconsistent with Regulation E and CFPB guidance, which state that transfers resulting from account takeover or compromised authentication ( including port-out and XXXX swap type fraud ) are considered unauthorized electronic fund transfers, even if the banks system sent a 2FA code to the correct phone number. 

A phone number is not an access device under Regulation E, and possession of a phone number following a XXXX  swap or port-out does not demonstrate consumer authorization. Bank of America refused to acknowledge this and repeatedly stated that the burden of proof is on me, which is contrary to 12 CFR 1005.11, where the XXXX XXXX  the burden of proving that a transfer was authorized.

Bank of America also stated that they would not provide authentication logs or any supporting documentation unless I obtained a subpoena, which prevents a good-faith investigation and denies me the information needed to dispute their findings. This is not consistent with the banks obligations under Reg E to conduct a reasonable investigation and provide documentation upon request.

Bank of Americas investigation did not examine or address : the port-out/SIM-swap account takeover, the fact that I did not receive or control the 2FA codes, the IP address or device fingerprint of the login, whether a new device or recipient was added, or any indicators of fraud consistent with account compromise.

Instead, the claim was denied solely because a 2FA code was routed to my phone number which was no longer under my control due to the port-out/XXXX swap. Their reasoning does not meet the standard of a proper investigation under Regulation E.

I am requesting that the CFPB require Bank of America to : Conduct a Regulation E-compliant reinvestigation, Stop placing the burden of proof on the consumer, Provide provisional credit if the investigation can not be completed within the required timeframes, and Reimburse me for the unauthorized transfers. 

Thank you for your assistance.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation