Consumer complaint received 2026-01-02 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Privacy issues
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: AZ

Complaint narrative:
I am filing this new complaint because Bank of America has failed to rectify the issues stated in Complaint ID XXXX and continues to violate my rights as a consumer. 

Despite my explicit instructions to stop all data sharing via the Visa Account Updater ( VAU ) program, Bank of America has again allowed an unauthorized merchant charge to bypass a card replacement. This is a direct result of the banks refusal to process an opt-out request that Visas own documentation states is the consumer 's right. 

Because of VAU my credit card continues to experience fraud charges. I have notified them to block these merchants multiple times and even request to be removed from VAU. And they have done nothing. 

Legal Violations : Regulation Z ( Truth in Lending Act ) : Bank of America is facilitating unauthorized charges by proactively sending my private, updated account information to merchants I have already attempted to block. By failing to stop this data transmission after being told to do so, the bank is responsible for the resulting unauthorized transactions. 

Regulation E ( Electronic Fund Transfer Act ) : The bank is allowing recurring electronic access to my account credentials without my valid, ongoing consent. 

UDAAP ( Unfair, Deceptive, or Abusive Acts or Practices ) : Bank of America representatives have repeatedly and falsely claimed that an opt-out for VAU is " impossible. '' Providing false information regarding a consumer 's ability to control their financial data is a deceptive practice.

Breach of Fiduciary Duty regarding Data Security : By forcing my participation in a data-sharing web ( VAU ) against my express written and verbal instructions, the bank is intentionally creating a security vulnerability. They are providing " keys to my house '' to merchants I have already moved to evict from my account. 

Deceptive Omissions : Bank of America fails to clearly and conspicuously disclose the VAU opt-out process in their initial Cardholder Agreement. This lack of transparency is a deceptive practice intended to keep consumers trapped in recurring payment cycles for the bank 's own profit via interchange fees. 

Violation of the Gramm-Leach-Bliley Act ( GLBA ) / Privacy Rule : Bank of America is sharing my non-public personal information ( NPI ) specifically my updated credit card numbers and expiration dateswith third-party merchants without my consent. Because I have explicitly revoked my " opt-in '' to the VAU program, their continued sharing of this data constitutes a breach of federal privacy standards and a failure to protect my financial data from unauthorized disclosure. 

Required Resolution : I demand that Bank of America immediately : Hard-block my account from the Visa Account Updater ( VAU ) Reverse the unauthorized charges allowed through this service. 

Provide a written statement explaining why my previous requests to opt out were ignored or met with false information from staff. 

I have attempted to resolve this through standard customer service channels multiple times to no avail. I am now seeking CFPB intervention to force compliance with federal consumer protection standards.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief