Consumer complaint received 2015-05-01 00:00:00
Product: Credit card — 
Issue: Identity theft / Fraud / Embezzlement — 
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CO

Complaint narrative:
I received an email from Bank of America on XX/XX/XXXX stating the following regarding my BoA Master Card credit card : '' We continuously monitor ATM, debit and credit card transactions to look for out-of-pattern activity that might be potential fraud, as well as information from outside companies about account compromises at undisclosed merchants or service providers. 
Your card was part of XXXX of these compromises. This does not mean fraud has or will occur on your account. We 're simply taking precautionary steps to help protect your account. " This is the second time this has happened to me with the same BoA credit card, the last time I received a replacement card due to my account being compromised was on XX/XX/XXXX. I received a letter from BoA at that time that also alluded to " undisclosed merchants or service providers ''. 
My concerns are as follows:1. Data security breaches with BoA are becoming more common, perhaps due to insufficiently robust security measures used by them and/or merchants/service providers that work with them. 
2. Other financial services companies that have been hacked ( such as XXXX ) seem to offer more comprehensive solutions, such as free credit monitoring for a period of time, than BoA, who in the email notification referenced above, simply stated their standard policy of the account holder not being liable for fraudulent charges, IF BOA IS NOTIFIED PROMPTLY BY THE ACCOUNT HOLDER OF SUCH FRAUDULENT CHARGES. So now I must closely watch transaction activity on this account?? I find this exceptionally toothless as far as fraudulent activity mitigation goes. Of course, the term " promptly '' is not explicitly defined in this notification described above. Why must the onus be on me when I had nothing whatsoever to do with the reported data breach? 
Thirdly, BoA has not, as they also did not in XX/XX/XXXX, identified the merchants or service providers responsible for the data security breach. This lack of disclosure is nothing more than a blatant cover-up used to protect any such merchants/service providers. BoA 's solution to protect me is to re-issue a new card without offering any type of free credit monitoring service and also not disclosing to me the merchants responsible for the breach. 
I did call BoA customer service after the XX/XX/XXXX data breach/card re-issuance in an attempt to find out just which of the merchants/service providers that I had recently dealt with were responsible for allowing my sensitive personal information to be compromised. I was told that only Master Card knew that, which I found to be a highly suspect response. 
I DEMAND TO KNOW THE IDENTITIES OF THE BREACHED MERCHANTS/SERVICE PROVIDERS I HAVE DONE BUSINESS WITH WHO ARE RESPONSIBLE FOR THIS DATA SECURITY BREACH!! For all I know, it may be the same vendor ( s ) who were hacked, and my account affected, in XX/XX/XXXX. Once these entities have been named, I will make the final decision as to whether or not I wish to continue my business relationship ( s ) with them. Given BoA 's protection of and refusal to identify the responsible parties, I am unable to make any such decision, potentially leaving me open to further problems should I unknowingly continue to do business with the same merchant ( s ). 
I have unfortunately been the victim of numerous instances of identity theft in the past 10 years, very likely due to similar reported or unreported breaches. I find that BoA 's failure to provide free credit monitoring options, as other major companies do, and also their failure to identify by name merchants/service providers who were breached, totally unconscionable. It would seem that BoA 's priority is to protect the breached merchants XXXX and then, in a less than optimal manner, the breached account holders. 
Research indicates that what I have described above is a widespread practice of BoA 's. 
I demand greater accountability in breach reporting.

Company public response: Company chooses not to provide a public response
Company response to consumer: Closed with explanation