Consumer complaint received 2016-06-26 00:00:00
Product: Credit card — 
Issue: Identity theft / Fraud / Embezzlement — 
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: NJ

Complaint narrative:
On Thursday morning XXXX XXXX, I was alerted by email that my XXXX XXXX card had a new user added to my account. I called and told them this was fraud and they took the necessary steps to verify my identity close the account and get a new card sent to me. At that time they also added a password to my account so that any future transactions by phone would need to verify the password to proceed. Later that same morning I received an email from XXXX, another creditor of mine that a new user had been added to my account. I called and reported it as fraud, they closed the account, made arrangements to get a new card to me and also added a password to my account to verify my identity for future transactions by phone. 

In both instances the representatives that I talked to told me that someone called and had enough information about me ( social security number, and other financial information ) and after a few attempts was able to convince the representative that they were me. I immediately got a copy of my credit report and talked to someone at my credit monitoring service about the situation. They added a fraud alert to my credit report and recommended that I call my other credit card issuers to alert them to the situation. 

I called Bank of America, another creditor, to alert them to the possibility of fraud. There had been no evidence of it yet but we added a password to the account in the event an attempt was made. The next day I received a call from a fraud specialist at Bank of America questioning the addition of a new user to my account as she thought it might be fraudulent. I immediately told her to close the account and then I began questioning her on how this could happen since I had called the day before and added a password so this could n't happen over the phone. She told me that the caller could n't verify the password but was added to the account anyway! After I expressed my dissatisfaction with the situation she said that the regular customer service representatives are n't as well trained in fraud and account security. 

I received replacement cards from the XXXX creditors, when I called to activate the cards with XXXX and XXXX through the automated system I was immediately transferred to a fraud specialist for extensive questioning that started with me knowing the password that was placed on the account and then questions from my financial history so they could verify my identity before activating the cards ( exactly what I would expect in this situation ). 

When I called Bank of America I was able to activate the new card through the automated system by typing in the last XXXX digits of the account number. I was concerned about that so I called the customer service number, I got to a representative by inputting my social security number and when she picked up the phone she asked for the account password. I gave her the password and she told me that was n't the correct password and asked if I would like to change it. I did n't know what to say to her, I thought to myself they ca n't possibly have so little regard for account security on an account that has already been breached. I 'm convinced that by the end of the week the person that has all my information will convince someone at Bank of America to send them a new card for my account because their security is nonexistent. 

Who regulates this industry? Are there any rules in place to protect consumers from XXXX? A number of red flags should have been raised in my situation including multiple attempts to answer security questions, a request to add a user with a different last name and sending a card to a different address in a different state. Rules against any of those without a verification call to the primary phone number on the account would probably cut credit card fraud in half.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation