Consumer complaint received 2025-01-06 00:00:00
Product: Credit card — General-purpose credit card or charge card
Issue: Other features, terms, or problems — Other problem
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CA

Complaint narrative:
In XX/XX/year>, attempts were made to liquidate the credit access lines on two of my credit cards to the tune of {$75000.00}. I alerted Bank of America to the signs of fraud and it did nothing choosing, instead, to let the funds be withdrawn. All of my attempts to resolve this issue with the bank went no where. Here is the text of the letter I sent to B of A about the fraud. I never received a response. 

This is written to complain about Bank of Americas ( BOA ) completely inadequate security platform. My BOA cards have been hacked several times over the years ; I was always told this is normal and it happens to everyone. However, the magnitude of the latest failure of BOAs fraud department has resulted in a complete lack of confidence that my funds are protected by BOA and has compelled me to write this letter. I do not want anything from BOA but I want you to know what happened. I will be moving my accounts as the below incident is simply unacceptable. 

On XX/XX/year>, I received a call from BOA ( XXXX ) regarding a potential fraudulent transaction on my business credit card. I was told that someone charged over {$500.00} at a XXXX in XXXX and was trying to withdraw {$5000.00} cash. After advising the fraud department that these charges were unauthorized, and cancelling the card, everything was taken care of and nothing hit my account. Of course the process of doing this was long and tedious but at least I was taken care of. 

On XX/XX/year>, I received a confirmation that a {$25000.00} transfer from my personal credit card which now ends in XXXX ( then XXXX ), payable to XXXX XXXX XXXX was processing. I immediately called BOA fraud and to make a long story short was told that I could not be authenticated over the phone and that I would have to visit a branch to get authenticated. 

Before my call with the fraud department, I talked to regular customer service who told me that, not only was XXXX compromised, but that withdrawals of cash were attempted from my other two credit cards -- {$35000.00} from the card ending in XXXX ( which I have not used for at least 18 months to two years ) and {$15000.00} from the card ending in XXXX. When I spoke to the fraud department, they told me that they had no record of these attempted transactions. ( I found this to be strange because, if customer service could see these transactions, why could the fraud department not see them? Surely customer service did not make this up. ) I immediately traveled to my local branch which is located at XXXX XXXX XXXX  XXXX, XXXX XXXX XXXX, CA XXXX, ( XXXX ) XXXX. I worked directly with manager XXXX XXXX who was extremely helpful. ( I had dealt with XXXX XXXX on a previous issue and he was extremely helpful on that occasion as well. ) XXXX XXXX called the fraud department and, after several transfers, he finally reached someone who could help us. I reported the fraud to the fraud team representative and the other attempted frauds. She said she would report the fraud and cancel all three of my credit cards as they had all ostensibly been compromised. She agreed to send the three new cards to the branch by express mail. ( I live in an area where delivery to my home address is extremely difficult and most couriers will not deliver to a XXXX XXXX which is how I receive my mail. ) This development meant that I would be without any credit cards for at least two to three days. 

Today, I checked my account only to find that the {$25000.00} had been paid out and that a {$1000.00} transaction fee was also charged to my account. I called the number on the website to report fraud but it was taking too long to speak to someone. Therefore I contacted Merrill Lynch XXXX XXXX  through which I received the credit cards. 

The gentleman I spoke to there ( XXXX ) was very helpful and instituted a claim to have the {$26000.00} charge to my account reversed. As the number to the account that was hacked had been changed, I found it strange that the other accounts still bore their original numbers when I looked on line. The day before, BOA fraud told me that all three cards would be cancelled. XXXX verified that the two cards were still active. He therefore cancelled the cards. I asked XXXX to verify that the three cards were going to be sent by expedited mail to the branch. XXXX informed me that only one new card was in transit to me and that it was via regular mail as opposed to express mail to the branch. Regular mail takes five to seven business days which means I will have no credit cards for at least a week. I am scheduled to leave town on Tuesday which means I will have no personal credit cards on my trip. 

There are quite a few things that do not add up. For example, I was told that the {$25000.00} transaction was effected with a credit card at an ATM. But I am not aware that you can set up an interbank transfer at an ATM, much less one in the amount of {$25000.00}. 
I have every alert turned on in my account yet the only notice I received of this fraudulent transfer was when it was being processed. 
I was told by the fraud department yesterday that they tried to call me on XX/XX/XXXX, XX/XX/XXXX, XX/XX/XXXX and XX/XX/XXXX but I received no calls from BOA on either of the numbers on my account and no voice mail messages. Later the person in the fraud department suggested they had been calling my land line which, of course, has no texting ability. However, there were no voice messages on this line either. I simply do not believe the fraud department tried to reach me. My belief is bolstered by the fact that, the fraud department that dealt with my business card, had no trouble reaching me by phone. 
If BOA had looked at my account when this transfer came in, it would have realized that, at most, I have taken cash advances from this card fewer than 10 times and usually when I was in another country. Those withdrawals would have been in the neighborhood of $ XXXX. How did the BOA system not flag this completely unprecedented transaction? I have been stopped from using my card at gas stations for far less money. 

The question of the day is how many red flags does it take for BOA to act? BOA had knowledge that my business account was hacked on XX/XX/year>, which should have created concerns about my personal accounts. How did someone get approval for a cash transfer of {$25000.00} at an ATM? Moreover, how is it that I received no telephone call about this transfer before it happened? Every time I talk to BOA now I have to receive a message on my telephone to ensure I am the caller. This is the case with the most miniscule request. How can it be that BOA did not require authentication for this transaction?

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation