Consumer complaint received 2025-05-30 00:00:00
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Unauthorized transactions or other transaction problem — 
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: TX

Complaint narrative:
On XX/XX/2025, criminals used a coordinated fraud scheme to take control of my phone and execute unauthorized XXXX transfers totaling {$1800.00} from my Bank of America account. Despite immediate reporting, police documentation, and witness testimony, I believe Bank of America has wrongfully denied my claim based on flawed reasoning that ignores federal consumer protection law. I am seeking restoration of these stolen funds under Regulation E. I can provide the claim ID if needed. 

At approximately XXXX XXXX on XX/XX/2025, I was visiting XXXX XXXX ( " TXXXX XXXX  '' ) at XXXX XXXX XXXX XXXX in XXXX with my family, taking vacation photos. A few minutes earlier, I had opened my Bank of America mobile app to check a XXXX transaction from my father that same day for verification that it sent. Before this incident, I was unaware of the fact that active sessions remained open for a certain duration of time ; because the session was still active, the app could be reopened without Face ID or password authentication. While photographing with my phone, a man approached me with a friendly attitude and asked if he could look something up on XXXX on my phone. I figured it to be harmless, but as soon as I briefly handed it to him, two accomplices immediately inserted themselves between me and him, physically acting as a barrier to prevent me from reaching for my phone and acting as distractions while the first individual retained control of my device.

I should really emphasize that while I attempted to retrieve my phone, the two physically blocked me and resisted my efforts to get it back. My family members witnessed this entire confrontation, seeing my obvious distress and the coordinated nature of their interference. I had to physically push through the two who inserted themselves and pull my phone forcefully back from the man 's hands as he resisted to recover it.

Immediately upon regaining my phone, I checked my recently opened apps, and saw that the Bank of America app had been opened. I figured nothing could have happened since I believed he couldnt have accessed anything besides XXXX, but felt my XXXX drop when I discovered that XXXX transfers totaling {$1800.00} had just been sent to " XXXX XXXX '' a person I have never heard of and never authorized any payment to. As soon as I saw this, I clearly remember yelling out to my family He took {$1800.00}! '' as all three criminals fled the scene. My younger brother attempted to grab one of them by the hoodie of his jacket, but my parents prioritized our safety over pursuit, saying to let them go as they were concerned they might be armed and it wasnt worth it to either send people or be sent to the hospital and exacerbate this already bad situation. I realize now that this was clearly a coordinated street fraud operation designed to exploit open banking apps on unlocked phones. 

I took immediate action to report and document this crime. Within minutes, my family and I ran directly to the nearest Bank of America branch across the street and explained the situation to a manager, who said that I could file a police report for the bank to reimburse me for this criminal activity. I then walked approximately 30 minutes to the nearest police station and filed a comprehensive report that same afternoon, obtaining a police report number that I can provide. The officer documented the recipient 's name, transaction amounts, descriptions of the three men, and full circumstances of the theft. 

The next morning on XX/XX/ 2025 well within the required 48-hour reporting window I called Bank of America 's fraud department and provided complete details of the incident, including that I had filed a police report, but they never asked for any details of the report or the reports ID. They then put a 180 day freeze on my account and had me reset the password in the case that the men obtained any sensitive info, but due to the freeze I can also no longer perform any transactions with it. I fully expected the bank to recognize this as a clear case of unauthorized electronic fund transfer under federal law. 

However, on XX/XX/2025, ( today ) I received a denial letter stating that the transaction was " verified with a code sent to my phone number and came from a device with prior valid account activity. '' This reasoning completely ignores the criminal circumstances and misapplies federal consumer protection law. I had used the Bank of America mobile app and XXXX responsibly in the past without issue ; this fraudulent use occurred only because my device was physically compromised by deceptive and forceful actions. 

The fact that criminals had physical control of my open phone does not make their actions authorized. They had complete access to both the banking app and text messages containing verification codes because my unlocked phone was in their hands only minutes after an active session was made open on my banking app. Bank of Americas system sent the XXXX verification codes by XXXX but they, not I, read and used it. After the incident, I tested the behavior of the Bank of America mobile app on my own phone and found that an active session remains open for at least 6 minutes that being my minimum tested value without requiring Face ID or password reauthentication for the account to be accessed. This means that once the app is opened, a person could regain access without credentials for that minimum window of time. At the time, I had no reason to believe that someone could reaccess my financial account without credentials, which made it possible for the criminals to exploit the open session once they had my unlocked phone. 

Under 12 CFR 1005.2 ( m ) of Regulation E, an " unauthorized electronic fund transfer '' is defined as one " initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit. '' My case fits perfectly within this definition and its official interpretations, which explicitly state that unauthorized transfers include those " initiated by a person who obtained the access device from the consumer through fraud or robbery. '' The regulation also covers situations where " the consumer is induced by force to initiate the transfer. '' Here, criminals obtained access through fraudulent pretenses and physical force ( coercive interference from the two who inserted themselves between me and the one controlling my phone ), while I received no benefit whatsoever from the transfers.

The three regulatory exceptions that would disqualify a Regulation E claim do not apply to my situation : I did not furnish these individuals with access to my account, I did not act in concert with them, and the transfers were not initiated by a bank employee. Bank of America 's technical analysis, which focuses on authentication codes and device recognition, fundamentally misunderstands the law. If their reasoning were correct, it would eliminate Regulation E protections for any theft involving the consumer 's own device, directly contradicting the regulation 's explicit coverage of fraud and robbery scenarios.

Again, the regulatory exceptions disqualifying claims under Regulation Esuch as consumer furnishing access, acting in concert, or transfers initiated by bank employeesdo not apply here in my situation. Bank of Americas reasoning would effectively eliminate consumer protections for victims of theft involving their own devices, contrary to the intent and explicit language of the regulation. To the best of my knowledge, I have also never sent a XXXX payment over {$1000.00}, let alone {$1500.00}, in the past, making this {$1800.00} transaction clearly especially inconsistent with my normal usage pattern which further supports that the transfer was not initiated or authorized by me. 

Upon doing more research later, I found that this incident follows known patterns of coordinated financial fraud : a pretext approach to gain device access, coordinated distraction tactics, physical interference with device recovery, immediate exploitation of banking applications, and rapid dispersal after completing the theft. Multiple family members of mine can also corroborate the coordinated nature of this crime and my immediate distress upon discovering the unauthorized transfers.

I respectfully request that Bank of America reverse their erroneous denial and immediately restore the {$1800.00} in stolen funds. The bank 's initial analysis failed to consider the criminal circumstances or properly apply Regulation E requirements. This represents a textbook case of unauthorized electronic fund transfer, supported by police documentation, witness testimony, and immediate reporting. Federal consumer protection law exists precisely to protect victims in situations like mine, where criminals gain fraudulent access to financial accounts through deception and force. I am formally disputing these transfers and requesting full reimbursement in accordance with the Electronic Fund Transfer Act ( EFTA ) and Regulation E.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief