Consumer complaint received 2025-05-01 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem using a debit or ATM card
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CA

Complaint narrative:
In late XXXX of XXXX  I decided to go though my bank statements and noticed suspicious transactions from foreign countries that I did not make or authorize anyone else to make. I contacted BofA fraud department and later changed my password after realizing the possibility of my login credentials being stolen. Two claims were approved and permanently credited to my account. Around XX/XX/year> I further researched my previous bank statements and noticed more similar transactions and made four claims for those as well. Bank of America improperly denied those four fraud claims on XX/XX/year> on my checking account ending in XXXX. Despite substantial evidence, they have refused to reimburse me for a series of clearly unauthorized transactions tied to entities operated by the same international cybercrime ring. 
Bank of America previously approved the first two fraud claims I filed in late XX/XX/year> and early XX/XX/year> related to XXXX and " XXXX, '' the latter being a confirmed fake retail site that was suspended by its domain registrar, after I provided proof to the registrar it was used to launder stolen funds. Then on XX/XX/year> later discovered transactions associated with other XXXX entities such as " XXXX '', " XXXX * XXXX  '', " XXXX * XXXX '', and " XXXX * XXXX  '' and other fake shell companies beginning with XXXX all matching the same transaction patterns and international fraud profile. This resulted in four new fraud claims. These unauthorized charges occurred while I was in the U.S. and had no interaction with these vendors. Upon discovering the first fraudulent transactions in late XX/XX/year>, I immediately reported the activity. Bank of America approved the first two claims but denied the new claims, citing login activity and staggered withdrawals as indicators of legitimacy. They also stated I receive my statements online every month and should have recognized the transactions but I never check my statements because I trust BofA enough for this type of fraud to never happen. BofA failed to consider the following : My login credentials were compromised likely through phishing, credential stuffing, or a breach beyond my control and used by international cybercriminals. 
Logins do not equate to authorization, these were automated sessions designed to mimic normal user behavior. 
Modern cybercrime tactics include XXXX XXXX, spyware, and XXXX XXXX  exploits. 
I reported the fraud within 60 days of me discovering this fraud consistent with Regulation E guidelines. 
Bank of America 's decision ignores the reality of coordinated, modern financial fraud and misinterprets login patterns as evidence of consent. 
I am requesting the CFPB to investigate Bank of America 's handling of my claim and ensure they comply with federal consumer protection laws

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief