Consumer complaint received 2025-06-12 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Deposits and withdrawals
Company: BANK OF AMERICA, NATIONAL ASSOCIATION
State: CA

Complaint narrative:
To Whom It May Concern, I am writing to formally report fraudulent activity on my Bank of America accountsChecking Account ending in XXXX and Savings Account ending in XXXXwhich occurred on XX/XX/XXXX. The fraud involved unauthorized phone-based transfers facilitated through the banks automated phone system. 

Summary of Incident On XX/XX/XXXX, I received a call displaying a spoofed caller ID : ( XXXX ) XXXX, which is a valid Bank of America number. The caller claimed to be from the Bank of America fraud department and stated there had been suspicious activity on my debit cardspecifically, a {$3100.00} airline ticket charge. Coincidentally, I had just dropped off my son at XXXX for a trip to XXXX, which added to the plausibility of the claim. 

I was then prompted to verify my identity, and a one-time passcode ( OTP ) text was sent to my phone. The message came from the same 5-digit short code previously used by Bank of America , reinforcing the appearance of legitimacy. After entering the passcode, I received the familiar Youre all set message. 


During the call, I was " escalated '' to a supposed supervisor and manager and asked to reverify my identity each time the transfer occurred. Once again, a verification text was sent, and upon confirmation, the fraudulent transfer of funds from my Savings account to my Checking account was executed using the phone systemwithout my consent or direct action.

I became suspicious, immediately logged into my online banking account, and discovered the unauthorized transfers. I promptly called BofAs Fraud Department at XXXX. After waiting on hold for 17 minutes, I reported the incident and requested all accounts be frozen to prevent further unauthorized activity. Note : the real Bank of America fraud person used the exact same method to verify my identity and I received the Youre all set message.

________________________________________ Vulnerability Description The fraudulent activity appears to exploit a security flaw in the phone-based authentication process. Specifically, the system allows a malicious actor to : Spoof a legitimate BofA phone number Initiate an automated outbound OTP message to the targets registered mobile number Trigger fund transfers based solely on identity verification, not account login In this case, the attacker relied on credentialed identity verification via text, not on full user login or multi-factor authentication ( MFA ), to gain unauthorized access.

To confirm this vulnerability, I replicated the process using my spouses phone. I was able to initiate an outbound text message requesting account verification and gained access once she responded. This shows the process can be manipulated using caller ID spoofing and OTP-based social engineering.

________________________________________ Regulatory and Security Concerns This incident represents a violation of both GLBA ( Gramm-Leach-Bliley Act ) and FFIEC ( Federal Financial Institutions Examination Council ) guidelines regarding the safeguarding of consumer Personally Identifiable Information ( PII ) and financial data : 1. GLBA Safeguards Rule Financial institutions must implement robust administrative, technical, and physical safeguards to protect customer information ( 16 CFR Part 314 ).

2. FFIEC Authentication Guidance Strong authentication is required for high-risk transactions, such as funds transfers. One-time passcodes alone are not sufficient, especially without device binding or secondary verification ( FFIEC XXXX & XXXX Supplement ). 
3. NIST SP 800-63B Recommends against using OTP as a sole authentication method for sensitive account access, particularly in the presence of caller ID spoofing or phishing attacks.

The current system gives a false sense of security by mimicking official communication channels and using familiar language and numbers. This trust can easily be exploited to bypass consumer safeguards.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation