Fraudulent Charges Appearing On Bank Of America EDD Debit Cards Of 350,000 Unemployed Californians
SAN FRANCISCO (KPIX 5) -- Something very scary is happening to thousands of unemployed Californians who receive their government benefits through a Bank of America debit card - their accounts are getting drained by fraudsters.
Bank of America has an exclusive contract with the State of California to handle Employment Development Department (EDD) benefits through special debit cards. About a month ago, we started hearing from people who have lost thousands of dollars they desperately need.
"My heart dropped. I was scared, you know?" said Tatiana Solorzano, still traumatized by a hack attack that happened a month ago. "I thought they were going to do it again!"
Solorzano, a single mother, receives her unemployment benefits through a Bank of America debit card and says a few weeks ago, there was a strange transaction on her account from another bank showing just zeros.
"It happened the second day, then again the third day. Once it was the third day they were finally able to hit my account for $1,003," said Solorzano. "Rent was due October 2nd, you know, I was like, 'Oh my God, that money got pulled out right when my rent is due!'"
Others we spoke to had the same thing happen. "I went to the bank to withdraw money from my EDD account and it said I had reached my daily limit," said Brandon Birkhofer. He told us the fraudsters pulled money out of his account five days in a row - he's out $5,000.
Gail Goertzen lost $4,000. "From the ATM at Bank of America, $1,000 was drawn four days in a row," said Goertzen.
Then there's Heather. She found out her debit card was compromised through a text message from Bank of America "... asking me if I had used my card in Las Vegas. Obviously I didn't, so I replied no," said she said.
Right after she got locked out of her account, which had about $4,000 in it.
"Your whole account is frozen, frozen period. You can't get your own money," said Heather.
Bank of America turned down our request for an interview but told us it is working closely with EDD in an aggressive effort to fight fraud. EDD didn't want to talk to us either but confirmed it knows of 350,000 people whose EDD debit card accounts have been frozen due to suspected fraud.
"The most likely scenario is that there was a data breach," said Steve Morang, a certified fraud examiner with San Francisco-based accounting firm Frank, Rimerman and Company.
"The fraudsters were able to capture the data of those cards, of those people, their accounts, the card numbers, and any other information they needed, in order to produce a duplicate card," said Morang.
He suspects a large criminal enterprise is behind the fraud attack, that appears to have involved ATMs all over Southern California and Nevada. "This is a massive operation, because these are physical cards that have to be printed, and then somebody has to go to those ATMs everywhere," said Morang.
He says the fraudsters can buy your secret pin number on the dark web. And he says the EDD cards make stealing your information especially easy, because unlike regular debit cards, they don't have a chip.
"By having the chip, you have your information that's on the card encrypted in the chip and it makes it more difficult to duplicate the cards," said Morang. "Whereas the magnetic strip, that's 30-, 40-year-old technology."
"Bank of America gets paid from the state to take care of this, so the fact that we don't have a chip it just signals to me that we are not as important as their other clients," said Goertzen.
The victims we spoke to say filing a fraud claim with Bank of America made them feel like second-class citizens, because unlike regular bank customers they had to go through a separate department.
"I was on the phone for seven-and-a-half hours, disconnected every time. You get to the point where you are just exhausted," said Heather.
"I am worried about my future. Someone's got my information, multiple people probably, they have to fix it!" said Birkhofer.
Even worse, just days after finally filing their fraud claims came letters from Bank of America that appeared to deny them, saying, "Your claim has been closed because we believe your account has been the subject of fraud or suspicious activity."
"That's not fair, because they really didn't look into my case," said Solorzano. "It was the little bit of money that I did have left, that I was saving, it's all that I have."
Since KPIX 5 submitted the names of 11 fraud victims to Bank of America the bank has applied credits to five of them, including everyone interviewed in this report. A spokesperson told us other claims will be assessed on a case-by-case basis.
Interestingly, when we asked Bank of America why the EDD debit cards don't have chips a spokesperson suggested we ask EDD. We are still waiting for a response from the state and will keep you posted.
BANK OF AMERICA STATEMENT
Bank of America says there has been no data breach on their end and says it is working closely with EDD in an aggressive effort to fight fraud. Bank of America and EDD are asking any cardholder who is uncertain on why a debit to their account occurred to call the number on the back of their card (1.866.692.9374).