$17,000 Stolen From Bank of America Account in ‘Stunning’ Phone Hack – Why Two-Factor Authentication ‘Hijacked Everything’

A Bank of America customer says she’s stunned after losing control of her phone and watching $17,000 disappear from her bank account in a matter of minutes.

And to make matters worse – the bank’s two-factor authentication system (2FA) was a key element of the criminal’s success.

Sharon Hussey says an impostor recently walked into Verizon and convinced the company to give away control of her phone number and SIM card, reports the ABC-affiliated news station WJLA.

The thief promptly used her number to intercept 2FA verification codes from Bank of America and break into her account.

Hussey quickly realized her phone number had been hacked and decided to contact the bank – but she no longer had a working phone.

So she tried reaching out to the bank online – but the system sent over a 2FA code that she couldn’t receive.

Although Hussey still managed to contact the bank soon after the hack, her money was already gone.

“It was absolutely stunning. My heart dropped to the floor…

I have two-factor identification which ended up biting me in the face when it all came down to it. That was the thing that completely hijacked everything. They had complete control of my phone and there was nothing I could do about it.”

Although the transfers out of Hussey’s account were unauthorized, Bank of America denied her claim for three months before reimbursing the account.

In an email, the bank says identity theft is complex, but doesn’t address why it repeatedly denied Hussey’s claim.

“We take identity theft very seriously. We are always working to improve the experience knowing that resolving identity theft issues is a complicated process.”

Verizon says it’s unable to comment on the case because of a need to protect people’s privacy.

“Verizon values the privacy and security of our customers. Whenever a case of potential fraud is brought to our attention, we work quickly to investigate and resolve the matter. Due to customer privacy laws, we cannot share specific information about this particular investigation.”

Generated Image: Midjourney