Bank of America – EDD Advantages Thieves Now Concentrating on Victims’ Bank Accounts; ‘My Identity Is Being Hijacked’ – CBS San Francisco

By Kenny Choi and Abby Sterling, KPIX 5

SAN FRANCISCO (CBS SF) — Think about discovering in the future that your bank account has been hijacked by an imposter who has stolen all of your cash. It’s the most recent twist in a hacking epidemic involving unemployment debit playing cards that KPIX 5 was first to reveal final fall.

As an alternative of stealing the advantages in cash at ATMs as we have now been reporting for months, some fraudsters are actually hijacking victims’ accounts and transferring the funds to themselves.

“I feel it’s very invasive. I feel violated,” mentioned Michelle Barrionuevo Mazzini.

“My identity is being hijacked!” mentioned Linda Kucma.

RELATED: KPIX EDD Fraud Particular Part

Kucma and Barrionuevo-Mazzini have by no means met one another, however they’ve loads in widespread proper now. Their EDD debit card accounts at Bank of America lately acquired hijacked.

Barrionuevo-Mazzini came upon whereas pumping gasoline.

“I was able to pump maybe probably around $9.50. And then the pump stopped on me,” mentioned Barrionuevo-Mazzini.

She referred to as the quantity on the again of her Bank of America debit card and acquired a impolite shock.

“It said I was locked out,” Barrionuevo-Mazzini mentioned.

Shock changed into shock when she lastly acquired by way of to Bank of America’s fraud division.

“They were able to confirm that the email in the account was not my email,” mentioned Barrionuevo-Mazzini.

And the routing quantity was not “her” routing quantity. It was the fraudsters’.

“They had removed my bank account information. They had put their routing information, their bank account,” she informed KPIX 5.

Somebody had hijacked her account and stolen the whole lot in it, altogether $7500 {dollars}.

Identical factor occurred to Kucma. She came upon when she went on-line to pay a invoice.

“I was at zero and I knew something was wrong immediately,” mentioned Kucma.

She says after hours on the telephone to file a declare, a bank worker confirmed her worst worry: A fraudster was impersonating her and had drained $3,000 {dollars} from her account.

“This person literally got into my profile, changed my email, similar to you, Michelle. Then they had the nerve to go ahead and set up a complete transfer,” mentioned Kucma.

“Basically it’s an account takeover,” mentioned licensed fraud examiner Steve Morang. “If, in fact, they were able to get the EDD recipients’ personal identifiable information, we call it PII, which would include name, birth, date, social, address, then they’re able to go in and basically impersonate you.”

The routing quantity for each Barrionuevo-Mazzini and Kucma is similar: It traces to Sutton Bank in Ohio.

From there, in Kucma’s case, the cash was then transferred right into a “cash app” account.

“What the fraudster wants to do is he just wants to get more and more steps away from you with that money. Once money has been out of an account for more than 48 or 72 hours it’s almost impossible to retrieve that money,” mentioned Morang.

Morang suspects in these instances the private figuring out data got here from EDD, as a result of the victims are all EDD claimants.

“This data breach could have happened six months ago, a year ago, two years ago,” Morang mentioned. “It doesn’t matter because your information will never change. It has a very long shelf life.”

A former job placement employee we spoke to suspects the identical. We agreed to not reveal his identification. He says 15 years in the past he labored for an EDD accomplice company that helped individuals discover jobs.

“We were trained to access the EDD databases, employment databases to verify the information provided by the jobseekers,” the previous employee informed us.

He says everybody on the non-profit had logins that allowed full entry.

“It was obvious then that if they’re giving partner agencies that much free reign of their databases, that this was a problem,” mentioned the previous job placement employee.

KPIX 5 requested him what sort of data he was speaking about. His response: “The top of the heap, social security numbers, home addresses, account numbers.”

A couple of years in the past he got here throughout his previous login, and tried it again then, out of curiosity. He informed us it was nonetheless energetic.

“I’m seeing the same thing I was able to see when I worked for the agency, just full access to personal information of the people who were registered for jobs services with the Employment Development Department,” mentioned the previous job placement employee.

That open entry is precisely what Barrionuevo_Mazzini and Kucma have feared, leaving them in a relentless state of tension.

“You had your bank information there. I did. And our full names and our personal addresses. Kenny, they’re able to see all of that at this time,” mentioned Barrionuevo_Mazzini.

After KPIX 5 gave Barrionuevo_Mazzini’s title to Bank of America she acquired all her a refund.

As for Kucma, Bank of America gave her a provisional credit score, however fraudsters struck yet one more time.

“The person again went into my account, changed my password and took the credit,” mentioned Kucma.

As soon as once more, she acquired a refund. However that also wasn’t the top of it. In a sequence of changes, the bank took all her a refund and extra. Her account is now detrimental greater than $17,000.

“It’s a completely different treatment that EDD clients are getting right now. And it’s not right because those are the people who are really suffering and they should be taken care of,” mentioned Kucma.

Each girls at the moment are switching to paper checks. They are saying they’re not leaving something in Bank of America any extra, as a result of they simply don’t belief it.

EDD in the meantime denies the previous job placement employee’s allegations.

In an electronic mail to KPIX, spokesperson Loree Levee says: “Staff, including an employee with a community based organization that may have been working with EDD and/or our local partners on job search activities, would only be interacting with our online labor exchange CalJOBS system, not our main EDD database. And they would only have access to the last four digits of the SSN in CalJOBS, NOT the full SSN or other Personal Identifying Information.”

KPIX tried to contact Sutton Bank and acquired by way of to a customer support consultant after an extended wait. She put the decision on maintain, then hung up.

In an announcement from Bank of America’s Invoice Halldin, he mentioned: “In our business, we refer to these as “account takeovers” – the place somebody has been capable of achieve entry to an account. We haven’t seen it a lot within the context of the unemployment program.”