Bank of America – EDD Advantages Thieves Now Concentrating on Victims’ Bank Accounts; ‘My Identity Is Being Hijacked’ – CBS San Francisco

By Kenny Choi and Abby Sterling, KPIX 5

SAN FRANCISCO (CBS SF) — Think about discovering someday that your bank account has been hijacked by an imposter who has stolen all of your cash. It’s the newest twist in a hacking epidemic involving unemployment debit playing cards that KPIX 5 was first to reveal final fall.

As a substitute of stealing the advantages in cash at ATMs as we’ve been reporting for months, some fraudsters are actually hijacking victims’ accounts and transferring the funds to themselves.

“I feel it’s very invasive. I feel violated,” mentioned Michelle Barrionuevo Mazzini.

“My identity is being hijacked!” mentioned Linda Kucma.

RELATED: KPIX EDD Fraud Particular Part

Kucma and Barrionuevo-Mazzini have by no means met one another, however they’ve lots in widespread proper now. Their EDD debit card accounts at Bank of America not too long ago obtained hijacked.

Barrionuevo-Mazzini discovered whereas pumping gasoline.

“I was able to pump maybe probably around $9.50. And then the pump stopped on me,” mentioned Barrionuevo-Mazzini.

She known as the quantity on the again of her Bank of America debit card and obtained a impolite shock.

“It said I was locked out,” Barrionuevo-Mazzini mentioned.

Shock become shock when she lastly obtained by to Bank of America’s fraud division.

“They were able to confirm that the email in the account was not my email,” mentioned Barrionuevo-Mazzini.

And the routing quantity was not “her” routing quantity. It was the fraudsters’.

“They had removed my bank account information. They had put their routing information, their bank account,” she informed KPIX 5.

Somebody had hijacked her account and stolen all the pieces in it, altogether $7500 {dollars}.

Similar factor occurred to Kucma. She discovered when she went on-line to pay a invoice.

“I was at zero and I knew something was wrong immediately,” mentioned Kucma.

She says after hours on the cellphone to file a declare, a bank worker confirmed her worst worry: A fraudster was impersonating her and had drained $3,000 {dollars} from her account.

“This person literally got into my profile, changed my email, similar to you, Michelle. Then they had the nerve to go ahead and set up a complete transfer,” mentioned Kucma.

“Basically it’s an account takeover,” mentioned licensed fraud examiner Steve Morang. “If, in fact, they were able to get the EDD recipients’ personal identifiable information, we call it PII, which would include name, birth, date, social, address, then they’re able to go in and basically impersonate you.”

The routing quantity for each Barrionuevo-Mazzini and Kucma is similar: It traces to Sutton Bank in Ohio.

From there, in Kucma’s case, the cash was then transferred right into a “cash app” account.

“What the fraudster wants to do is he just wants to get more and more steps away from you with that money. Once money has been out of an account for more than 48 or 72 hours it’s almost impossible to retrieve that money,” mentioned Morang.

Morang suspects in these instances the private figuring out info got here from EDD, as a result of the victims are all EDD claimants.

“This data breach could have happened six months ago, a year ago, two years ago,” Morang mentioned. “It doesn’t matter because your information will never change. It has a very long shelf life.”

A former job placement employee we spoke to suspects the identical. We agreed to not reveal his identification. He says 15 years in the past he labored for an EDD associate company that helped individuals discover jobs.

“We were trained to access the EDD databases, employment databases to verify the information provided by the jobseekers,” the previous employee informed us.

He says everybody on the non-profit had logins that allowed full entry.

“It was obvious then that if they’re giving partner agencies that much free reign of their databases, that this was a problem,” mentioned the previous job placement employee.

KPIX 5 requested him what sort of info he was speaking about. His response: “The top of the heap, social security numbers, home addresses, account numbers.”

A couple of years in the past he got here throughout his previous login, and tried it again then, out of curiosity. He informed us it was nonetheless lively.

“I’m seeing the same thing I was able to see when I worked for the agency, just full access to personal information of the people who were registered for jobs services with the Employment Development Department,” mentioned the previous job placement employee.

That open entry is strictly what Barrionuevo_Mazzini and Kucma have feared, leaving them in a continuing state of tension.

“You had your bank information there. I did. And our full names and our personal addresses. Kenny, they’re able to see all of that at this time,” mentioned Barrionuevo_Mazzini.

After KPIX 5 gave Barrionuevo_Mazzini’s title to Bank of America she obtained all her a refund.

As for Kucma, Bank of America gave her a provisional credit score, however fraudsters struck yet one more time.

“The person again went into my account, changed my password and took the credit,” mentioned Kucma.

As soon as once more, she obtained a refund. However that also wasn’t the tip of it. In a collection of changes, the bank took all her a refund and extra. Her account is now adverse greater than $17,000.

“It’s a completely different treatment that EDD clients are getting right now. And it’s not right because those are the people who are really suffering and they should be taken care of,” mentioned Kucma.

Each girls are actually switching to paper checks. They are saying they’re not leaving something in Bank of America any extra, as a result of they only don’t belief it.

EDD in the meantime denies the previous job placement employee’s allegations.

In an electronic mail to KPIX, spokesperson Loree Levee says: “Staff, including an employee with a community based organization that may have been working with EDD and/or our local partners on job search activities, would only be interacting with our online labor exchange CalJOBS system, not our main EDD database. And they would only have access to the last four digits of the SSN in CalJOBS, NOT the full SSN or other Personal Identifying Information.”

KPIX tried to contact Sutton Bank and obtained by to a customer support consultant after a protracted wait. She put the decision on maintain, then hung up.

In a press release from Bank of America’s Invoice Halldin, he mentioned: “In our business, we refer to these as “account takeovers” – the place somebody has been in a position to achieve entry to an account. We haven’t seen it a lot within the context of the unemployment program.”