LOS ANGELES, September 26 — A physical therapist who has banked with Bank of America for more than two decades is disputing nearly two thousand dollars in Zelle transfers she says she never authorized, and a cybersecurity expert who reviewed the records says the case raises questions about why the bank’s anti-fraud systems did not intervene sooner.
Karleen Cox, who opened her practice and a small business banking account with the bank more than twenty years ago, first learned of the problem on June 1, when her bookkeeper flagged an unfamiliar transaction, according to NBC4 News, which reported the dispute on Tuesday, Sept. 22. Two payments totaling nearly two thousand dollars had been sent through Zelle to someone identified as Julia MacFarland.
Cox said she did not authorize the transfer and had no idea who Julia MacFarland was. “It was so obvious and clear that this wasn’t right,” Cox said. “Something had happened.
Something had been hacked.”
Blocked transfers, then two that went through
Bank records reviewed by NBC Los Angeles show Cox primarily used Zelle to receive payments from patients. As she investigated, she noticed Bank of America had blocked multiple transfer attempts to the same recipient the day before the successful payments were processed. Cox also discovered that a phone number associated with that recipient had been added as an authorized user on her account.
“That’s when the panic ensued,” she said. “How did something that we thought was so protected get hacked, and a phone number was added?” NBCLA asked cybersecurity expert Joseph Steinberg to review records related to the disputed transactions.
Steinberg pointed to the repeated blocked transactions followed by the two successful transfers to a recipient who had never previously received money from Cox’s account. “There are several things about this case that look unusual,” Steinberg said. “You have a device that had transactions blocked, and then money is going out to accounts that this user had never sent money to in the past.” “This account was used primarily for inbound payments.
That should have stood out as a red flag,” Steinberg said. “That is actually something the bank can determine by going through its records and what its anti-fraud system saw.”
Three denial letters, then a fourth
Cox said she immediately reported what she called fraudulent transactions to Bank of America and repeatedly asked the bank to reconsider its findings. She received responses by mail dated June 9, June 15 and July 15 — all with the same language. “Our investigation found that the transaction in question was completed using a device that is consistent with previous valid account activity,” the letters said.
When Cox requested additional information, including details about the device or IP address used to complete the transaction, she received an out-of-focus document on a black background that again stated the transfer had been completed from her device. Steinberg reviewed that document and said it raised additional questions.
“It looks like there’s a lot of stuff that was declined or blocked,” he said. “Usually, that’s a red flag that leads to much stricter analysis or even locking an account and contacting a user.” When Cox questioned Bank of America about what that document showed, she was told her case would be reopened for a fourth time. Three weeks later, she received another denial notice.
“I don’t understand why it’s not so clear to them that in the 20 years I’ve had this account, they can’t see that this is not consistent with my account activity,” Cox said.
What the bank is required to watch
Steinberg said banks have obligations to monitor unusual account activity. “Banks have a requirement to know their customer, especially with a business,” he said. “If the party who received money had no reason to be receiving money from this business, that’s something the bank is supposed to pay attention to for issues of theft, money laundering and other financial crimes.
I can say that the papers the account holder has that I have seen don’t really explain very much and certainly don’t show why their anti-fraud systems didn’t kick in.” Since June, NBCLA has repeatedly asked Bank of America for comment. Carolyn Johnson reports for the NBC4 News at 5 p.m. on Tuesday, Sept. 22, 2026.
What to watch next: whether Bank of America responds to NBCLA’s requests for comment and whether Cox’s fourth denial is revisited. For small-business account holders who rely on Zelle for inbound payments, the case turns on a question the bank’s own records should answer — why repeated blocked transfers to a new recipient did not trigger a closer look before the money left the account.
