Nearly $1,980. That is what Karleen Cox, a Burbank physical therapist, says left her Bank of America business account in two Zelle payments she never approved. Three letters from the bank say otherwise, and a fourth review ended the same way.
NBC Los Angeles reported the dispute on Tuesday, Sept. 22, 2026. Cox opened her practice, and a small business account with the bank, more than 20 years ago. On June 1 her bookkeeper spotted a transaction nobody recognized: two payments, together close to $2,000, sent over Zelle to someone named Julia MacFarland. Cox said she had no idea who that was.
“It was so obvious and clear that this wasn’t right,” she said. “Something had happened. Something had been hacked.”
Blocked, then allowed
Bank records NBC Los Angeles reviewed show Cox mostly used Zelle to take in payments from patients, not to send money out. When she dug in, she found that the bank had stopped several attempts to pay the same recipient the day before the two payments cleared. She also found that a phone number tied to that recipient had been added to her account as an authorized user.
“That’s when the panic ensued,” Cox said. “How did something that we thought was so protected get hacked, and a phone number was added?”
The station asked cybersecurity expert Joseph Steinberg to look over the records. He found the pattern odd. “You have a device that had transactions blocked, and then money is going out to accounts that this user had never sent money to in the past,” Steinberg said. An account built for incoming money suddenly sending it to a stranger, he added, “should have stood out as a red flag.” The bank, in his view, could settle the question from its own records and what its anti-fraud system saw.
Letters and a blurry document
Cox reported the payments right away and pushed the bank to reconsider. Mailed replies dated June 9, June 15 and July 15 used the same wording: the investigation found the transaction was completed on a device consistent with earlier valid activity on the account.
She asked for more, including the device or IP address behind the transfer. What came back was an out-of-focus document on a black background, again saying the transfer came from her device. Steinberg looked at it too. “It looks like there’s a lot of stuff that was declined or blocked,” he said. “Usually, that’s a red flag that leads to much stricter analysis or even locking an account and contacting a user.”
When Cox asked the bank what the document proved, she was told the case would be reopened for a fourth time. Three weeks later another denial arrived.
“I don’t understand why it’s not so clear to them that in the 20 years I’ve had this account, they can’t see that this is not consistent with my account activity,” she said.
What banks must watch for
Steinberg said a bank has to know its customer, and more so when the customer is a business. If whoever received the money had no reason to be paid by that business, he said, the bank is supposed to take notice for the sake of theft, money laundering and other financial crimes. The papers Cox holds, he said, explain little and do not show why the anti-fraud systems stayed quiet.
NBC Los Angeles has asked Bank of America since June for an explanation of why the transfers went through. The bank told the station that explanations were mailed to the customer. Asked why its fraud systems did not stop the payments after the earlier blocked attempts, it said the matter was still in progress, even though Cox already held a denial letter.
For Cox the money is not abstract. “I know to Bank of America, $2,000 may not seem like a lot,” she said. “But I’m a small business, and $2,000 could be payroll for employees.” She took out a loan to cover payroll and is now weighing a small claims suit to get the money back.
Sources
- Burbank business owner disputes $2,000 Zelle transfer, bank's fraud review – Consumer | Burbank News
