No letting third parties use your Zelle or sharing credentials, with exceptions
You agree not to authorize a third party to use the Zelle Service or share your credentials so a third party can use it on your behalf. The exception is legally authorized situations, such as a legal guardianship or a power of attorney.
Supporting quotations
You agree that you will not authorize a third party to use the Service or share your credentials with a third party to use the Service on your behalf
except in legally authorized situations such as for a legal guardianship or pursuant to a power of attorney
Qualifications & exceptions
Exception for legally authorized situations such as guardianship or power of attorney
Security & Safeguards · Restriction or exception
You accept security procedures and are bound even by unauthorized instructions
By enrolling in and accessing the Service with your User ID, password and any other security methods Bank of America requires (such as security questions or one-time passcodes), you agree that its security procedures for transfers initiated through the Service are commercially reasonable. You agree to be bound by instructions, authorized or not, that Bank of America carries out in compliance with those procedures, unless you gave prior notice of possible unauthorized use of your password and Bank of America had a reasonable opportunity to act on it. Separately, Section 8.B says consumers will have no liability for unauthorized transactions reported within 60 days after the statement showing them is sent, and Section 8.D says liability for Three Business Day and Next Business Day ACH transfers involving a Bank of America consumer account is as described in Section 8. The Agreement does not say how these provisions fit together.
Supporting quotations
using your User ID and password, and such other security and identification methods as we may require from time to time, such as security questions or one-time passcodes
you acknowledge and agree that this system includes security procedures for transfers initiated through this Service that are commercially reasonable
You agree to be bound by instructions, whether authorized or unauthorized, which we implement in compliance with these procedures, unless you have given us prior notice of possible unauthorized use of your password and we had a reasonable opportunity to act on such notice.
You will have no liability for unauthorized transactions if you notify us within 60 days after the statement showing the transaction has been sent to you
Our liability for Three-Business Day ACH transfers and Next Business Day ACH transfers involving a transfer to or from a Bank of America consumer account is as described in Section 8.
Qualifications & exceptions
Applies to instructions implemented in compliance with the security procedures
Exception: prior notice of possible password misuse plus a reasonable opportunity to act
Section 8.B gives consumers a separate unauthorized-transaction rule (no liability if reported within 60 days, or 90 for other-bank transfers)
data: identifiers · purpose: security
Not stated here
How this paragraph interacts with the consumer unauthorized-transaction rules in Section 8.B is not stated
The paragraph sits under the ACH and wire transfer heading but refers to transfers initiated through "this Service"; whether it reaches other transfer types is not stated
Cross-references
contrast (model-proposed): No liability for unauthorized transactions reported within 60 (or 90) days — Section 6.A binds you to instructions 'whether authorized or unauthorized' that the bank carries out under its security procedures (b372). For consumers, Section 8.B says you have no liability for unauthorized transactions reported within 60 days (b584). This is a real tension for consumer ACH transfers.
qualifies (model-proposed): Which transfers this section's ACH and wire liability rules cover — Section 6.E says liability for ACH transfers to or from a consumer account is set in Section 8 (b457), not under 6.A/6.E's business-oriented rules. That limits how the 6.A binding-instruction rule applies to consumers.
Alerts are unencrypted and may show your name and balance
Because alerts are not encrypted, Bank of America says it will never include your full account number in them. Alerts may still include your name and some account information, such as your balance or due date, and anyone with access to your messages could see that information.
Supporting quotations
Because alerts are not encrypted, we will never include your full account number. However, alerts may include your name and some information about your accounts, such as your account balance or due date. Anyone who has access to your messages could view the alert information.
related (model-proposed): Erica alerts may deliver sensitive information by push or text — Alerts are unencrypted, and anyone with access to your messages can read them (b496). Erica can also send sensitive information by push or text alert (b653).
Security & Safeguards · User right or choice
Security text alerts: one STOP opts out of all, UNDO opts back in
Bank of America may also send credit card, business line of credit and/or debit card security text alerts to your mobile number when applicable, from short codes that are Free to End User (FTEU), though data rates may apply. Texting STOP to any listed short code opts you out of all security text alerts, and you will get a confirmation text. To opt back in, text UNDO to any listed short code or call the number on the back of your card; text HELP for more information.
Supporting quotations
We may also send credit card, business line of credit and/or debit card security text alerts to your mobile phone number when applicable.
Text alerts will be delivered from a short code number which are Free to End User (FTEU), however, data rates may apply depending on your mobile carrier plan.
You can opt out of all security alerts at any time by sending the word STOP to any of the short codes below. Opting out of any of the alerts will automatically STOP all security alerts via text message from being sent to you.
If you text STOP, you will receive an additional confirmation text acknowledging our receipt of your request. To opt back into receiving all security text alerts, text UNDO to any of the short codes listed below or call us at the number on the back of your card.
If you need further assistance text HELP to any of the following codes for more information.
Qualifications & exceptions
Opting out of any security text alert stops all security text alerts
Data rates may apply depending on your carrier plan
data: messages · purpose: security
Security & Safeguards · Context
Short codes and toll-free numbers for security text alerts by product
A table lists the short code and toll-free number for each security text alert product: credit card (non-fraud and fraud), ATM/debit card (non-fraud and fraud), Mobile Wallet, digital fingerprint, account takeover, Zelle, wires, ACH and Bill Pay, rewards redemption, account opening, ACH/balance transfer, checking and/or money market savings, SMS on demand, credit card application, Small Business credit card (two short codes, 96264 / 659543), and account restrictions. For example, credit card fraud alerts use short code 322632 and 844.585.0488, and ATM/debit card fraud alerts use 39989 and 844.585.0485.
Supporting quotations
Product
Short Code
Toll Free Number
Credit card (Non-Fraud)
49739
800.427.2449
Credit card (Fraud)
322632
844.585.0488
ATM/debit card (Non-Fraud)
65216
800.432.1000
ATM/debit card (Fraud)
39989
844.585.0485
Mobile Wallet
47518
855.262.0541
Digital fingerprint
55983
866.500.6260
Account takeover
56433
866.376.7091
Zelle®, Wires, ACH and Bill Pay
80814
866.376.4584
Rewards redemption
82096
844.585.0488
Account opening
82958
866.258.4982
ACH/balance transfer
85382
866.222.4145
Checking and/or money market savings account
86006
877.887.8935
SMS on demand
90208
800.432.1000
Credit card application
91207
888.230.6262
Small Business credit card
96264 / 659543
800.427.2399
Account restrictions
85594
877.488.7843
Qualifications & exceptions
Small Business credit card lists two short codes
purpose: security
Security & Safeguards · Context
Report compromised passwords or unauthorized transfers at once
You are told to notify Bank of America at once if you believe your password has been compromised or someone has transferred or may transfer money without your permission, and that calling immediately is the best way to minimize your loss. The agreement warns that unauthorized use of the Services could cause you to lose all the money in your accounts plus any amount available under your Balance Connect overdraft protection service.
Supporting quotations
Tell us at once if you believe your password has been compromised or if someone has transferred or may transfer money from your account without your permission.
The best way to minimize your loss is to call us immediately.
The unauthorized use of the Services could cause you to lose all of your money in your accounts, plus any amount available under your Balance Connect® overdraft protection service.
Qualifications & exceptions
Potential loss includes Balance Connect overdraft protection amounts
Not stated here
Balance Connect overdraft protection terms are not supplied in this section
Security & Safeguards · Restriction or exception
You are responsible for transactions by people you let use your credentials
If you permit another person to use your User ID, password and related codes, you are responsible for all transactions that person performs, even if they exceed your authorization, until you notify Bank of America that the person is no longer authorized so it can block the credentials or codes and issue new ones. Transactions that you or someone acting with you initiates with fraudulent intent are also treated as authorized.
Supporting quotations
If you permit another person to use your User ID and password and related code(s), you are responsible for all transactions that person performs (even if he or she exceeds your authorization), until you notify us that the person is no longer authorized
the credentials or codes and issue new ones
Transactions that you or someone acting with you initiates with fraudulent intent are also authorized transactions.
Qualifications & exceptions
Responsibility continues until you notify the bank the person is no longer authorized
Applies even if the person exceeds your authorization
Fraudulent transactions by you or someone acting with you are treated as authorized
Security & Safeguards · Procedure
Small business: how to report a possibly compromised password
Section 9 applies only to small business accounts. If you think your password may have been compromised, or you believe there has been unauthorized or erroneous online activity on your account, the agreement tells you to contact Bank of America at 866.758.5972. If you are calling from outside the continental U.S., you can call collect at 925.681.7600.
Supporting quotations
9. Additional Provisions Only Applicable to Small Business Accounts
If you think your password may have been compromised, or you believe there has been unauthorized or erroneous online activity with respect to your account, contact us at 866.758.5972.
If you are calling from outside of the continental U.S., call us collect at 925.681.7600.
Qualifications & exceptions
Section 9 applies only to small business accounts
Collect-call number is for callers outside the continental U.S.
purpose: security
Security & Safeguards · Procedure
Small business password duties: keep it confidential and report exposure
Small business customers agree to (1) keep the password secure and strictly confidential, giving it only to authorized signers on the account; (2) tell everyone they give it to not to disclose it to anyone unauthorized; and (3) immediately notify Bank of America and select a new password if they believe it may have become known to an unauthorized person. For businesses using the additional services in the Business Services Addendum, this password section applies to all passwords, including those assigned to users or Administrators.
Supporting quotations
9. Additional Provisions Only Applicable to Small Business Accounts
1) keep your password secure and strictly confidential, providing it only to authorized signers on your account(s)
2) instruct each person to whom you give your password that he or she is not to disclose it to any unauthorized person
3) immediately notify us and select a new password if you believe your password may have become known to an unauthorized person
For businesses who use the additional services described in the Business Services Addendum, this section applies to all passwords, including those assigned to users or Administrators.
Qualifications & exceptions
Section 9 applies only to small business accounts
Password may be shared only with authorized signers
Extends to user and Administrator passwords for Business Services Addendum users
purpose: security
Not stated here
The contents of the Business Services Addendum are not supplied.
Security & Safeguards · Permission or license
Bank may suspend or cancel a password it suspects is being misused
Bank of America may suspend or cancel your password even if you have not notified it of a problem, if it suspects the password is being used in an unauthorized or fraudulent manner. This appears in the small business section.
Supporting quotations
9. Additional Provisions Only Applicable to Small Business Accounts
We may suspend or cancel your password even without receiving such notice from you, if we suspect your password is being used in an unauthorized or fraudulent manner.
Qualifications & exceptions
Section 9 applies only to small business accounts
Does not require notice from you first
purpose: security
Not stated here
The provision does not say whether or how you will be told about a suspension or cancellation.
The basis for suspicion is not described.
Security & Safeguards · Restriction or exception
Small business agrees security procedures are commercially reasonable
By using the Services, a small business customer acknowledges that the security procedures this Agreement sets out for electronic banking are commercially reasonable. The customer agrees to be bound by instructions, authorized or unauthorized, that Bank of America carries out in compliance with those procedures, unless the customer had already given notice of possible unauthorized use and the bank had a reasonable opportunity to act on it.
Supporting quotations
9. Additional Provisions Only Applicable to Small Business Accounts
By using the Services, you acknowledge and agree that this Agreement sets forth security procedures for electronic banking transactions that are commercially reasonable.
You agree to be bound by instructions, whether authorized or unauthorized, which we implement in compliance with these procedures
unless you have given us prior notice of possible unauthorized use as described above (and we had a reasonable opportunity to act on such notice)
Qualifications & exceptions
Section 9 applies only to small business accounts
Binding even for unauthorized instructions processed under the procedures
Exception requires prior notice and a reasonable opportunity for the bank to act
purpose: security
Not stated here
Section 9.B does not itself list which security procedures it means.
Security & Safeguards · Restriction or exception
No warranty the website is virus-free; you bear the cost of repairs
Neither Bank of America nor its Vendors warrant that the website, or the server that makes it available, is free of viruses or other harmful components. You assume the entire cost of any servicing, repair or correction of problems caused by viruses or other harmful components.
Supporting quotations
WARRANT THAT THE WEB SITE, OR THE SERVER THAT MAKES THEM AVAILABLE, IS FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS
YOU ASSUME THE ENTIRE COST OF ALL NECESSARY SERVICING, REPAIR, OR CORRECTION OF PROBLEMS CAUSED BY VIRUSES OR OTHER HARMFUL COMPONENTS.
EXCEPT AS OTHERWISE PROVIDED HEREIN, AND SUBJECT TO APPLICABLE LAW,
Qualifications & exceptions
You bear the entire cost of repairs
The Section 10.A disclaimer is subject to applicable law and other provisions of the Agreement.
Security & Safeguards · Restriction or exception
Erica may record other voices; voice transactions treated as authorized by you
Once activated, Erica may respond to voices that are not yours, and once you invoke the microphone in a session it may capture, record and transcribe other voices, continuing to record for up to 15 seconds after it hears a statement it can respond to, unless you close Erica or sign out of the Mobile Banking app. Bank of America will treat all voice interactions and transactions as authorized by you, even if another voice or person initiated or completed them.
Supporting quotations
Once activated, Erica may respond to voices that are not yours.
once you invoke the microphone in a session
Erica may capture, record, and transcribe other voices in addition to yours, and may continue recording for a period of time (up to 15 seconds) after Erica hears any statement to which a response can be made, unless you close Erica or sign out of the Mobile Banking app
We will treat all voice interactions and transactions as though you authorized them, and as though they are authorized interactions and transactions, even if another voice or person initiated or completed them.
A transaction is unauthorized for purposes of this Section, if it is initiated from your account by someone other than you, who does not have actual authority to initiate that transaction and from which you receive no benefit.
These liability rules are established by Regulation E, which implements the federal Electronic Fund Transfer Act and does not apply to business accounts.
Qualifications & exceptions
Recording can continue up to 15 seconds after a respondable statement
Closing Erica or signing out of the Mobile Banking app stops the continued recording
Applies even if another person initiated or completed the transaction
Section 8.B separately treats as unauthorized a transaction initiated by someone other than you without actual authority from which you receive no benefit, under rules it says Regulation E establishes for consumer accounts
data: audio · purpose: service_operation
Not stated here
The Agreement does not reconcile this Erica rule with Section 8.B's definition of unauthorized transactions and its Regulation E liability rules for consumer accounts
Cross-references
contrast (model-proposed): What counts as an unauthorized transaction under this section — Erica treats all voice transactions as authorized even when another person's voice started them (b649). That is in tension with Section 8.B's definition of an unauthorized transaction (b585).
Security & Safeguards · Restriction or exception
Anyone who can open your Mobile Banking app can also use Erica as you
You acknowledge that anyone who can access your accounts through the Mobile Banking app, whether by passcode, fingerprint, facial recognition or otherwise, could also access them through Erica. Bank of America will treat those interactions as authorized by you, even if another voice or person initiated or completed them.
Supporting quotations
anyone who can access your accounts through the Mobile Banking app, either through your passcode, fingerprint, facial recognition, or otherwise, could also access your accounts through Erica
We will treat these interactions as though you authorized them
even if another voice or person initiated or completed them
A transaction is unauthorized for purposes of this Section, if it is initiated from your account by someone other than you, who does not have actual authority to initiate that transaction and from which you receive no benefit.
Your debit card, username, or password has been lost, stolen, compromised, or used without your permission;
These liability rules are established by Regulation E, which implements the federal Electronic Fund Transfer Act and does not apply to business accounts.
Qualifications & exceptions
Applies to any access method to the app
Section 8.B separately treats as unauthorized a transaction initiated by someone other than you without actual authority from which you receive no benefit, including use of your username or password without permission, under rules it says Regulation E establishes for consumer accounts
Not stated here
The Agreement does not reconcile this Erica rule with Section 8.B's definition of unauthorized transactions and its Regulation E liability rules for consumer accounts
Cross-references
contrast (model-proposed): What counts as an unauthorized transaction under this section — Erica terms treat interactions by anyone who can open your app as authorized 'even if another voice or person initiated or completed them' (b651). Section 8.B treats a transaction as unauthorized if someone without actual authority initiates it and you get no benefit (b585).
Erica alerts may deliver sensitive information by push or text
If you have enabled certain Erica functions, you may receive insights or sensitive information through push or text alerts, possibly even when the Mobile Banking app is closed. Your mobile carrier's message and data rates may apply.
Supporting quotations
If you have enabled certain functions within Erica
you may receive insights or sensitive information through push or text alerts, possibly even if your Mobile Banking app is closed
Message and data rates from your mobile carrier may apply.
Qualifications & exceptions
Only if certain Erica functions are enabled
Carrier message and data rates may apply
data: messages · purpose: service_operation
Not stated here
Which functions trigger these alerts is not specified