Bank of America Online Banking Service Agreement

Security & Safeguards · User right or choice

Higher limits may be available with Secured Transfer or a registered USB security key

Footnote 1 to the transfer-to-someone-else limits says you may be eligible for higher limits if you add Secured Transfer, which sends a one-time passcode to your mobile device, or register a USB security key. It adds that higher limits may also apply for Bank of America Private Bank, Merrill or small business accounts.

Supporting quotations

You may be eligible for higher limits if you add Secured Transfer to receive a one-time passcode on your mobile device or register a

Higher limits may also apply for Bank of America Private Bank, Merrill or small business accounts.

Qualifications & exceptions

• Says you may be eligible; the footnote does not state the higher amounts or the eligibility conditions.

Not stated here

• The text of the linked USB security key page is not supplied here, and the higher limit amounts are not stated in this source.

Security & Safeguards · Restriction or exception

You accept the security procedures as commercially reasonable and are bound by instructions under them

By enrolling and accessing the Service with your User ID, password and other methods the bank may require, such as security questions or one-time passcodes, you acknowledge that the system includes security procedures for transfers initiated through the Service that are commercially reasonable. You agree to be bound by instructions, whether authorized or unauthorized, that Bank of America implements in compliance with these procedures, unless you gave prior notice of possible unauthorized use of your password and the bank had a reasonable opportunity to act on that notice. Separately, the agreement's Section 8 says that for consumer accounts you have no liability for unauthorized transactions reported within 60 days after the statement; this section does not say how the two provisions fit together.

Supporting quotations

you acknowledge and agree that this system includes security procedures for transfers initiated through this Service that are commercially reasonable.

You agree to be bound by instructions, whether authorized or unauthorized, which we implement in compliance with these procedures, unless you have given us prior notice of possible unauthorized use of your password and we had a reasonable opportunity to act on such notice.

You will have no liability for unauthorized transactions if you notify us within 60 days after the statement showing the transaction has been sent to you

Qualifications & exceptions

• Applies to transfers initiated through this Service.
• The exception requires prior notice and a reasonable opportunity to act.

Not stated here

• The source does not state how this binding-instructions provision interacts with the Section 8 protections for unauthorized transactions.

Cross-references

• contrast (model-proposed): No liability for unauthorized transactions reported within 60 days; later losses may not be recovered — Section 6.A says you are bound by instructions the bank implements under its security procedures, whether authorized or unauthorized, unless you gave prior notice; Section 8.B says you have no liability for unauthorized transactions reported within 60 days of the statement. The two pull in different directions and the source does not reconcile them.

Security & Safeguards · User right or choice

Higher transaction limits may be available with Secured Transfer or a registered USB security key

Footnote 3 says you may be eligible for higher transaction limits if you add Secured Transfer to receive a one-time passcode on your mobile device or register a USB security key, and that higher limits may also apply to Bank of America Private Bank, Merrill or small business accounts.

Supporting quotations

You may be eligible for higher transaction limits if you add Secured Transfer to receive a one-time passcode on your mobile device or register a

Higher transaction limits may also apply for Bank of America Private Bank, Merrill or small business accounts.

Qualifications & exceptions

• Stated as eligibility, not as a right.

Not stated here

• The text of the USB security key page is not supplied here; the higher limit amounts are not stated.

Security & Safeguards · Company practice

Alerts are not encrypted, may show your name and account details, and the bank can add or cancel alerts

The bank may add new alerts or cancel old ones, and usually but not always notifies you when it cancels one. Because alerts are not encrypted, it never includes your full account number, but alerts may include your name and some account information, such as balance or due date. Anyone with access to your messages could view the alert information.

Supporting quotations

We may add new alerts from time to time, or cancel old alerts. We usually notify you when we cancel alerts, but are not obligated to do so.

Because alerts are not encrypted, we will never include your full account number.

alerts may include your name and some information about your accounts, such as your account balance or due date. Anyone who has access to your messages could view the alert information.

Security & Safeguards · User right or choice

Security text alerts come from free short codes; text STOP to any short code to stop all of them

The bank may also send credit card, business line of credit and/or debit card security text alerts to your mobile number when applicable. They come from short codes that are Free to End User, though data rates may apply on your carrier plan. You can opt out of all security alerts at any time by texting STOP to any listed short code; opting out of any of the alerts stops all security text alerts, and you receive a confirmation text. To opt back in, text UNDO to any listed short code or call the number on the back of your card. Text HELP to any listed code for more information.

Supporting quotations

We may also send credit card, business line of credit and/or debit card security text alerts to your mobile phone number when applicable.

Text alerts will be delivered from a short code number which are Free to End User (FTEU), however, data rates may apply depending on your mobile carrier plan.

You can opt out of all security alerts at any time by sending the word STOP to any of the short codes below.

Opting out of any of the alerts will automatically STOP all security alerts via text message from being sent to you.

To opt back into receiving all security text alerts, text UNDO to any of the short codes listed below or call us at the number on the back of your card.

Qualifications & exceptions

• Opting out of any alert stops all security text alerts.

Security & Safeguards · Context

Short codes and toll free numbers: credit card and ATM/debit card alerts, fraud and non-fraud

The short code table lists, by product: credit card (non-fraud) 49739 and 800.427.2449; credit card (fraud) 322632 and 844.585.0488; ATM/debit card (non-fraud) 65216 and 800.432.1000; ATM/debit card (fraud) 39989 and 844.585.0485.

Supporting quotations

Product

Short Code

Toll Free Number

Credit card (Non-Fraud)

49739

800.427.2449

Credit card (Fraud)

322632

844.585.0488

ATM/debit card (Non-Fraud)

65216

800.432.1000

ATM/debit card (Fraud)

39989

844.585.0485

Qualifications & exceptions

• Each row pairs a product with a short code for text alerts and a toll free number.

Security & Safeguards · Context

Short codes and toll free numbers: mobile wallet, digital fingerprint, account takeover and payments

The table lists: Mobile Wallet 47518 and 855.262.0541; Digital fingerprint 55983 and 866.500.6260; Account takeover 56433 and 866.376.7091; Zelle, Wires, ACH and Bill Pay 80814 and 866.376.4584.

Supporting quotations

Product

Short Code

Toll Free Number

Mobile Wallet

47518

855.262.0541

Digital fingerprint

55983

866.500.6260

Account takeover

56433

866.376.7091

Zelle®, Wires, ACH and Bill Pay

80814

866.376.4584

Qualifications & exceptions

• Each row pairs a product with a short code for text alerts and a toll free number.

Security & Safeguards · Context

Short codes and toll free numbers: rewards, account opening, ACH/balance transfer and checking or savings

The table lists: Rewards redemption 82096 and 844.585.0488; Account opening 82958 and 866.258.4982; ACH/balance transfer 85382 and 866.222.4145; Checking and/or money market savings account 86006 and 877.887.8935.

Supporting quotations

Product

Short Code

Toll Free Number

Rewards redemption

82096

844.585.0488

Account opening

82958

866.258.4982

ACH/balance transfer

85382

866.222.4145

Checking and/or money market savings account

86006

877.887.8935

Qualifications & exceptions

• Each row pairs a product with a short code for text alerts and a toll free number.

Security & Safeguards · Context

Short codes and toll free numbers: SMS on demand, credit card application, small business card, restrictions

The table lists: SMS on demand 90208 and 800.432.1000; Credit card application 91207 and 888.230.6262; Small Business credit card 96264 / 659543 and 800.427.2399; Account restrictions 85594 and 877.488.7843.

Supporting quotations

Product

Short Code

Toll Free Number

SMS on demand

90208

800.432.1000

Credit card application

91207

888.230.6262

Small Business credit card

96264 / 659543

800.427.2399

Account restrictions

85594

877.488.7843

Qualifications & exceptions

• Each row pairs a product with a short code for text alerts and a toll free number.

Security & Safeguards · Procedure

Tell the bank at once if your password is compromised; unauthorized use could cost you all your funds

Tell the bank at once if you believe your password has been compromised or that someone has transferred or may transfer money from your account without your permission. The best way to minimize loss is to call immediately. The agreement warns that unauthorized use of the Services could cause you to lose all your money in your accounts plus any amount available under your Balance Connect overdraft protection service.

Supporting quotations

B. Limitation of Liability for Online Banking Transactions

Tell us at once if you believe your password has been compromised

The best way to minimize your loss is to call us immediately.

The unauthorized use of the Services could cause you to lose all of your money in your accounts

Security & Safeguards · Procedure

Transfers you did not make or permit also count as unauthorized; notify the bank at once

The list of situations considered unauthorized also includes someone having transferred money from your account without your permission and your statement showing transfers out of your account that you did not make or permit. In capital letters the agreement says to notify Bank of America at once if you believe any of these have happened to your account.

Supporting quotations

Someone has transferred money from your account without your permission; or

Your statement shows transfers out of your account that you did not make or permit.

NOTIFY BANK OF AMERICA AT ONCE if you believe any of these have happened to your account.

Security & Safeguards · Restriction or exception

If you let someone use your credentials you are responsible for what they do until you tell the bank

If you permit another person to use your User ID, password and related codes, you are responsible for all transactions that person performs, even if they exceed your authorization, until you notify the bank that the person is no longer authorized so it can block the credentials or codes and issue new ones. Transactions that you or someone acting with you initiates with fraudulent intent are also authorized transactions. This sits alongside the rule that you have no liability for unauthorized transactions reported in time.

Supporting quotations

If you permit another person to use your User ID and password and related code(s), you are responsible for all transactions that person performs (even if he or she exceeds your authorization)

until you notify us that the person is no longer authorized so we may block

Transactions that you or someone acting with you initiates with fraudulent intent are also authorized transactions.

You will have no liability for unauthorized transactions if you notify us within 60 days after the statement showing the transaction has been sent to you

Qualifications & exceptions

• Responsibility continues until you notify the bank that the person is no longer authorized.

Cross-references

• narrows (model-proposed): No liability for unauthorized transactions reported within 60 days; later losses may not be recovered — If you permit another person to use your credentials you remain responsible for what that person does until you notify the bank, which narrows the no-liability rule for unauthorized transactions.

Security & Safeguards · Procedure

Section 9 applies only to small business accounts; call 866.758.5972 if a password may be compromised

This section's additional provisions apply only to small business accounts. If you think your password may have been compromised, or believe there has been unauthorized or erroneous online activity on your account, contact the bank at 866.758.5972, or call collect at 925.681.7600 from outside the continental U.S.

Supporting quotations

9. Additional Provisions Only Applicable to Small Business Accounts

If you think your password may have been compromised, or you believe there has been unauthorized or erroneous online activity with respect to your account, contact us at 866.758.5972.

If you are calling from outside of the continental U.S., call us collect at 925.681.7600.

Qualifications & exceptions

• Applies to small business accounts.

Security & Safeguards · Restriction or exception

Small businesses must keep passwords confidential, report compromise, and accept notices at the address on file

You agree the bank may send notices and other communications, including password confirmations, to the current address in its records whether or not it names a particular individual, and that it is not responsible or liable if information is intercepted by an unauthorized person in transit or at your place of business. You agree to keep your password secure and strictly confidential and give it only to authorized signers, to instruct each person you give it to not to disclose it to unauthorized persons, and to notify the bank immediately and select a new password if you believe it may have become known to an unauthorized person. The bank may suspend or cancel your password without notice if it suspects unauthorized or fraudulent use. For businesses using the additional services in the Business Services Addendum, this applies to all passwords, including those assigned to users or Administrators.

Supporting quotations

You agree that we may send notices and other communications, including password confirmations, to the current address shown in our records

Bank of America will not be responsible or liable to you in any way if information is intercepted by an unauthorized person, either in transit or at your place of business.

1) keep your password secure and strictly confidential, providing it only to authorized signers on your account(s); 2) instruct each person to whom you give your password that he or she is not to disclose it to any unauthorized person; and 3) immediately notify us and select a new password if you believe your password may have become known to an unauthorized person.

We may suspend or cancel your password even without receiving such notice from you, if we suspect your password is being used in an unauthorized or fraudulent manner.

For businesses who use the additional services described in the Business Services Addendum, this section applies to all passwords, including those assigned to users or Administrators.

Qualifications & exceptions

• Applies to small business accounts.
• For Business Services Addendum users it covers user and Administrator passwords.

Not stated here

• The Business Services Addendum is not supplied in this source, so this card cannot say what its additional services include.

Security & Safeguards · Restriction or exception

Small businesses are responsible for all transactions by users, and the bank is not liable before it is told of misuse

Bank of America has no liability to you for any unauthorized payment or transfer made using your password that occurs before you notified it of possible unauthorized use and it had a reasonable opportunity to act on the notice. You are responsible for all transactions performed by you and any designated users, including Administrators, whether or not you specifically authorize them. If you notify the bank that a person is no longer authorized, only transactions that person performs after the notice are considered unauthorized. This is stated for small business accounts and differs from the consumer rule in Section 8, which gives no liability for timely-reported unauthorized transactions.

Supporting quotations

Bank of America will have no liability to you for any unauthorized payment or transfer made using your password that occurs before you have notified us of possible unauthorized use and we have had a reasonable opportunity to act on that notice.

You are responsible for all transactions performed by you and any designated user(s), including Administrator(s), whether you specifically authorize the transactions or not.

If you notify us that the person is no longer authorized, then only transactions that person performs after the time you notify us are considered unauthorized

You will have no liability for unauthorized transactions if you notify us within 60 days after the statement showing the transaction has been sent to you

Qualifications & exceptions

• Applies to small business accounts.
• Unauthorized status begins only from the time you notify the bank that a person is no longer authorized.

Cross-references

• contrast (model-proposed): No liability for unauthorized transactions reported within 60 days; later losses may not be recovered — For small business accounts you are responsible for all transactions by you and designated users, and the bank is not liable before it is told of misuse; for consumer accounts Section 8.B gives no liability for unauthorized transactions reported within 60 days.

Security & Safeguards · Restriction or exception

Small businesses accept the security procedures as commercially reasonable and are bound by instructions under them

By using the Services, you acknowledge and agree that the agreement sets out security procedures for electronic banking transactions that are commercially reasonable. You agree to be bound by instructions, whether authorized or unauthorized, that the bank implements in compliance with them, unless you gave prior notice of possible unauthorized use as described in the password section and the bank had a reasonable opportunity to act on it.

Supporting quotations

By using the Services, you acknowledge and agree that this Agreement sets forth security procedures for electronic banking transactions that are commercially reasonable.

You agree to be bound by instructions, whether authorized or unauthorized, which we implement in compliance with these procedures

Qualifications & exceptions

• Stated in the small business provisions.

Security & Safeguards · Restriction or exception

Erica may respond to and record other voices, and voice interactions are treated as authorized by you

Once activated, Erica may respond to voices that are not yours. When you invoke the microphone in a session, Erica may capture, record and transcribe other voices as well as yours, and may keep recording for up to 15 seconds after it hears any statement it can respond to, unless you close Erica or sign out of the Mobile Banking app. The bank treats all voice interactions and transactions as though you authorized them, even if another voice or person initiated or completed them.

Supporting quotations

Once activated, Erica may respond to voices that are not yours.

Erica may capture, record, and transcribe other voices in addition to yours

may continue recording for a period of time (up to 15 seconds)

We will treat all voice interactions and transactions as though you authorized them

Qualifications & exceptions

• Recording continues up to 15 seconds after a respondable statement unless you close Erica or sign out.

Security & Safeguards · Restriction or exception

Anyone who can open your Mobile Banking app can use Erica, and the bank treats it as your authorization

You acknowledge that anyone who can access your accounts through the Mobile Banking app, through your passcode, fingerprint, facial recognition or otherwise, could also access your accounts through Erica. The bank treats these interactions as though you authorized them, even if another voice or person initiated or completed them.

Supporting quotations

anyone who can access your accounts through the Mobile Banking app, either through your passcode, fingerprint, facial recognition, or otherwise, could also access your accounts through Erica.

We will treat these interactions as though you authorized them