A Burbank physical therapist says two Zelle payments totaling nearly $2,000 left her business account in June without her authorization. Karleen Cox, who has banked with Bank of America for 20 years and run her practice for more than two decades, says the disputed transfers went to a recipient she did not know. After multiple reviews, she says the bank reopened her case for a fourth time.
NBC Los Angeles reported that the payments were sent June 1 through Zelle to someone named Julia MacFarland. Cox says she did not authorize them and had never heard of MacFarland. She mainly used Zelle to receive patient payments, she said, and her bookkeeper first noticed the unfamiliar transactions that day, according to NBC Los Angeles.
The question of how the transfers cleared is central to Cox’s account of the dispute. NBC Los Angeles reported that Bank of America had blocked multiple attempts to send money to the same recipient the day before the two payments succeeded. The report also said a phone number associated with MacFarland had been added as an authorized user on Cox’s account. Cox believes her account was hacked.
What the Transaction Pattern Showed
Cybersecurity expert Joseph Steinberg reviewed materials in the case, NBC Los Angeles reported. He identified a sequence of blocked transfers followed by two successful payments to a recipient who had not previously received money from Cox’s account. Steinberg also noted that the account was generally used to receive patient payments, rather than send out large sums.
Steinberg said banks have obligations to monitor unusual activity in business accounts and to know their business customers. After reviewing documents Bank of America sent Cox, he said the declined or blocked activity should have prompted closer scrutiny before a transfer was allowed to proceed, according to the report.
The Bank’s Explanation and Cox’s Request for Evidence
Bank of America’s letters to Cox, dated June 9, June 15 and July 15, said the bank associated the completed transfer with a device used in earlier valid account activity. The bank told NBC Los Angeles the matter remained under review, although Cox had received a denial letter.
Cox reported the transfers and asked Bank of America to reconsider, requesting information about the device or IP address used. She says the response was an out-of-focus document on a black background that offered little detail she could use to verify the bank’s conclusion.
Cox says the bank told her it would review the case for a fourth time, then sent another denial notice three weeks later. Bank of America confirmed the case was closed on September 22. NBC Los Angeles reported that it asked the bank why its anti-fraud systems had not stopped the transfers.
The Dispute’s Cost to Cox’s Practice
Cox said the nearly $2,000 loss put pressure on her practice’s cash flow: the money could have covered employee payroll, and she took out a loan to help meet payroll expenses. She is considering taking Bank of America to small claims court.
How Account Takeover Differs From a Separate Zelle Case
A Federal Reserve-supported payments toolkit defines account takeover fraud as a criminal gaining unauthorized access to a legitimate user’s account and exploiting it. That describes unauthorized account access, but the definition alone does not establish how Cox’s disputed transfers were initiated or whether her account was taken over. In a separate case, the Consumer Financial Protection Bureau sued Early Warning Services and three banks, including Bank of America, on December 20, 2024, alleging Zelle-related violations. The agency voluntarily dismissed the action with prejudice in March 2025, and the court dismissed it with prejudice on March 5, according to the Consumer Financial Protection Bureau. That agency case concerned allegations against multiple defendants; it does not resolve Cox’s individual business-account dispute.
Cox’s case remains unresolved. Her account of the disputed payments and the bank’s device-based explanation leave the central question unanswered: how were the transfers initiated?
