Bank of America (BofA) vs GOS Phone Numbers?

dregrinfuces

I really doubt this has anything to do with GOS, but I thought I'd ask (just in case). I've been happily using the BofA web site (sending 2FA to my GOS phone) and app (on the same phone). Suddenly, both the web site and the app refuse to let me sign in. After entering the login information, the web site doesn't even ask where to send the 2FA. In both cases, it dumps me to a page demanding I call them to get an authorizations code. That works for one login, but that fails the same way after logging out and trying to log in again.

Anyone else seeing this? I really think it's a problem on BofA's end. But, though I'd ask.

JollyRancher

Does the same thing happen if you log in via their website from your computer?

dregrinfuces

Yes. That's actually what I meant when I talked about their web site, above. Sorry. But, now that you mentioned it, I've tried browsing to their page on the phone. Same result.

Blastoidea

Have you tried calling them to see what they say?

It might be interesting and informative.

dregrinfuces

I spent 3 hours on the phone with them. They're clueless. Every time they gave me a code and I logged in, they could see I was in just fine. All my security information was correct (and very secure). And, every time I logged out, the login immediately dumped me to that "call them" page. It doesn't even offer to send codes to my email address or alternative phone numbers. Nothing shows up in their system logs as to why that's happening. Nothing is weird about any transactions. Their last statement was that it was failing new logins because I was still on the phone with them after using the last code they gave me (?!?). They absolutely promised that some random time after I hung up with them, the problem would fix itself. Of course, I asked them how I was supposed to do my banking without being able to login. They had no answer. So, I gave up and went away. It's been two full days and still no access. I'd sure like to know what kind of programmers lock people out of their banks without telling the person why and logging that reason.

Anyway, sorry for the rant. Since I can't see how this could be related to GOS and nobody here jumped in with the same problem, I'll just escalate the issue on the BofA side. Thanks, anyway.

Blastoidea

dregrinfuces
Wow!

Murcielago

Do you use a VPN? I can remember a similar behavior of websites (but I can't think of a specific example right now, sorry) when I had a VPN activated.

dregrinfuces

Nope. No VPN.

dregrinfuces

Just for posterity, here's the page I get dumped to after entering my correct login credentials on their web site (without getting any prompt to send 2FA anywhere):

https://i.imgur.com/qPYkrTe.jpg

And, I love the URL for that page:

https://secure.bankofamerica.com/login/sign-in/signOnSuccessRedirect.go

Note the "signOnSuccessRedirect" part at the end.

The page on their app looks very similar (and I sign in with biometrics, there).

And, of course, that phone number doesn't go to some kind of direct or automated place to get a code. It's off to their telephone menu where I get to dig my way down to a place where if finally tells me about how busy they are and I can leave a callback number for them to call me when they can get around to it. An hour or so later, they'll call back, and I get to spend a fine time answering all their "credit bureau" type of questions to prove who I am.

JollyRancher

dregrinfuces
When you get logged in, what 2fa option(s) to you have set?

All I can think of is that you have it set to something that isn't functioning correctly so it is throwing you into their emergency 2fa method.

Oh, if you have a second phone and use a physical SIM then try popping the SIM into the non-GOS device and see what happens.

The other thing that comes to mind is that you are using a VOIP number and BoA doesn't like that.

dregrinfuces

No VOIP either. Straight T-Mobile account.

All I can remember about the 2FA option is that it's set to always ask (though I did turn it off to test while on the phone with them). It always used to ask and I think it listed all the phones and the email address (again, that's just from memory). The next time I get into the account I'll check that option. Maybe there's an option to use a specific (different) phone or even email.

Good idea about swapping SIMs to a non-GOS phone. I'll work on that. Of course, the problem is that it doesn't even ask any more, not that I don't get the code on the phone.

dregrinfuces

I waited too long and can't edit the above post anymore. I just wanted to add that it's possible they don't like that I've used this phone for 2FA so they've flagged the whole account. Though that theoretical status ought to clear once they grill me with their 20-questions and validate I'm legitimate. Since this problem started, I've never been offered the option to send 2FA anywhere. This phone or anything else. I even asked them if their 2FA server was up.