Bank of America 2-Step Verification Loop: Why It Keeps Asking for Code & How to Fix

By David Sterling, Senior Financial Systems & Cybersecurity Analyst (CISA) Published: September 2026 | Technical Verification: Client Device Fingerprinting & Token Storage

Every time you sign into Bank of America on your laptop or home computer, you enter your Online ID and passcode, check the box reading "Remember this computer" (or "Don't ask me again on this device"), and enter a 6-digit SafePass code sent to your phone. Yet the very next day—or even hours later—Bank of America prompts you for another verification code.

Two-step verification is designed to safeguard your wealth, but when a banking portal repeatedly ignores trusted device settings, it creates severe authentication fatigue. If you are trapped in a perpetual 2FA loop on Bank of America, the issue is almost always rooted in how your browser stores, encrypts, or deletes client-side session cookies.

Here is the exact technical explanation of how Bank of America recognizes a trusted device and 5 proven fixes to make the verification stick.

Basic Troubleshooting First Aid: 2FA Loop Resolution Matrix

Technical Architecture: How BofA Identifies a 'Trusted Device'

When you check the box to remember your device, Bank of America's authentication engine does not just record your username. It generates a multifaceted device fingerprint combined with a persistent, encrypted cryptographic token stored in your browser's local storage:

[User Checks "Remember Device"] ──> [BofA Authentication Engine]
                                                    │
                         ┌──────────────────────────┴──────────────────────────┐
                         ▼                                                     ▼
               [Encrypted Cookie Placed]                             [Device Telemetry Stored]
            Name: `bofa_trusted_device`                            - WebGL / Canvas Fingerprint
            Max-Age: 180 Days                                      - Screen Resolution & Color Depth
            HttpOnly + Secure                                      - User-Agent & Installed Fonts
                         │                                                     │
                         └──────────────────────────┬──────────────────────────┘
                                                    │
                                     (Cookie Deleted or IP Shifts)
                                                    ▼
                                        Fingerprint Match Fails
                                                    ▼
                                     2FA Code Prompted on Every Login

If any software on your computer deletes that persistent cookie, if your browser randomizes your fingerprint, or if your IP address hops to an unrecognizable subnet, the authentication server treats your machine as an entirely new, untrusted computer.

5 Steps to Stop Bank of America from Asking for Codes Every Time

1. Whitelist Bank of America in Google Chrome

Many users have Chrome configured to wipe cookies on exit for privacy. You can preserve your Bank of America trust token while keeping the rest of your browsing private:

1. In Chrome, open a new tab and go to: chrome://settings/cookies
2. Scroll down to the section: Sites that can always use cookies (or Customized behaviors).
3. Click the Add button.
4. Enter: [*.]bankofamerica.com
5. Check the box: Including third-party cookies on this site.
6. Click Add.
7. Log into Bank of America once more, complete the SafePass code, and check "Remember this device." The cookie will now persist across browser restarts.

2. Disable iCloud Private Relay for Safari (macOS & iOS)

Apple's iCloud Private Relay routes your web traffic through two proxy servers, deliberately changing your IP address and geographical metadata every few hours. When Bank of America sees a trusted cookie originating from an unfamiliar IP address every morning, it flags the session as suspicious and triggers a 2FA prompt.

• On macOS: Go to System Settings > Apple ID > iCloud > Private Relay and toggle it Off (or click Options and uncheck Safari).
• On iPhone: Open Settings > [Your Name] > iCloud > Private Relay and toggle Off.

3. Adjust Privacy Shields in Brave or Firefox

Privacy-focused browsers utilize anti-fingerprinting techniques that spoof screen dimensions and hardware configurations to prevent cross-site tracking. This also prevents Bank of America from verifying your legitimate computer:

• Brave Browser: When visiting bankofamerica.com, click the Brave Lion icon in the address bar. Change Trackers & ads blocking to Standard or toggle Shields Down for this domain.
• Firefox: Navigate to about:preferences#privacy. Under Enhanced Tracking Protection, ensure it is set to Standard rather than Strict, or click the shield icon next to the address bar on Bank of America and toggle protection off.

4. Cease Using Automated PC Cleaners on Browser Data

Third-party cleaning utilities (such as CCleaner, CleanMyMac, or automated antivirus browser extensions) scan and wipe browser caches and cookies on a scheduled basis. Configure these tools to exclude Bank of America from their cleaning rules, or your trusted device tokens will be purged daily.

5. Clear the 2FA Loop in the Mobile App

If the repetitive code prompt is occurring inside the Bank of America mobile app rather than a browser:

1. Open the app and log in.
2. Tap Menu > Settings > Security.
3. Turn Face ID / Touch ID / Fingerprint to OFF.
4. Log out of the app completely.
5. Restart your smartphone.
6. Relaunch the app, manually enter your Online ID and passcode, and complete the SafePass SMS prompt.
7. Once inside your dashboard, navigate back to Security and re-enable Face ID / Biometrics. This forces the app to generate a fresh cryptographic key inside your phone's hardware enclave.