I would suspect client called BOA - they utilize 2FA
Customer claimed they did not authorize access.