Random guesses include Alabama and Arkansas

Companies are allowed to do anything unless jurisdiction says otherwise.

It's not just the US. I had issues with my supplier a couple of years ago where they randomly changed the supply address of my account then opened additional accounts in my name without informing me or asking for consent, and after I called them to sort their shit they added a random over 2 grand charge to my account and expected me to pay my neighbour's bill for some reason. I ended up with around 15 calls to them where every time they claimed to be confused how that could have happened and promised an immediate fix which never materialised.

When I was finally able to raise a complaint with the ombudsman the supplier didn't even bother to respond. For all that blatant fraud they got a slap on the wrist. Their only penalty was that they had to credit a tiny amount to my account (I think it was ~£100) and remove the other fraudulent charges and accounts.

The worst part is I know for a fact they're pulling that shit with people unable or unwilling to fight back. I dread to think how much of their profit is from just straight-up scamming people.