Slashdot Log In
Identity Theft Rates Among Top Banks
Posted by
kdawson
on Tue Mar 04, 2008 03:38 AM
from the naming-names dept.
from the naming-names dept.
Hugh Pickens writes "Consumers, regulators, and businesses lack objective tools to compare the incidence of identity theft across financial institutions and without such tools, consumers cannot 'vote with their feet' and choose safer institutions. Now a study by Chris Hoofnagle has analyzed 88,000 complaints submitted by victims to the FTC over a three month period in 2006 and found that Bank of America ranked highest of all firms in the study, with an average of 1,117 incidents over a three-month period. AT&T had 763 incidents, followed by Sprint Nextel, JP Morgan, Chase and its Chase and Bank One, and Capital One. When the estimated events are divided by the total deposits, the data show that HSBC, Washington Mutual, and Bank of America have the highest rates of identity theft. Hoofnagle said lending institutions should publicly report information about identity theft events such as the rate of identity theft; the form of identity theft attempted; whether it was a mortgage loan or credit card; and the amount of loss suffered as a result. would help consumers choose safer financial institutions. The full study(PDF) is available from the Berkeley Center for Law and Technology."
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
But they're huge... (Score:5, Insightful)
"Incidences per billion dollars" isn't good enough because that would favor banks with a low number of high-value deposits over consumer-oriented banks (which many of us presumably care more about) that deal with large numbers of low-value deposits.
Not only, that, but:
and
So they don't know how many total customers these organizations are dealing with (meaning we can't get a rate) and they're not even sure what victims meant when they identified an organization as related to their incident. That leaves the only interesting question, "Which institution is the riskiest one to do business with in terms of potential identity theft?" unanswered.
Anyone know if better data/a better analysis is available?
Re: (Score:3, Informative)
Re: (Score:2)
Uh, no... (Score:3, Informative)
The findings presented (in the summary, the linked article, and the original paper) were based on total incidents per institution (favoring small institutions), and incidents in relation to total deposits (favoring institutions having large average deposits).
Since the study was meant to "meaningfully compare institutions on their performance in avoiding identity theft,
Re: (Score:3, Insightful)
The difference is pretty important as the number of customers of a bank is not going to make it more or less attractive as a place to take a fraudulent loan out at. That is going to be determined by the fraud measures in place and how well known the brand is. If we are talking about loan fraud
Re: (Score:2)
Look at TD Ameritrade last year, it took them an unknown length of time to discover that somebody was able to access one of the servers they had with personal information. It was fairly well known before they admitted it that they had been loose with customer data. I was personally receiving pe
Re: (Score:3, Interesting)
As an example, one of the reasons I have a Bank of America account is that you can do just about anything from their web site. I routinely move money around between accounts, pay bills, all sorts of stuff. Now, probably because of this, as well as their wide customer base, I regularly see phishing attacks aimed at BoA, with plenty of them e-mailed to me over the years. I've seen some pretty sophisticated r
Re: (Score:3, Interesting)
Further correction (Score:3)
Showing the largest numbers of incidents is more akin to showing the relative perceived popularity of the bank in Romania, Ukrain and other places that originate the attacks and the relative stupidity of the banks customers.
"Voting with your feet" based on that data is probably not the best idea..
Re: (Score:2)
That was the first thing I thought of, since Bank of America is the largest bank in the country. Another thing that they must be struggling with is their growth. They've grown by acquiring other banks. Tho
It would depend on the type of business, no? (Score:4, Insightful)
- Online banking
- ATM access
- Point of sale transactions
- Brokerage Transactions
etc, etc.
My strategy has always been to spread my risk - make all point of sale transactions with a publically exposed credit card, which I pay off monthly from a completely separate checking account, which is totally divorced from my investment accounts. Each account is at a different bank, which i use different logins and passwords for.
If any one is compromised, I have at least a marginal degree of separation from all the others.
Re:It would depend on the type of business, no? (Score:4, Informative)
note that we're talking about stealing your identity here, not your money (though I guess that is likely to be the ultimate objective). Once they have your identity, they can likely open an account of their (or your) own - likely a credit account, of course - at some other institution.
perhaps I missed something...
Parent
Assumes a Cause (Score:4, Informative)
"Bank of America" is an actual bank? (Score:3, Funny)
Re: (Score:1, Insightful)
Not a Bit Surprised About Sprint (Score:4, Interesting)
Re: (Score:3, Informative)
Completely agree with the point about companies holding onto personal information far longer than they should. Playing devil's advocate though, they may need to protect themselves from people complaining about misdeeds from the distant past. Or receiving a bill in the mail that was posted 10 years prior. This seems a reasonable excuse to hold on to records. However, I think they should move this data "offline" so that it can be called up as a special measure in case of a dispute, but will be non-existent fo
Re: (Score:2)
Considering the account password gives access to very sensitive info and the pictures website PIN doesn't, that seems totally backwards. I've m
I bet AOL users are more likely to be phised too (Score:3, Insightful)
In particular did anyone else notice that the highest rates of identity theft seemed to occur at the largest banks who likely had the most customers? This suggests to me that it's not bad IT practices that account for these results but the make up of their customer bases. I suspect that while many financially and technologically savy people (such as me) have accounts at these banks their success at appealing to the largest possible market means they have a larger percent of non-savy customers. On the other hand another good hypothesis is just that more phising attacks attacks target the institution with the most customers. But if you are confident of your ability to avoid those then this shouldn't worry you much.
In either case this seems like a totally useless statistic and not a result of poor security as the write up suggests.
It's lucrative (Score:2)
I have heard rumours about fraudulent bank employees selling confidential information about customers to third parties.
I heard about this through a friend who never lost or misplaced their HSBC credit card, and who suddenly received entries in their monthly bills that did not correspond to past activity. But since this friend was very cautious about using the credit card and it was used very rarely indeed, it was virtually impossible for someone to steal this information physically.
If this is true then ba
If you ever wondered... (Score:2)
Canada's Royal Bank just sent around an amended customer agreement for people who bank on-line. They've refused to accept responsibility for quite a range of problems in this area, even if those proble
Re:If you ever wondered... (Score:5, Interesting)
It used to be that if a bank lost money because someone defrauded them by pretending to be a customer of theirs it was their problem. But now, with the wonderful new term "identity theft", it's your identity that's been stolen and therefore your money. You may appear to still have your identity, and they may appear to have lost their money, but that's just looking at it too simplistically.
So remember; fraud = their money, identity theft = your money. Change the way you describe the crime and magically you change who's the victim. Isn't that clever?
Parent
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Voting with your feet is "dangerous" (Score:1)
Re: (Score:2)
IANABanker but I suspect the last thing a financial regulator would want is a massive "voting with one's feet". Anything that has a slight chance of starting a bank run is seen as a danger. That can be one reason there are so little (public and detailed, comparative) data about data theft, card fraud etc. (Which is sad but rather a problem of the system not of the regulators).
Exactly, it's the role of supervisors to deal with such problems, and unless you force every person in the society to have a PhD in statistics and access to the whole financial structure of every bank, it's impossible for the average consumer to take proper decisions on which bank is more exposed to risk then another. Asking consumers to make their decisions on identity theft is like asking car buyers to make their decisions solely based on the quality of the cars wipers, ID theft is just one minor aspect
Re: (Score:1)
The catch is that you have to trust the regulators who are appointed by a government/president elected by representatives/electors elected through a sometimes complicated process by you. Too many leverages there.
Re: (Score:3, Interesting)
and that's why the financial sector is so expensive. To the public at least and in almost all countries. A big knowitall aganecy telling the little dumb citizen whom to trust, and even if they fail there is always the (knowitall) government to pay the bill - from the pocket of the little citizen.
The catch is that you have to trust the regulators who are appointed by a government/president elected by representatives/electors elected through a sometimes complicated process by you. Too many leverages there.
Actually, most of the regulations are set by the Basel Committee (The Basel accords), which theoretically should guarantee that there is at any point 99.7% chance that the bank doesn't go bankrupt. What you have to trust are the agencies supervising the applications of those accords. Either way, the banks are the first wishing those rules to be enforced, because failure of on bank usually means crisis in the sector, and problems for every bank. But indeed, risk management is a very costly aspect of banking
Banks != Market (Score:3, Insightful)
I mean isn't the whole point of being able to call yourself a bank is that you apply to prudential rules set by the government and therefore the consumer doesn't have to ask himself questions whether the bank is safe or not?
Quite frankly identity theft is a detail compared to other risks the banks are facing, this is why the whole financial market is divided between the banking system (black box supervised by the government) and the markets (where the government just guarantees transparency and it's up to the consumer to make his choices based on the information he is given).
The problem with disclosing this kind of information is that it sets doubt on the banking system, and the whole banking system relies on trust to function (hence the tight regulation of the banking sector).
We're not going to ask consumers to assess the risk exposure of banks are we?
Re: (Score:2)
Good day.
-Matt
P.S. Here's a link: http://en.wikipedia.org/wiki/Savings_and_Loan_crisis [wikipedia.org]
WaMu victim here (Score:5, Interesting)
However, I have to say that my experience with WaMu was really bad:
* They canceled my card while I was displaced during the California wildfires
* If you call the number on the back of your bank card it's actually extremely hard to work out how to get through to an actual person to talk about card fraud
* When I did get through to an actual person, using an alternative number they provided me at an actual bank, they tried to forward me to their fraud department. I sat on hold for an hour before deciding to give up and call back later
* The would not reverse fraudulent charges to my account. They told me that they would send me an affidavit that I would have to sign before they would refund the charges, and then it would take 30 days or more to process. This affidavit never arrived.
* I had much better luck calling the numbers listed on my statement and getting merchants to refund fraudulent charges
* WaMu did refund one fraudulent charge eventually
Short story: If you're a fraud victim at WaMu don't expect them to go out of their way to help you as a customer. You may have better luck taking care of it yourself.
More recently, I tried to pay off a loan with my WaMu debit card. Big mistake. According to my statement there was a double-charge pending for thousands of dollars. I called WaMu immediately, here is how that conversation went:
Me: I'm looking at my statement, it looks like there is a double charge for several thousand dollars
Them: Yes, we do see that, we see one charge has cleared and another pending
Me: That's an unauthorized charge, and clearly a mistake
Them: Well, the good news is that it that the money hasn't left your account yet, it is still pending
Me: Okay, can you stop the charge?
Them: No. But after it gets charged you could file a dispute with the merchant
Me: But you just said that the money hasn't left my account yet, and I'm telling you it's unauthorized, so why don't you stop it?
Them: We can't do that.
Me: Well that's completely useless then, isn't it?
Them: Yes, I understand, sorry about that..
It's not identity theft, per-say, but more indicitive of my experiences with WaMu so far. They don't exactly go out of their way to help you out during a bad situation.
So, yes, I believe this information should be published, and not only that, each and every customer affected should be questioned as to how well they feel their bank dealt with the situation and as to how secure they feel at their bank. WaMu would not be getting a very high rating from me at all.
Re:WaMu victim here (Score:5, Informative)
They should have explained things a little better. When a card is charged, it's a two-step process: authorization and capture. At authorization, they've told the merchant "yes, this transaction can go through and we'll hold the money for you". A merchant can't undo an authorization. The money doesn't get sent until capture, usually a nightly process. If a charge isn't captured within a certain amount of time (24 hours to a few days), the bank rescinds the authorization automatically.
They should have explained that there was a chance the merchant realized their mistake and wasn't going to capture the funds. If you contacted the merchant and let them know the situation, they probably could have prevented capture too. But, if the charge ended up being captured, you would need to file a dispute.
As a merchant, this is the way I want things to work. If an authorization goes through, I don't need to wait until I have the money in my account to ship someone their order. If they could back out of an authorization before capture, the authorization would be meaningless and I'd probably see a lot more fraud.
Parent
Re: (Score:3, Interesting)
However, even given that explanation, it does appear that simply having a debit card is a severe security risk for any customer - the bank seems to be unwilling to prevent the capture of funds when an account holder flags an authorization as false, and refunding fraudulent transactions may take well over a month. I've never seen any of my debit card transactions blocked for security purposes either - I have only ever received calls q
B of A victim here (Score:2)
I had a check stolen out of my mailbox and, being a college student, they stole all $40 out of my account. After spending the requisite bazillion years on the phone with several shell companies to get the fraud itself straightened out, I visited my friendly B of A.
"I recently had fraud on my checking account," I told them. "Here's the paperwork proving that this is what happened."
"Okay," they said, "we first recommend
Re: (Score:2)
There's a problem with banks and credit cards: with many online merchants, all you need to make a purchase is the card number and expiry date. That wouldn't be too bad, except that most banks issue credit cards in contiguous blocks with the same expiry date. So if you start with a known-good credit card, you can increment or decrement the card number (modulo the Luhn algorithm [wikipedia.org]), keeping the expiry date the same, and get a lot of hits.
You could keep your card in a lead-sealed box buried under your house a
Identity Theft (Score:1)
HOWEVER
I understand the problem differently - the TYPE of people at the bigger banks are MORE likely to be victims because of the mindset they have - they're unwilling to take the difficult steps of preserving personal information!
In canada, we have a different banking system, there are only five (or six, depending on what you consider as BIG) banks that most everyone uses. Several of
Re: (Score:3, Insightful)
I've had to write nasty letters to employers, brokers, and banks because they constantly put SSN on statements. Mail theft isn't that uncommon in larger cities (happened to my room mate once and sometimes I get important mail that appears to have been opened) so even though one could shred everything you cannot prevent someone from
Re: (Score:2)
It also appeared that someone at the USPS was actually the one doing since the mailboxes are locked. How can you protect yourself against that?
But it's so easy.
Re: (Score:2)
Look at the billing systems (Score:2)
What are they measuring? (Score:2)
Personally I find this whole focus on "web safety" is overrated. I still see lots of people giving their credit card with signature and photo ID (with DL#, DOB, address, etc.) to minimum wage wo
BofA Stinks (Score:2, Interesting)
I'd like some more data (Score:2)
What percentage of the identity theft cases were done by social engineering the banks.
What percentage of the identity theft cases were done by stealing the date from a 3rd party.
Without that information the data is pretty much meaningless and usable only for trending analysis by just looking at the number of total cases.
Kill the editor! (or submitter) (Score:2)
I don't insist that the article titles (or summaries) be perfect, but could they at least have SOME relation to the story itself?
Whatever (Score:2)
Re: (Score:2)
Intresting what you leave out (Score:2)
The guy tried to sell a pair of bikes for 600 dollars, then received a check for 2000 dollars, and tried to cash it in. He then claims he found that suspicious and all, sure he did AFTER THE FACT! It wouldn't look good in court to say "I thought it was my lucky day receiving more then TRIPLE the amount we agreed".
WHOOOP, WHOOOP, WHOOOP! Red FLAG!
The article explains that this is part of a scam and you can't scam an honest person. What honest person would believe that someone sends more then 200% of the pr
Re: (Score:2)
Back when MBNA was s