Identity theft study reveals HSBC, BofA, Wamu top targets
Customers of HSBC, Bank of America, and Washington Mutual suffer the highest rates of identity theft in the banking industry, according to an investigative study released Wednesday by a UC Berkeley Law School researcher.
The Federal Trade Commission received over 245,000 reports of identity theft in 2006, but does not typically publish the names of the financial firms and companies listed in the reports. Through an extensive Freedom of Information Act request, Chris Hoofnagle, a staff attorney at UC Berkeley's Boalt School of Law, was able to get detailed records on the individual consumer complaints.
Hoofnagle received detailed information for three randomly chosen months in 2006: January, March, and September. These months included data from 88,560 complaints, with 46,262 names of institutions identified by victims.
Estimated Annual Incidents Per Billion in Deposits Among Largest US Banks (2006)
(Credit: With permission from Chris Hoofnagle)Once he crunched the numbers, Hoofnagle discovered that HSBC has the highest rates of reported identity theft in the financial industry during 2006, when adjusted for billions of dollars in deposits. Bank of America and Washington Mutual came in a close second and third. According to Hoofnagle's stats, HSBC had 21 incidents of identity theft per billion dollars in deposits, Bank of America/MBNA had about 17, while Washington Mutual had 16. Online banking leader ING had the lowest rates in the industry, with just a single reported incident.
Technically, American Express and Capital One lead the pack--with 485 and 242 respective incidents per billion dollars in deposits. However, Hoofnagle excluded them from the graph due to the small scale of each company's banking operation (Amex's 7 billion in deposits compared with Bank of America's nearly 760 billion).
Outside of the financial services sector, telecom giants AT&T and Sprint suffered from more than 9,100 and 8,300 estimated reported cases of identity theft. As the firms do not publish the numbers of customers they serve, it was impossible for Hoofnagle to break these numbers down further.
While the FTC incidents that Hoofnagle examined were from 2006, a number of recent reports indicate that HSBC has recently been overwhelmed with a "a wave of banking fraud." Real numbers to back up these reports will not be available from the FTC for some time.
The levels of theft described by Hoofnagle's match up nicely with a 2007 report released by Cambridge University researchers, which revealed that Bank of America and Washington Mutual took the longest time to shut down phishing sites targeting the banks. Sites masquerading as BofA and Wamu typically stayed online for more than 100 hours, compared with less than two days for Chase and PayPal.
Finally, while the FTC publishes an annual identity theft report, it is not required to break down its figures and reveal the names of the most frequently victimized banks. While states like California have been able to pass significant pro-consumer data breach legislation, this is one area where states have little power. Incidents of identity theft are primarily reported to the FTC, and not to state attorneys general. To force the FTC to voluntarily publish such data, federal legislation will be required--something that is unlikely to happen.
Hoofnagle's 16-page study, with detailed numbers and graphs, can be found here.
Christopher Soghoian delves into the areas of security, privacy, technology policy and cyber-law. He is a student fellow at Harvard University's Berkman Center for Internet and Society , and is a PhD candidate at Indiana University's School of Informatics. His academic work and contact information can be found by visiting www.dubfire.net/chris/. He is a member of the CNET Blog Network, and is not an employee of CNET. Disclosure.
I have been learning that they are a really crappy lender since I took that loan. Apparently they don't just have a high rate of ID theft, but they are also shistey about changing the rate on "fixed rate" credit and not obeying minimum payment agreements on loans.
(Agree to a low introductory rate + fixed low minimum payment for X months of a 4X month loan= minimum payment will almost double the SECOND MONTH!! ***!?!)
I would avoid this bank like the plague, I am going to pay off my loan ASAP! (Fortunately it was just financing on a scooter so I should be able to pay it off in about 3 months!)
They outsource the Customer Service calls to India etc. The call centers are packed with operators sitting so closely that you can hear the activity of several accounts. I am a captive audiance to numerous conversation where I can hear not only the operators but the customers they are talking to. There are obviously no cubicles and if so they are not to ensure privacy. Also they are trained with such canned answers that it is impossible to have a logical constructive conversation.
It is a HSBC is a Pygmy Bank !
On Jan. 1, a new Federal Reserve Board regulation went into effect to combat this lack of knowledge. The rule gives bankers until November to implement ID theft protection programs that meet the Fed?s requirements, which require ?reasonable policies and procedures? for preventing ID theft, identifying ?red flag? activities, and notifying victims.
And the introduction of new and improved ID theft detection and prevention tools will help increase awareness, too. In a few weeks, my company is going to announce a new technology banks can use to protect their depositors. Essentially it will compare the location of the depositor (determined via their cell phone) with the location of the credit card transaction. If the two don?t match, the transaction is flagged so it can be checked out immediately.
My advice to banks: The ID protection space is huge and there are many different vendors and services, but you need to start researching and seriously consider implementing one. That?s the best way for them to protect their customers, and themselves.
Bryan Ansley
BAnsley@FNBmerchants.com
http://SecureIdentitySystems.com.
-
by smsdes
April 21, 2008 10:03 AM PDT
- Had heard of the Bof A and WaMu problems, but never thought it would hit home.
-
Reply to this comment
-
(10 Comments)My husband was checking our monthly online statement and saw 2 new accounts setup. he figured it was a glitch, but an hour later the accounts had taken $30,000 from a line of credit at Bof A and had then transfered $10,000 to a Wamu Account!!!
We are now fighting to get all the info and have had the police in our home for reports and lost time from work to deal with the banks.
Its more than just a simple crime,It effects the persons life for years!
I am on the west coast,and the theives from wha twe could tell are on the East coast.
I would love to hop a plane and personally hunt them down!!