Group items tagged

Banks and cellphone companies have a long way to go to persuade U.S. consumers to use their cellphones for banking, as many worry about security and extra fees and others are not even aware they can. In a survey of about 500 U.S. consumers, accounting firm KPMG found that only about 9 percent had tried mobile banking. In comparison, about 76 percent "consistently use" online banking services on computers. As many as 95 percent said they were so uncomfortable with conducting financial transactions on their phones that they've never used them to make a purchase on a retailer's Web site. About 48 percent of respondents cited security and privacy worries as their reason for not banking on their cellphones, according to KPMG. While many respondents said they believe mobile banking is important, according to the accounting firm, they do not think it is important enough to pay extra for it. Roughly 19 percent of respondents said they are "somewhat likely" to a use a mobile device for online banking in the next 12 months but only seven percent said are willing to pay a nominal fee for cellphone banking, according to the survey. And even though most of the major U.S. banks offer a mobile banking service, about 68 percent of the survey respondents said their bank does not offer the service. "The fact that the majority of U.S. consumers are not aware that their current banks offer mobile banking is clearly more perception than reality," said Carl Carande, a principal in KPMG LLP's Advisory and Banking and Finance practices. Banks offering mobile services include Citigroup Bank of America and Wells Fargo.

In all of 2008, 40 banking institutions failed - 25 banks and 15 credit unions. So far in 2009, 72 institutions have either been closed or taken over by regulators, including 7 banks just this past weekend. The Federal Deposit Insurance Corporation (FDIC)'s troubled bank list, now at 305, has more than doubled from last year's total, when 117 banks were listed. Which begs the questions: Where and why are all these institutions failing, and how many more closures will we see by year's end? Failures by the Numbers Analysis of this year's bank/credit union failures (see interactive map) reveals some interesting facts: * Total Failed Banks: 64 * Total Failed Credit Unions: 8 o Top States For Failures: o Georgia - 16 banks o Illinois - 12 banks o California - 8 banks, 3 credit unions o Florida - 3 banks * Largest Failure BankUnited, Coral Gables, FL., $12.8 billion in assets, * Total Cost to FDIC Insurance Fund: $13.553 billion

A recent data breach study commissioned by the state of Maine sheds light on the losses banks experienced as a result of the data breaches at TJX and Hannaford Brother's supermarkets. The state's banks said they incurred $2.1 million in expenses related to data breaches since January 1, 2007. The Hannaford breach had the largest impact, affecting 71 financial institutions and incurring $1.6 million in expenses according to the Maine Data Breach Study. Hannaford is based in Scarborough, Maine. The TJX breach accounted for $485,000 in expenses. The report was issued by the Main Bureau of Financial Institutions in November 2008. It studied the impact of data security breaches on Maine banks and credit unions. Fifty credit unions and 25 banks headquartered in Maine responded to the survey. Financial institutions reported more than 18 million records breached last year, according to the Identity Theft Research Center. The San Diego-based nonprofit found that data breach reports across five industry sectors jumped to 656 last year, up 47% from 2007. About 12% of the reports came from financial-services firms, up from 7% in 2007. In Maine, the Hannaford breach resulted in more than $318,000 in gross fraud losses, according to data reported by 22 financial institutions. More than 700 accounts were used to buy items fraudulently, although five of the 22 institutions that suffered a fraud loss did not report the number of accounts, according to the report. The Hannaford breach cost some banks as much as $58,000 to reissue credit cards to customers. Investigation expenses cost nearly $30,000 for some banks. Communication to customers cost nearly $28,000, some banks and credit unions reported. Fraud losses of nearly $45,000 were tied to the TJX data breach. The losses were reported by six financial institutions. The expenses for reissuing credit cards cost some banks as much as $32,000. Investigation expenses were as high as $21,000 for some banks. Communication to custom

"A Texas bank is suing a customer hit by an $800,000 cybertheft incident in a case that could test the extent to which customers should be held responsible for protecting their online accounts from compromises. The incident, which was first reported by blogger Brian Krebs this week, involves Lubbock-based PlainsCapital bank and its customer Hillary Machinery Inc. of Plano. In November, unknown attackers based in Romania and Italy initiated a series of unauthorized wire transfers from Hillary's bank accounts and depleted it by $801,495. About $600,000 of the amount was later recovered by PlainsCapital. Hillary demanded that the bank repay it the rest of the stolen money. In a letter to the bank in December, Hillary claimed that the theft happened only because PlainsCapital had failed to implement adequate security measures. PlainsCapital promptly filed a lawsuit in the U.S. District Court for the Eastern District of Texas asking the court to certify that its security procedures were "commercially reasonable." In its complaint, the bank noted that it had made every effort to recover the stolen money."

Bank sues theft victim in pre-emptive strike

Is your bank on the list?

Failed Banks Thirty-six banks have failed this year, up from the 25 that shut down in 2008, which included Washington Mutual, the largest bank failure in US history. While the banks that have closed this year are not as large as WaMu, there have been some substantial banks that failed with assets in the billions. Click on to find out which of them rank as the 10 largest failures so far in 2009. Source: FDIC Posted June 4, 2009 »Slideshow: Largest Bankruptcies »Slideshow: World's Safest Banks

"A New York computer technician has been charged with stealing the identities of more than 150 Bank of New York Mellon employees and using them to orchestrate a scheme that netted him more than $1.1 million, prosecutors said this week. Adeniyi Adeyemi, 27, of Brooklyn was indicted Wednesday on charges of grand larceny, identity theft and money laundering for crimes allegedly committed between Nov. 1, 2001 and April 30, 2009, according to a news release from Manhattan District Attorney Robert Morgenthau. According to prosecutors, Adeyemi, who was employed as a computer technician working at the headquarters of Bank of New York, stole the personal information of dozens of bank employees, primarily from individuals in the information technology department. He then used the identities to open bank and brokerage accounts, which served as "dummy accounts" to receive stolen funds. Adeyemi then stole money from the bank accounts of numerous charities and nonprofit organizations, and transferred the funds into the dummy accounts, which he later withdrew or transferred to other accounts, prosecutors said."

A former IT analyst at the Federal Reserve Bank of New York and his brother were arrested Friday on charges that they took out loans using stolen information, including sensitive information belonging to federal employees at the bank. Prosecutors allege that Curtis Wiltshire, 34, took out student loans totalling US$73,000 using the stolen information. His brother, Kenneth Wiltshire, 40, is charged with using the identities of two federal employees to try and obtain a loan for a 2006 Sea Ray 340 Sundancer speedboat. The charges (pdf) come two months after federal investigators found two 2006 student loan applications on a thumb drive attached to the work computer of Curtis Wiltshire, who had worked at the Reserve Bank for nearly eight years as an information and technical analyst. According to court documents, that investigation was unrelated to the fraud charges. Wiltshire was dismissed soon after the drive was found on around Feb. 15, prosecutors said. The charges were filed in the federal court in Manhattan. The two men could not be reached for comment Friday and the names of their lawyers were not included in the court documents. Curtis Wiltshire had "access to computer files containing information about employees of the [federal bank], including their names, dates of birth, Social Security numbers, and photographs," U.S. Federal Bureau of Investigation Special Agent Cordel James said in an affidavit filed in the case. Curtis Wiltshire was charged with bank fraud and identity theft and faces more than 30 years in prison if convicted. His brother was charged with mail fraud and identity theft and faces a maximum of 22 years in prison.

"Identity theft can happen to anyone," is the frequent refrain of government and advocacy groups warning consumers about bank fraud. What they don't add: The crime is far more likely when that "anyone" is a woman. A study released Monday by the fraud-tracking firm Javelin Research showed that women are 26% more likely than men to be the victims of identity theft. While 3.8% of men had their banking details stolen and used for fraud in the last year, 4.8% of women were victimized. And women took far longer on average to discover their financial identities had been compromised, leading to far greater risk of repeat fraud: Women took 83 days to detect they'd been targeted, compared with 45 days for men. The growing reason behind this disparity, argues Javelin President James Van Dyke, is an often-misunderstood trend: Digital commerce is making identity theft harder, rather than easier. Because men are statistically more likely than women to adopt newer technologies such as online banking and shopping, they more often have the benefit of high-tech safeguards, Van Dyke says. Women, because of their lesser use of Web banking and sales, suffer from more old-fashioned fraud caused by stolen credit cards or retail employees, he says. Fifty-eight percent of women, for instance, have never banked online, compared with 55% of men, according to Javelin's study. That means women are less likely to sign up for fraud protection programs like text message or e-mail alerts that warn of abnormal transactions. Twenty-three percent of men use e-mail alerts, compared with 15% of women; 8% of men receive text message warnings, compared with just 3% of women.

The following is an excerpt from the book The Truth About Identity Theft. In this section of Chapter 11: Social Engineering (.pdf), author Jim Stickley explains how easy it really is to hack a password. People often ask me how hard it is to hack a password. In reality, it is rare that I ever need to hack someone's password. Though there are numerous ways to gain passwords on a network and hundreds, if not thousands, of tools available to crack encrypted passwords, in the end I have found that it is far easier to simply ask for them. A perfect example of this type of attack was a medium-sized bank that I was testing recently. The bank's concern was related to the new virtual private network (VPN) capabilities it had rolled out to a number of its staff. The VPN allowed staff to connect directly to their secured network while at home or on the road. There is no doubt that a VPN can increase productivity, but there are some pretty major risks that can come with that convenience. The bank explained that the VPN was tied into its Active Directory server. For people who are not technical, basically this just means that when employees log in via the VPN, they use the same credentials they use to log on to their computer at the office. So I went back to my office, sat down, and picked up the phone. The first call I made was to find out the name of an employee in the IT department. I called the company's main line to the bank, pressed 0, and asked to speak with someone in the IT department. I was asked what I was calling about, so I told the employee I was receiving emails from that bank that seemed malicious. I could have used a number of excuses, but I have found that if you tie in an unhappy customer with a potential security issue, your call gets further up the food chain. In this case, I reached a man who I will call Bill Smith. I made up a story about the email, and after a few minutes, he was able to explain to me that I had called the wrong bank and it was actuall

From 2003 to 2007, there were 10 bank failures in the U.S. In 2008 that number more than doubled, reaching 25. 2008's lowlight was the collapse of Washington Mutual on September 25--the biggest bank failure in American history. Thus far, 13 banks have failed in 2009.

A coalition of privacy groups today urged the Obama Administration to defend California's landmark financial privacy law against the banking industry's legal efforts to overturn it. The US Supreme Court is currently considering taking up the banks' appeal of a 2008 decision by the 9th Circuit Court upholding almost all provisions of the Financial Information Privacy Act of 2003 (SB 1 - Speier). On March 9th, the Supreme Court invited the Obama Administration to voice its opinion on the California privacy law. The case is American Bankers Association v. Brown, Supreme Court Docket Number 08-730. Letters to President Obama and Solicitor General Elena Kagan were signed by The Consumer Federation of California, Privacy Rights Clearinghouse, CALPIRG, Consumers Union, Consumer Action, The Older Women's League, The California Alliance for Retired Americans, and Chris Larsen, Propser Marketplace, and founder of Californians for Privacy Now, the organization that spearheaded a 2003 ballot initiative campaign that turned fierce banking industry opposition into acquiescence with SB 1. "This represents a defining moment for privacy rights" the letter states. We ask you to stand with consumers by telling the Supreme Court to reject the banks' appeal in Brown." Privacy advocates support the State of California's position in this legal matter, which is that there is no merit to the appeal filed by the American Bankers Association. At issue is whether federal laws preempt portions of California law that regulate the sharing of private consumer information within a financial institution's family of affiliates.

Chase Bank has sent out data breach notification letters to an undisclosed number of customers after a computer tape with customers' personal information was reported missing from a third-party vendor's storage facility. Tom Kelly, spokesperson for New York-based Chase, the commercial/consumer banking arm of financial giant JPMorgan Chase, says the vendor -- which he would not name -- confirmed it received and maintained the tape, and that its offsite facility had been searched thoroughly after the tape disappeared. Kelly would not say if the data on the tape was encrypted, but says its data can be read only with special equipment and software. "We have no evidence to indicate any of the information has been viewed or used inappropriately," Kelly says. A local ABC News station in Louisville, KY first reported the missing data tape and the notification letters being sent in August. Kelly says the notification letters are being sent out in batches, but would not say how long the tape has been missing, nor what type of customers' information (credit or banking) was on the tape. The electronic files, according to the notification letter, may have included names, addresses and Social Security numbers, but did not include any banking or financial information. Affected customers are being offered a free one-year subscription to the bank's identity protection program, Kelly says. For more information on 2009 data breaches involving financial institutions, see this interactive timeline

"A new study from the Pew Charitable Trust has found that every one of the credit cards offered by the country's 12 largest credit card issuers are bad deals for consumers and have practices the Federal Reserve has defined as "unfair or deceptive." The Trusts' Health Group's Safe Credit Cards Project, titled STILL WAITING: "Unfair or Deceptive" Credit Card Practices Continue as Americans Wait for New Reforms to Take Effect also compared credit union card programs and found them sharply better. "Although credit unions control only a small portion of credit card outstandings, comparisons between credit union and bank product models illustrate options available to consumers and potential benchmarks for future regulatory rulemaking efforts," the organization said. The observed credit unions presented a distinct alternative to credit card pricing and other practices of the observed banks, the report said. "In July 2009, median advertised interest rates on cards from the 12 largest credit unions were between 9.90 and 13.75% annually, depending on a consumer's credit profile-approximately 20% lower than comparable bank rates," the report said. "Meanwhile, credit union penalties were generally less severe than those of banks." "

Bank of America will pay Connecticut $350,000 as part of a settlement for a data breach by Countrywide Financial Corp., which the bank acquired last year, state officials said Thursday. The bank will also provide at least $25,000 to reimburse Connecticut residents forced to pay for freezing and unfreezing their credit reports because of the breach, Attorney General Richard Blumenthal said. The major credit bureaus, Experian, Equifax and TransUnion, charge about $10 to freeze and unfreeze credit reports. Affected consumers will receive about $60 for credit freezes and unfreezes for all three credit bureaus, Blumenthal said. Nearly 30,000 state residents were affected by the nationwide breach, which came to light last August after the FBI arrested a former Countrywide employee on charges of selling personal information, including Social Security numbers, for as many as 2 million loan applicants. To be reimbursed, consumers must send proof of payment for their credit freezes and unfreezes to Blumenthal's office, 110 Sherman St., Hartford, CT 06105, attn: Countrywide Credit Freeze.

A third (34 per cent) of discarded hard disk drives still contain confidential data, according to a new study which unearthed copies of hospital records and sensitive military information on eBayed kit. The study, sponsored by BT and Sims Lifecycle Services and run by the computer science labs at University of Glamorgan in Wales, Edith Cowan University in Australia and Longwood University in the US, also found network data and security logs from the German Embassy in Paris on one purchased drive. Researchers bought 300 drives from eBay, other auction sites, second-hand stalls and car boot sales. A disk bought on eBay contained details of test launch routines for the THAAD (Terminal High Altitude Area Defence) ground to air missile defence system. The same disk also held information belonging to the system's manufacturer, Lockheed Martin, including blueprints of facilities and personal data on workers, including social security numbers. Lockheed Martin denies that the disk came from it. The arm manufacturer has launched an investigation that aims to uncover just how the sensitive data might have been wound up on the disk. Two discs bought in the UK apparently came from Lanarkshire NHS Trust, including patient medical records, images of X-rays and staff letters. Lanarkshire NHS Trust runs the Monklands and Hairmyres hospitals. In Australia, the exercise turned up a disk from a nursing home that contained pictures of actual patients and their wound photos, along with patient details. A hard disk from a US bank contained account numbers and details of plans for a $50bn currency exchange through Spain. Details of business transactions between the bank and organisations in Venezuela, Tunisia and Nigeria were also included. Correspondence between a member of the Federal Reserve Board and the unnamed banks revealed that one of the deals was already under scrutiny by the European Central Bank, and that federal investigators were also taking an interest. Yet anothe

TJX Companies Inc. has agreed to pay $525,000 to settle a lawsuit brought by several banks in connection with the massive data breach disclosed by the retailer in January 2007. The money will reimburse AmeriFirst Bank, HarborOne Credit Union, SELCO Community Credit Union, and Trustco Bank a portion of the expenses they incurred in connection with the breach, TJX said in a statement. As part of the agreement, the banks will drop all other claims against TJX. The discount retailer admit no wrongdoing. The settlement money is part of the $118 million the company had set aside in the second quarter of 2007 to cover breach related costs.

Americans are about to re-learn that bank deposit insurance isn't free, even as Washington is doing its best to delay the coming bailout. The banking system and the federal fisc would both be better off in the long run if the political class owned up to the reality. We're referring to the federal deposit insurance fund, which has been shrinking faster than reservoirs in the California drought. The Federal Deposit Insurance Corp. reported late last week that the fund that insures some $4.5 trillion in U.S. bank deposits fell to $10.4 billion at the end of June, as the list of failing banks continues to grow. The fund was $45.2 billion a year ago, when regulators told us all was well and there was no need to take precautions to shore up the fund.

In an indication of the legal troubles that companies can find themselves in over data breaches these days, several banks and credit unions have begun suing Heartland Payment Systems Inc. over its recently disclosed data breach. In the six weeks since the potentially massive breach was disclosed, eight banks and credit unions have filed lawsuits against Heartland over its alleged failure to take adequate measures for protecting credit and debt cardholder data. Heartland said on Jan. 20 that unknown intruders had broken into its network sometime last year and accessed payment card data belonging to an undisclosed number of customers. The breach, thought to possibly be the biggest ever disclosed, has already affected over 500 financial institutions, including a handful in the Bahamas, Bermuda and Canada. The lawsuits seek compensation from Heartland for the costs that the financial institutions said they've had to bear in notifying affected customers about the breach and in reissuing new payment cards. The lawsuits also claim damages from Heartland for costs of the alleged fraud that the banks claimed have resulted from the breach.

DAVOS, Switzerland (Reuters) - Two years ago anyone uttering the words "state" and "regulation" in the same sentence would have been sneered at in high-powered banking circles gathered by the ski slopes of Davos. Now, more than 18 months into the biggest financial upheaval in the last eighty years, those bank executives that still have jobs are preparing to swallow large doses of regulatory medicine to help cure a crisis they are accused of causing. With bank lending still frozen, the world sliding into recession and more than 300,000 financial jobs already gone, policymakers are replacing bankers in the driving seat at this year's World Economic Forum (WEF) to discuss short- and long-term solutions to the sector's woes. "Two years ago nobody could see the problems and the risks," said Marc Weil, head of EMEA Financial Services at consultancy firm Oliver Wyman, which is publishing a report on the state of the global financial services industry this week. "It is clear now that the financial services industry is like no others and anyone that poses systemic risks needs tighter regulation."

Government Information Security Podcasts Credit Eligible As a GovInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info Heartland Breach -- What it Means to Banking Institutions: James Van Dyke, Javelin Strategy & Research January 29, 2009 The Heartland Payment Systems data breach - it's the first major security incident of 2009. But how big is it really? What are the key takeaways for banking institutions left explaining this breach to their customers? In an exclusive interview, James Van Dyke, Founder and President of Javelin Strategy & Research, discusses the implications of the Heartland case, offering insight on: Conclusions we can draw from the Heartland breach; How banking institutions should communicate with their customers; Vulnerabilities we should watch to avoid the next big breach. Van Dyke is founder and president of Javelin Strategy & Research. Javelin is the leading provider of independent, quantitative and qualitative research for payments, multi-channel financial services, security and fraud initiatives. Javelin's clients include the largest financial institutions, card issuers and technology vendors in the industry.