Home > News & Events > Financial Institution Letters
Financial Institution Letters
The Gramm-Leach-Bliley Act (GLBA) directs the Federal Deposit Insurance Corporation (FDIC) and other federal banking agencies to review their regulations and guidelines to ensure that financial institutions have policies, procedures and controls in place to prevent the unauthorized disclosure of customer financial information and to deter and detect fraudulent access to such information. Consistent with section 525 of the GLBA (15 U.S.C. 6825), the FDIC has developed the following guidance to address how banks should protect customer information against identity theft. Guidance is also included on completing Suspicious Activity Reports (SARs) to report offenses associated with identity theft and pretext calling, i.e., posing as a customer or someone authorized to have customer information in order to obtain confidential customer data.
Several federal criminal statutes address illegal conduct associated with identity theft and pretext calling. These include:
Institutions are reminded of guidance recently issued by the FDIC and the other banking agencies concerning the safeguards financial institutions can put into place to help prevent the problems caused by pretext calling.
Protecting Customer Information
Banks should take various steps to safeguard customer information and reduce the risk of loss from identity theft. These include: (1) establishing procedures to verify the identity of individuals applying for financial products; (2) establishing procedures to prevent fraudulent activities related to customer information; and (3) maintaining a customer information security program.
1. Verification Procedures. Verification procedures for new accounts should include, as appropriate, steps to ensure the accuracy and veracity of application information. These could involve using independent sources to confirm information submitted by a customer; calling a customer to confirm the customer has opened a credit card or checking account; using an independently verified telephone number; or verifying information through an employer identified on an application form. A financial institution can also independently verify the zip code and telephone area code provided on an application are from the same geographical area.
2. Fraud Prevention. To prevent fraudulent address changes, banks should verify customer information before executing an address change and send a confirmation of the address change to both the new address and the address of record. If a bank gets a request for a new credit card or new checks in conjunction with a change of address notification, it should verify the request with the customer.
When opening a new account, a bank should, where possible, check to ensure information provided on an application has not previously been associated with fraudulent activity. For example, if a bank uses a consumer report to process a new account application and the report is issued with a fraud alert, the bank's system for credit approval should flag the application and ensure the individual is contacted before it is processed. In addition, fraud alerts should be shared across the bank's various lines of business.
3. Information Security. On February 1, 2001, the federal banking agencies issued guidance on the security of customer information ("Interagency Guidelines for the Safeguarding of Customer Information by Financial Institutions," 66 Fed. Reg. 8616 (February 1, 2001) (the "Guidelines")).
The Guidelines require financial institutions to implement a comprehensive information security program that includes appropriate administrative, technical, and physical safeguards for customer information. To prevent pretext callers from using pieces of personal information to impersonate account holders in order to gain access to their account information, the Guidelines require banks to establish written policies and procedures to control access to customer information.
Other measures that may reduce the incidence of pretext calling include limiting the circumstances under which customer information may be disclosed by telephone. For example, a bank may not permit employees to release information over the telephone unless the requesting individual provides a proper authorization code (other than a commonly used identifier). Banks can also use Caller ID or a request for a call back number as tools to verify the authenticity of a request.
Banks should train employees to recognize and report possible indicators of attempted pretext calling. They should also implement testing to determine the effectiveness of controls designed to thwart pretext callers, and may consider using independent staff or third parties to conduct unscheduled pretext phone calls to various departments.
Reporting Suspected Identity Theft and Pretext Calling
Banks are required by regulation to report all known or suspected criminal violations to law enforcement and regulatory agencies on SARs. Criminal activity related to identity theft or pretext calling has historically manifested itself as credit or debit card fraud, loan or mortgage fraud, or false statements to the institution, among other things.
As a means of better identifying and tracking known or suspected criminal violations related to identity theft and pretext calling, a bank should, in addition to reporting the underlying fraud (such as credit card or loan fraud) on a SAR, also indicate within the SAR that such a known or suspected violation is the result of identity theft or pretext calling. Specifically, when identity theft or pretext calling is believed to be the underlying cause of the known or suspected criminal activity, the reporting institution should, consistent with the existing SAR instructions, complete a SAR in the following manner:
In June 2000, the FDIC issued the Federal Trade Commission (FTC) consumer education pamphlet entitled "ID Theft: When Bad Things Happen To Your Good Name" and published an article on identity theft in the Summer 2000 issue of FDIC Consumer News. The Appendix provides a complete listing of FDIC publications relating to these topics and instructions on how to obtain them. Also, the FDIC's Web site, www.fdic.gov, is periodically updated to contain the latest information on these topics. Another excellent source of information for consumers is the U.S. government's central Web site for information about identity theft maintained by the FTC, www.consumer.gov/idtheft. Banks may wish to make available to their customers information about how to prevent identity theft and necessary steps to take in the event a customer becomes a victim of identity theft.
Banks should assist their customers who are victims of identity theft and fraud by having trained personnel to respond to customer inquiries; by determining whether an account should be closed immediately after a report of unauthorized use; and by prompt issuance of new checks or new credit, debit or ATM cards. If a customer has multiple accounts with the institution, it should assess whether any other account has been the subject of potential fraud.
APPENDIX: LIST OF AGENCY ISSUANCES REGARDING INFORMATION SECURITY
Below is a list of FDIC publications regarding or related to identity theft and pretext calling. These documents may be accessed at the FDIC's Web site (www.fdic.gov) or (except as indicated below) in the FDIC Public Information Center, Room 100, 801 17th Street, NW, Washington DC 20429. Banks are encouraged to familiarize themselves with the contents of each issuance.
|Last Updated firstname.lastname@example.org|