Financial organizations must make vigorous response to ID theft concerns

by Mark Vernon | Jul 01, 2005 7:00:00 PM

Tags: Outsourcing, Financial services, Mark Vernon, financial, identity theft, bank, security, Financial Service IT Newsletter

Takeaway: Financial services companies must take aggressive steps to mitigate the consequences of ID theft after an avalanche of consumer data loss and bad publicity. Mark Vernon reports on what leading security analysts are recommending to combat the problem.

Identity theft has been in the headlines again in recent weeks in both the United States and in the United Kingdom, where an undercover reporter from one tabloid newspaper, The Sun, was promised the details of thousands of bank accounts from a computer engineer in an Indian call center. It led to a police investigation and left a series of banks—including Lloyds TSB, Barclays, Woolwich, and HSBC—with a PR nightmare on their hands.

The British consumer watchdog Which? earlier reported that a quarter of UK adults have had their identity stolen or know somebody who has been a victim of ID fraud. It is costing the country an estimated £1.3 billion ($2.3 billion) a year.

In the United States, the FBI was recently contacted after a computer hacker was rumored to have broken into more than 40 million credit card accounts. MasterCard International confirmed a breach traced to a transaction processing company in Atlanta.

"Close to 60 percent of U.S. consumers sampled in January 2005 expressed that they were worried about identity theft, and close to 6 percent admitted to switching banks to reduce their risk of becoming a victim of identity theft," says Sophie Louvel, a research analyst with Financial Insights' Consumer Banking practice. "Identity theft incidents have been taking their toll on banks and their customer relationships. Recent high-profile incidents of customer data theft at Bank of America, ChoicePoint, and LexisNexis will drive bank customers to worry further about the possibility of experiencing identity theft. But our survey results show that not all consumers worry about identity theft equally, and the crime does not impact all consumers across the U.S. at the same rate."

Having said that, what is required is strategy for dealing with ID theft. Paul Henry, an IT security industry expert with CyberGuard Corporation, has a list of recommendations for enterprises to ensure that their customer data is not compromised.

"A strong security policy must be put in place and followed vigorously," he says. "Then you must be extremely careful to ensure that the companies you outsource data to fully support the policies, procedures, and technical safeguards you have put in place to protect your client's personal information." His point is that a chain is only as strong as its weakest link: banks must not let their outsourcing partners become that weak link. This goes beyond perimeter security to include physical security, as well as both access and application controls. "We are starting to see this problem in India, and unless enterprises are diligent about protecting their data, it will explode out of control like identity theft," he believes.

Henry has two tips in particular:

• Firms that outsource their data to call centers should ensure that the security policy, procedures, and technical safeguards utilized by the outsourcing partner are equal to or better than their own;
• Both regular and random risk assessments should be carried out at any outsourcing center, especially if it is located in a high-commercial risk area—where bribery and corruption are endemic. Risk assessments should cover all domains of network security and should not be limited to gateway security.

Louvel believes that a security strategy must go even further than that. Recent data theft incidents prove that not only must financial organizations and other businesses enhance security around data access, they must take a look at mitigating the consequences of theft, once it happens. "While security must be improved, it will never be so strong that data theft becomes impossible," she warns. "Just as important is ensuring that when data is stolen it is not used to commit fraud. Effectively preventing criminals from using identity information requires a technology and organizational infrastructure for cooperation and data-sharing between creditors across industries, data brokers, and law enforcement agencies." Moves in this direction are being made with new bills being proposed, including a bipartisan bill that would make business leaders responsible for data leaks from their companies and rules set by regulating agencies, such as the Federal Trade Commission.

Stay up to date with the latest IT news and information affecting the world of finance with TechRepublic's free Financial Services IT newsletter, delivered each Wednesday. Automatically sign up today!