Banks work to protect electronic records from identity theft

Judging by their marketing, banks’ IT firewalls are as impregnable as the thick lead that lines their vaults. But
in reality, banks fight a constant war against identity theft.

Unfortunately, they don’t win every battle.
So your personal vigilance is by far the bank’s best safeguard against a security breach.

“Identity
thieves are constantly looking for new ways to steal money. Since banks are where the money is, they are, and probably always
will be, the primary targets of thieves,” said Baker & Daniels LLP partner Joan Antokol, who chairs her firm’s
privacy and data management group. “Because identity thieves are increasingly organized and sophisticated, it is likely
that they will look for and continue to find new ways to exploit security vulnerabilities to allow them access to bank accounts.”

About 2 million Americans annually are victims of bank fraud, Antokol said. Their average loss is $1,200. And because
most businesses hold larger balances than individuals, they’re increasingly the target.

In Indiana, there
were 4,598 identity theft complaints last year, according to the Federal Trade Commission. Of those, 822 involved credit card
fraud. Another 487 were for checking and savings account or electronic fund transfer fraud. And 176 involved fraudulent loans.

When it comes to identity theft, the old adage about an ounce of prevention being worth a pound of cure truly applies.
Banks spend millions to establish data safeguards that ensure their servers will be nothing but big electronic bricks if they’re
ever physically stolen.

But only customer education can completely thwart crooks, said Reagan Rick, regional president
of Milwaukee-based M&I Bank. That’s because many scams trick bank customers into unwittingly giving away the electronic
keys to their accounts.

Rick and his colleagues regularly hold security seminars for bank clients or speak to neighborhood
groups about why it’s important to shred bank statements. It’s good business, and not just for customers. Identity
theft raises banking costs for everyone—not only its victims.

“It’s one of those issues where,
if everybody is conscious of it and works to prevent people from [fraudulently] obtaining information, you keep a lot of unnecessary
cost from the system,” Rick said. “It’s one of those costs where you don’t think it will hit you [individually],
but it hits you broadly because it’s passed back broadly.”

To understand why banks get a better bang
for their buck by emphasizing prevention over prosecution, consider Indiana’s recent decision to step up its efforts
against identity theft.

This spring, the General Assembly enacted Public Law 137, which formally established an
identity theft unit in the Indiana Attorney General’s Office. Its challenge—and results so far—show what
banks are up against.

The identity theft unit was formed internally in 2008. Since its resources include just two
attorneys and a pair of paralegals, much of its work focuses on coordinating collaboration among federal authorities, postal
inspectors, local police and county prosecutors. Indiana’s new law granted the unit subpoena authority to help it gather
information more quickly.

In 2008, the identity theft unit opened 359 case files, all originated by consumer complaints,
said Deputy Attorney General Chuck Taylor, who oversees the unit. Another 261 were opened between January and July this year.
The unit has enjoyed most of its success helping victims clean up their credit, closing 226 cases last year and another 228
this year.

But only about 20 percent resulted in a suspect’s being identified. Just 15 led to arrests.

That’s why much of the identity theft unit’s mission is educational. It counsels banks to take extra steps
confirming the identity of patrons. And it guides consumers to be extraordinarily careful with personal information, like
Social Security numbers.

“Protect [personal information] as if it was a $1,000 bill. Don’t just give
it to anybody,” Taylor said. “Make sure it’s something they really need.”

Personal attention
is even more necessary than most consumers realize. That’s because banks don’t protect depositors nearly as much
as most people assume, Antokol said. The FDIC’s $250,000 protection applies in the event of a bank’s insolvency,
she said, but doesn’t cover fraud.

And identity theft scams can occur anywhere. Antokol pointed to the DefCon
security conference in August at the Riviera Casino Hotel in Las Vegas, attended annually by 8,000 security industry leaders.
During the conference, she said, an attendant noticed a suspicious ATM in a portion of the hotel not monitored by security
cameras. Turns out the ATM had been installed by thieves who allowed unsuspecting users to withdraw cash. Meanwhile, the ATM
was copying their account and personal identification number for plundering later.

Antokol is particularly concerned
about the risk of identity thieves’ secretly installing key-logging spyware on individual computers that obtains passwords
when users log on to bank Web sites. Other scams involve “phishing” solicitations for personal information via
e-mail, or “vishing” scams over the telephone.

Citing figures from Bedford, Mass.-based electronic
security firm RSA, she noted that the largest amount of identity theft—up to 50 percent—occurs at regional banks.
Credit unions endure the lowest amount of fraud.

“Thieves work day and night to steal identities and account
information, as well as any other credentials that they can monetize,” she said.

The best defense is personal
vigilance. Antokol counsels bank customers to never share personal information, even if the request seems to originate from
your bank. That sort of verification is only legitimate in response to a banking request you’ve initiated yourself.

She also advises never to use public computers to conduct online banking, and to use credit cards rather than debit
cards at gas stations, or pay cash. Whenever possible, she said, use ATMs at banks rather than in public locations. And both
businesses and consumers should review all banking statements for accuracy. Any improprieties should be reported to the bank
at once.

Taylor, the deputy attorney general, has similar advice.

“Typically, if you’re
talking about how information becomes compromised, it could be a lost wallet or someone who’s careless with giving out
information on the Internet or … over the telephone,” Taylor said. “When that happens, the bank’s
not at fault. The consumer needs to be more prudent.”•