Skip Header

Federal Deposit
Insurance Corporation

Each depositor insured to at least $250,000 per insured bank



Home > Regulation & Examinations > Laws & Regulations > FDIC Federal Register Citations




FDIC Federal Register Citations

via email

Comments on Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice

From Mary P. Kirwan
Security & Risk Consultant
Toronto, Ont., Canada

General Comments

In a recent survey conducted by the US Federal Trade Commission (FTC), the extent of the problem of identity theft was laid bare for the first time. It revealed that 27.3 million Americans had been victims of identity theft in the last five years, with 9.9 million alone in the past year.

These staggering numbers dwarfed all previous estimations of the problem, and caught even seasoned observers by surprise.

The cost to business, especially the financial services sector, appears to be enormous. The FTC survey estimated the damage to be in the region of US$48 billion. The credit card companies have been criticized for not doing more to prevent identity thefts. Retailers have been particularly vocal about their concerns because they suffer as a result of ‘charge backs from the card issuers in ‘card not present’ transactions, such as Internet and telephone transactions.

Many small retailers are unable to provide credit facilities to customers due to their exposure to various types of Internet fraud, as they are ill equipped to cope with the increasingly sophisticated nature of the crime.

Consumers are also paying dearly. They are often forced to mop up the problem themselves. According to the FTC survey, victims bear out of pocket expenses of approximately US$5 billion to clear up credit histories and good names, and put their lives back together again. Frequently, victims are pursued by debt collectors and institutions that care little about the true identity of the individuals responsible for running up myriad unauthorized charges. Many victims have had their credit ratings and lives destroyed.

In the FTC survey, most of the victims (76 per cent) indicated that existing credit card accounts had been misused, and more than half of the victims (52 per cent) spotted the problem themselves. Only 26 per cent were notified by the banks or credit card companies, and an unfortunate eight per cent only found out when they had credit applications turned down.

Many victims do not find out that their sensitive data has been compromised until well after the fact. As a result, their ability to take steps to protect themselves against the consequences of the crime has been severely compromised. The window of opportunity for the thieves to use the stolen information is often tight, and time is of the essence if victims are to protect themselves. They can do little if they do not know the crime has occurred.

There may be a trend emerging for regulators to mandate reporting of security breaches in situations where identity theft is foreseeable. For example, SB 1386 in California mandates reporting to customers in defined circumstances, where they are at risk as a result of a security breach, unless the data is encrypted.

Statutes such as these are controversial, as companies, regardless of sector, or indeed size, have proven to be extremely reluctant to report security breaches to those affected, usually the actual data owner, for fear of negative publicity and market sentiment, and loss of customer confidence. Companies’ reluctance to report security breaches results in a lack of reliable data to reflect the extent of the security problem. This in turn feeds perceptions in many circles that the problem is over hyped by the vendors (selling security products mainly through so- called FUD (fear, uncertainty and doubt) marketing.

However, there is a growing realization globally that the risk is escalating, and that it has the potential to negatively impact consumer confidence, at a time when consumers are driving growth in many sectors, and without whom the economy would be moribund.

Specifics:

I am doubtful as to whether reference to ‘substantial harm or inconvenience to the customer’ is sufficiently precise terminology to be workable for all concerned. Does it mean ‘substantial harm’ or ‘substantial inconvenience’ or mere ‘inconvenience’ alone? What is meant by ‘inconvenience’? This is a most subjective term. I believe this definition needs work - even ‘harm’ on its own would be better. Or the legal term ‘loss or damage’, which is at least well defined in case law.

And what is ‘substantial’? If the concern is the potential for identity theft, the customer may be forced at a minimum to cancel accounts, scour statements and charges, but in hard cases, may be forced to fight off debt collectors, law enforcement (when falsely arrested as result of thief committing crimes in his/her name), etc. More attention needs to be given to understanding the harm that the Guidelines seek to prevent and/or mitigate. The real concern to the customer is that they may suffer actual financial loss, and/or detriment to their credit rating and reputation in the community. In addition, a case of stolen/compromised sensitive data may result in considerable embarrassment to a customer – and in of itself merit mandatory reporting.

Customer Notice

I am a little concerned that the requirement to alert customers, when an institution ‘becomes aware’.. ..unless…etc’ is also imprecise. How is this level of awareness established after the fact? Who must become aware? The CIO/CSO, guy in the mailroom? There may be issues around when exactly the notification requirement has been triggered that perhaps should be teased out.

I am also concerned that the proviso allowing non notification is vague. What is ‘an appropriate investigation’? Of what duration? Involving whom? If the institution is not equipped/sufficiently resourced or skilled to carry out the investigation, should a TP be engaged? In determining that misuse is ‘unlikely to occur’, what does this mean? It is my understanding that this is the current de facto reasoning used by many financial institutions when they fail to advise customers of incidents of unauthorized access. In my view this leaves considerable discretion to interpret the provisions in accordance with short term cost considerations, which flies in the face of the intention of the Guidelines.

Other comments:

Banks increasingly moving from PKI/certs for online banking to one way SSL – new phishing attacks a concern here also. For SSL purposes, identification information often quite lax- mother’s maiden name, favorite artist, DOB, etc, etc. Sensitive information should be any data required by a bank for a customer to enter site/online banking, and certainly SIN, drivers license - any combination of data identity thief can use to build false identity. There is a possibility that they could build this data over time - for instance an insider might take data piecemeal - perhaps not triggering reporting requirement in any one given instance- but combined effect over time is significant to the customer.

Zero liability policies are widely promoted by the banks to reassure potential online customers of the safety of the medium. However, there is a need for increased co-ordination/information sharing between institutions in cases of identity theft where customer 1 has sensitive data exposed at bank A and is then flagged as a debtor by bank B (where thieves rip off Bank B under customer 1’s identity) – often customers are left hanging out to dry in these situations. Zero liability is useless here.

Surveys show concerns about identity theft making consumers more open to biometrics. FTC reports show consumers unhappy with banks concerning treatment they receive after id theft incidents.

Service Providers

There will be confusion about what level of oversight is required- strict audit rights? Compliance with BS7799 or a similar standard? Will service provider suffer same fate as banks in trying to determine when to notify as per comments above (except one step further removed from the customer). They may fail to notify banks for concerns about QoS commitments/penalties etc.

Corrective measures

Banks are very reluctant to cancel cards- huge expense involved. They often suggest to customer (in my experience) that ‘they should decide’ (the customer). However, mandatory cancellation may be prudent in given circumstances.

Other measures

Removing sensitive numbers from receipts – encrypting all/some digits. Moving like UK to CHIP and PIN.

Concerns

Organized crime etc have banks, TP clearing houses clearly in their sights. Per Symantec in early 2003, decrease in overall volume of attacks in second half of 2002, but sharp increase in volume/severity of attacks on financial services sector. Bugbear B virus/worm targeting sector.

Phantom withdrawal issues and ATMs. Banks forcing customers with disputed withdrawals to displace reverse presumption that ATMs secure – with skimming, secret cameras, insider attacks, more such cases will arise. Difficult for customer to displace such a presumption, although attacks becoming more commonplace.

Last Updated 10/16/2003 regs@fdic.gov

Skip Footer back to content