Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Communications Encryption Security

If a Financial Institution Mishandles My Data, What Recourse Do I Have? 224

Posted by Soulskill from the scream-into-the-abyss dept.
grahamsaa writes: My sister recently consolidated her student loans, and the bank e-mailed the paperwork, which included her name, address, date of birth, social security number, drivers license number and bank account information to the wrong e-mail address. The address (a gmail address) is associated with a real person (not her), so someone now has all of her personal details. My sister claims that she read her e-mail address to the bank representative over the phone twice, but that it was transcribed incorrectly.

The real issue is that the bank was willing to use unencrypted e-mail at all to send sensitive information, and I told my sister that at a minimum the bank should cover electronic credit monitoring for her for a minimum of a year, but I feel like that alone probably isn't enough. While my sister should have insisted that they use a more secure means of sending this information, I think it should be the bank's responsibility to ensure that this kind of thing doesn't happen. What kind of recourse does a person in my sister's position have? Did the bank violate any laws (she lives in Connecticut in the United States)? Is there a standard penalty for this kind of thing? I'm not a lawyer, but I know some of you are. What are her options in this case?
This discussion has been archived. No new comments can be posted.

If a Financial Institution Mishandles My Data, What Recourse Do I Have? More

If a Financial Institution Mishandles My Data, What Recourse Do I Have?

Comments Filter:

  • Not a laywer. (Score:5, Informative)

    by Anonymous Coward on Tuesday February 03, 2015 @06:19AM (#48967191)

    You know a lawyer could lose their license if they gave advice to you in this situation (they'd be representing you).

    Your options are: find a lawyer.

    • Or live with amateur advice from people who can't be lawyers by definition.

    • Re: Not a laywer. (Score:4, Funny)

      by Anonymous Coward on Tuesday February 03, 2015 @06:56AM (#48967339)

      CFPB has regulations against sending such info in plain emails. Bank can get seriously fined.

      • I recently filed a complaint with the CFPB for a situation wherein a major bank processed my mortgage application manual entirely via email. They did this because they managed to waste weeks of my time and then lose my first web form based application.

        Well, I get an email response back re: second application and I'm denied because my credit scores are atrocious. This is surprising, so I immediately ask if they can give me more info, and they say no they are legally only allowed to tell me the credit scor

  • Not over the phone (Score:4, Interesting)

    by OolimPhon ( 1120895 ) on Tuesday February 03, 2015 @06:26AM (#48967211)

    I wouldn't give out my email address over the phone.

    This is because it is fairly long and easy to miss-spell.

    Instead, I send an email to the bank, using their email address, and of course my correct addy is then available as Sender.

    This step ensures we both know we are talking to each other.

    This can only help if you are talking to a financial institution.

  • The address (a gmail address) is associated with a real person (not her), so someone now has all of her personal details.

    Since similar usernames can also mean similar full names, it could make identity theft that much easier for that other person bearing a similar name as your sister.

    Anyway, I hope that's not the case, and I hope that other person is not a criminal.

    • Since similar usernames can also mean similar full names, it could make identity theft that much easier for that other person bearing a similar name as your sister.

      On the other hand, the bank should know who they sent that information to. If I was by mistake given the keys to my neighbours home, and the person who gave me the keys knew who they gave them to, I would be an idiot to break into my neighbours house using these keys.

      • the bank should know who they sent that information to.

        If the bank really knew to whom they sent the email, then sure, they'd have suspect number one if anyone looked cross at the victim's credit history. But they only know the email address they sent it too. Not quite the same as a person, and if the account is subsequently closed (and records of said account purged after X months) then the victim could have her identity sold after this date. The bank then calls up the email provider:
        "Hey, we think one of your users is a hackety mchackerson. The email add

    • Since my gmail is just my last name (I got in early). This has been a terrible curse - I get the email of every idiot who shares my last name. I've gotten all manner of things, from filled out job applications to spam. This has to be a common problem.

      • decades ago we had the domain poiuyt.com, I was always amazed at how many people would register at different websites as poiuyt@poiuyt.com and have a password of qwerty! We should have kept the domain just for the pre-paid porn.

    • Don't worry, anytime Gmail sees Bank of America it sent straight to the spam bin! But seriously, my wife has never and will never conduct a credit card transaction over the phone or internet, yet her cards have been fraudulently used 3 times. She also has another woman who lives near by with the same first and last name and same middle initial, her driver's licience and Social Security numbers are only one digit different, we found that out while trying to clear a miss-applied tax lien on our property, I su

  • Technophobic bureaucrats (Score:5, Interesting)

    by GenieGenieGenie ( 942725 ) on Tuesday February 03, 2015 @06:30AM (#48967229)
    One of the main problems here is that people are given these technologies without understanding them completely. When I was working in the US, I made a big fuss once at my workplace about sending sensitive documents in unencrypted emails and was treated like I was hysterical and unreasonable. I managed to coerce the morons in charge to do this, but the incident was turned into a laughing matter from that point on. It's hard to convince drawer-minded bureaucrats to change their behavior when there aren't any regulations, created by other drawer-minded bureaucrats, that specify how it is that they should actually behave. I mean, god forbid, they might need to resort to independent thinking and resolution.

    • Re:Technophobic bureaucrats (Score:4, Insightful)

      by fuzzyfuzzyfungus ( 1223518 ) on Tuesday February 03, 2015 @06:53AM (#48967327) Journal
      Aside from understanding, you also have to care. And not just care; but care enough to overcome the practical inconveniences of doing it properly, especially if everyone around you doesn't understand why you are wasting time with the 'unnecessary' extra steps.

      Depending on the situation, not caring can easily be a greater obstacle than not understanding. This is the major reason why the existence of regulations carries weight. Regulations aren't very educational; but it is very, very, easy to understand 'doing X violates The Rules', while the logic behind The Rules can be of any level of complexity, or nonexistent. On the minus side, this means that arbitrarily stupid practices can be incorporated into The Rules without challenge. On the plus side, this means that brutally complex; but necessary, procedures can be laid out without the need to explain them to everyone from first principles.

    • Re:Technophobic bureaucrats (Score:5, Interesting)

      by Xest ( 935314 ) on Tuesday February 03, 2015 @06:57AM (#48967345)

      Yep, it's amazing how many just don't get it.

      I used to work for an engineering firm doing development, but prior to that my experience was in network administration. The IT department was managed by an engineer who had zero IT experience but took the job when the firm split from it's other half years before and the other half took all the IT staff, and all his staff were just people who had moved sideways. The net result was an IT department run wholly by amateurs wanting to be professionals.

      Because I had real actual IT experience of a 10,000 user network from my previous job I tended to help them a lot, and I really didn't mind that, and they appreciated it.

      But there were some things they just wouldn't get, security was one. I told them time and time again about the complete and utter lack of security and security policy and explained the risks. I was frankly laughed at by everyone in IT and even the directors and CEO I mentioned it to. I was told I was paranoid and being silly, and why would they ever be a hacking target, because it's not like they were drilling in the arctic or suing people for copyright infringement. All this was true despite the fact I'd set up a firewall around my net facing dev servers even if they weren't going to properly defend the rest of the company and I provided them IDS logs showing many probes from countries such as China and a number of South American countries like Colombia and Argentina, where they were also active and had an office.

      It's a shame because they actually had a proper R&D department and had some genuinely unique data, designs and techniques for the field in question, I left there about 7 years ago, and in the time since I'm aware that they repeatedly became loss making, in part because of the recession, but primarily because it turns out a company in China started doing everything they could do cheaper and had to have had all their data. This didn't particularly surprise me because they had on a number of occasions had problems with Chinese sales staff probing for more information than necessary when visiting the UK offices - it seemed pretty clear someone in China was interested in entering that industry, and probes on my dev servers from China were more prolific than anything I'd seen before and since. They have now been consumed by a German company and asset stripped for the remaining useful bits of IP, but are gone as an individual company - a good hundred or so jobs were lost.

      This is the greatest example I've witnessed personally where IT security and ignoring the risks due to naivety led to tragic consequences. It's possible they wouldn't have survived the prolonged downturn regardless, but it's pretty clear that espionage accelerated their end.

      But what do you do? If they don't listen to the warnings and advice I don't see how you can help them. There was an attempt to shift the responsibility onto me ("You write the security document and implement the procedures if you think we need them"), of writing the security policy, implementing all the measures, but I wasn't there for that, I'd moved into development precisely because I wanted to get out of that and whilst I said I'd be happy to train and review I wasn't willing to let it become my full time job - I didn't see why I should be forced into a job I hated because IT didn't want to do the job they were supposed to be doing, hence why I left.

      It's a shame that so many places learn the lesson too late, or not at all in some cases (e.g. Sony).

  • Is she sure she told them the correct address? (Score:5, Interesting)

    by Richard_at_work ( 517087 ) on Tuesday February 03, 2015 @06:32AM (#48967243)

    I have a firstnamelastname@gmail email address (you can see it above this post), and I get a *lot* of correspondence for other me's out there - bank details, divorce proceedings, legal proceedings, a long running internal discussion surrounding someones cock up in the Republican Party in the US, internal memos for several political parties around the globe.

    I've enjoyed free Netflix subscriptions (thanks!), invites to various exclusive clubs (not so great, most of them are in the US) and family meet ups. I know the progress of several children's schooling in Canada and the US, including an incident where the child was suspended for 3 days for kicking the teacher. I've had the ability to cancel several ISP connections, including business ones. Details of medical appointments and procedures, insurance documents etc etc.

    I've also been threatened with legal action for simply owning the email address and not handing it over - twice now. Yes, apparently there are other me's out there that think they have a right to this email address.

    So in short, without a recording of the telephone conversation, I wouldn't be so sure that it wasn't your sister that got the address wrong.

    • Still, none of this personal information should ever be sent unencrypted over email.

    • Comment removed (Score:5, Funny)

      by account_deleted ( 4530225 ) on Tuesday February 03, 2015 @08:16AM (#48967615)
      Comment removed based on user account deletion

    • I share a name with the son of a billionaire.

      I have given feedback on his condo housecleaning and politely declined his best friend's bachelor party blowout at some swanky ski resort. Was fun. :D Haven't received any more emails since then.

    • I have a firstnamelastname@gmail email address (you can see it above this post), and I get a *lot* of correspondence for other me's out there - bank details, divorce proceedings, legal proceedings, a long running internal discussion surrounding someones cock up in the Republican Party in the US, internal memos for several political parties around the globe.

      Same here. I usually reply with a "wrong person, please verify the email address" and get a thanks in reply. No legal threats, which would get a nice FU response from my lawyer, but I did have some idiot IT admin insist, repeatedly, the address was correct and that they would continue to send me the emails. He did't seem to understand that ignoring periods in email addresses complied with the RFC no matter what he thought. I said OK, but be advised that I make no assurance as to the privacy of the informati

    • Dear Sir,
      Please change your name at once or face prosecution.

      Sincerely,
      Richard

  • Aside from the sheer difficulty of litigating against a financial institution(If it is possible for your sister to have signed away her soul to mandatory binding arbitration in the venue of the bank's choice, those terms were probably included in at least one part of the fine print, probably several), there may not be much to go on. Not all states even require disclosure of a customer data breach, much less any particular action, standard of care, or other inconvenience.

    You might get somewhere if the ban

    • Re: (Score:2)

      by Rich0 ( 548339 )

      Agree, but I'd actually go a step further and ask why things like "identity theft" even exist. Of course this was a violation of privacy, but why should somebody having all your financial details actually cause harm?

      RSA was invented 35 years ago, and we're still authenticating people based on shared secrets that they basically have to share with everybody.

      Just give everybody an ID with a smartcard in it already, and use that for authentication. Yes, it means that the government and large businesses which

      • Re:You are probably SOL... (Score:5, Insightful)

        by fuzzyfuzzyfungus ( 1223518 ) on Tuesday February 03, 2015 @07:31AM (#48967451) Journal
        As best I can tell, "identity theft" is a brilliant invention on the part of institutions that are too lazy to authenticate people: as if by magic, this construction transforms fraud perpetrated against them into your problem. "Ooh, your identity got stolen, that sucks. Have fun fighting with the credit reporting agencies forever." rather than "Oh, another instance of fraud by impersonation against our pitifully weak systems. Maybe we have to do something about that..."

        I have to admit, it's elegant enough that I'd be forced to shake the hand of the person responsible before punching him in the face, just as a gesture of respect for carrying off something that audacious successfully.

        • Re: (Score:2)

          by Rich0 ( 548339 )

          "Ooh, your identity got stolen, that sucks. Have fun fighting with the credit reporting agencies forever."

          Particularly galling considering that these are the guys who basically run the credit reporting agencies.

        • As someone whose identity was stolen, this is spot on. My name, address, SSN, and DOB somehow ended up in someone's hands (never did find out how) and they opened up a credit card in my name. Mother's maiden name was wrong on the web form but that didn't matter to the credit card company (*cough* Capital One *cough*). By sheer luck, the thieves paid for rush delivery of the card BEFORE changing the address so the card wound up at my house. Still, the wrong mother's maiden name, immediate address change,

  • I'm not a lawyer, but I know some of you are.

    Pro tip: Anyone claiming to be a lawyer on Slashdot, or indeed on the internet in general, is probably lying. Especially if it is while they are providing you with what appears to be legal advice.

  • From a security perspective... (Score:5, Interesting)

    by pehrs ( 690959 ) on Tuesday February 03, 2015 @06:52AM (#48967311)

    Frankly, the risk of somebody doing something nefarious with the information they got it pretty low. Even on the internet the wast majority of people are nice and behave like decent human beings. Most people don't even know how they could use that information for financial gain. So if you go to a court you will have a hard time proving actually damage for what is obvious a mistake, which means any recuperation is either going to be based on good will or specific laws covering data breaches.

    In a larger perspective, you are right now encountering (and worrying about) a fundamental flaw in the way many American business work. There is a big confusion between identity, authentication and authorization. Identity (name, address, date of birth, social security number, bank account etc,) is not the same as authentication (I am the Identity) nor authorization (I am allowed to act as the Identity). None of the information the bank leaked really should be secret, and in Europe you could probably find most of it (except for bank account numbers) in public databases.

    • > the risk of somebody doing something nefarious with the information they got it pretty low.

      On a case by case baseis, yes. On a wholesale basis, the risk gets quite large, and they _script_ their attacks.

  • Comment removed (Score:5, Insightful)

    by account_deleted ( 4530225 ) on Tuesday February 03, 2015 @07:00AM (#48967355)
    Comment removed based on user account deletion
  • 'nuff said.

  • Bank Security? (Score:3)

    by tigersha ( 151319 ) on Tuesday February 03, 2015 @07:18AM (#48967413) Homepage

    I use a specific email address for any org that I deal with, something like @my.address.net So I can see who I get spam/malware from and I can block specific senders.

    I used a specific_bank@my.address.net for a loan application once and I got malware from that bank a year or so late. I certainly did not use the email for anything else. The BANK had a virus somewhere that harvested my email and God knows what. I transferred the loan to another institute.

    This is in Germany where there are actual laws about this.

  • 1. Consult an attorney in person, one with the initial interview free. Consult two more attorneys as a second opinion. If she is absolutely sure she gave the correct email to the bank then you can pursue legal action. Regardless, the bank should not have sent confidential information to an email address without some form of encryption. Most banks would send a secure message via their online website, an email just notifying you there is a secure message waiting for you, etc. I don't know of any laws that

    • Oh yeah, have fun watching your credit reports like a hawk for the rest of eternity. If you do encounter any identity theft, it is practically a full time job to keep on top of it and fight back. You will need to keep all correspondence forever and you will be using a lot of registered mail. Get everything in writing. Read up on the laws that protect you from debt collectors who are not allowed to harass you. Be prepared to fight the credit bureaus to remove fraudulent items off your credit report, etc

  • Use your state laws, the CFPB and Investor Relat. (Score:4, Informative)

    by Anonymous Coward on Tuesday February 03, 2015 @07:45AM (#48967501)

    I work in IT security for a bank. Your plan of attack depends on the state where you live, how your bank is chartered (state charter or federal charter) and how large your bank is with respect to the dollar amount of assets. If they are above ten billion in assets they are subject to more regulations.

    The federal laws are incredibly weak on this matter because the banks contribute so much to lobbying. The only federal regulator that scares the banks is the Consumer Financial Protection Bureau, www.consumerfinance.gov. They have an online complaint form. The primary regulator for banks is the Office of the Comptroller of the Currency www.occ.gov, but they are seen as weak on data protection matters. Lately they have been making a lot of noise about cybersecurity being a high priority but only from the hacking aspect and not consumer data protection.

    The CFPB and the state laws are your best legal avenue. A certified letter to them as well as to the OCC will get attention. ALWAYS send a letter by certified mail as well as using an online method. Certified mail gets a lot of attention because that is how legal matters arrive.

    It is not up to you to make sure the bank is using the correct contact information; it's up to the bank to validate it somehow and to protect the information while it is in transit and at rest on your ISP's mail server (yes, and that means no sending of unencrypted confidential docs by email). For email it's a preceding exchange of emails to validate the email address and the use of encryption on the files. You also could contact your local newspaper (if you still have one) or the local TV investigative reporter. If the bank is doing something so incredibly stupid with email they probably are doing other stupid things and TV stations love that kind of dirt. I'd also complain to your state Attorney General office in writing. New York has an incredibly proactive AG office on these matters. I'd also use the bank's Investor Relations contact information to make a complaint. That method is far, far more effective than trying to guess the CEO's email address. Every company watches their Investor Relations email or contact page closely, not just banks.

    Your bank "told" you that they do not have any type of secure document delivery service. They also told you that they do not have a properly configured, if indeed any, type of Data Loss Prevention application or program. What they did NOT tell you is whether they used encrypted email. There is a form of automatic email encryption called TLS that transparently encrypts email between servers. Gmail sends and receives TLS email by default. So it's entirely possible that they did use TLS email to encrypt it across the Internet. www.checktls.com can tell you whether your email provider and the bank can use TLS email.

    Good luck.

  • Simply call all 4 credit bureaus and lock your account. Do NOT use life-lock (pure crap).
    By locking up your data, the bureaus do not even get to sell your data. And if you are not using life-lock, nor can they.

  • Bank Security (Score:3, Interesting)

    by Old Aylesburian ( 2780221 ) on Tuesday February 03, 2015 @08:41AM (#48967745)
    I live in the UK. My bank wants me to sign up for internet banking, but they will not use email to request an appointment. Apparently the internet is safe enough for _my_ money, but not _their_ letters.
  • The only industry that has more power over the government than the banking/financial industry is the insurance industry - and the two are in cahoots. You won't get anywhere against them legally. Your sister should probably go request a new social security number immediately and cancel all her credit cards, then get ready to watch for activity. They banks aren't obligated to do much of anything, and they will dig in their heels to do as little of that as possible.

  • GLBA (Score:3, Informative)

    by Pagey123 ( 1278182 ) on Tuesday February 03, 2015 @08:50AM (#48967791)

    Disclaimer: I work for a small community bank. In the US, all banks are required to adhere to the Gramm-Leach-Bliley Act (GLBA). See: http://en.wikipedia.org/wiki/G... [wikipedia.org]

    As such, banks are required by both their state and federal regulators to follow a series of basic security protocols as laid out in the FFIEC IT Examination Handbook. Google this document for further details.

    I'm not sure what recourse she would have, specifically, under GLBA, but if she is truly interested in following up on this mistake by the bank, the place to begin would be consulting an attorney and contacting either the FDIC or the state's Department of Financial Institutions to make a formal complaint. Banks are usually required to have a formal complaint resolution process in place, and they are required to respond to both FDIC and state regulatory complaints as well.

  • I'd send an email to that wrong address, explaining my concerns and asking them in the most friendly way not to abuse the information they unintentionally received and to please delete the banks' email. If they answer, I'd take it from there (at least I would have some info about that person). Stay polite and don't make threats because they could cause a lot of damage in return.

    If they don't answer, then I would talk to a lawyer.

    In the mean time I would monitor my bank account(s) closely.

  • one and only piece of advice (Score:5, Informative)

    by ihtoit ( 3393327 ) on Tuesday February 03, 2015 @10:42AM (#48968657)

    Locate your State's Regulatory Data Commissioner. For CT, that would be the Ct. Banking Commissioner, via the Department of Banking, 260 Constitution Plaza, Hartford 06103-1800, and report as a protected data breach giving full details. They will carry it to closure. Contact there is the office of Bruce Adams, on (860) 240-8100.

    HTH.

  • But many financial institutions throw this at the end of their emails (amongst a larger disclaimer):
    "If you have received this communication in error please delete or destroy it and notify the sender immediately."

    Does anyone know if these statements hold any water?

  • Why on earth did she EVER agree to receive the information by email? When I refinanced I told them no when they asked about email. Either a secure document serving website where I could login and download the documents (which they had, surprise surprise) OR they go by fax. People don't generally know how to use email encryption properly, especially those that work in the mortgage area. I'd rather fax it 20 times than email it.

  • I have a friend. Back when he was building a house, he was fighting the bank for the mortgage. His mom was co-signing... and some moron at the bank (can't remember if it was Wells Fargo or BoA) emailed ALL THEIR DEPOSIT records, with account info, to them in an email.

    They got a lawyer. The bank paid 100% to a) change all of their accounts, b) all costs incurred by them to make changes elsewhere.

    Call a lawyer. I mean, do you actually *trust* banks (look up "Great Recession", 2008, subpriime lending....)

  • Fairly high up the food chain in IT, actually. And while it's too late in this case, I'd say that any bank telling you that they don't have a secure method for exchanging sensitive data is not a bank you ought to be doing business with.

    There's a whole raft of regulatory compliance and audit requirements that US financial institutions are subject to, and the one in question here is GLBA (Graham-Leach-Bliley Act), which governs how sensitive information must be handled. I'd place a call to the FFIEC and eith

  • I'd be drawn and quartered, end of contract. Especially for a financial institution.

    Every customer I've ever had made it crystal clear what the PII requirements were, and they were no joke.

    I guess it's different if you're not in software?

Slashdot Top Deals

"God is a comedian playing to an audience too afraid to laugh." - Voltaire

Close