Insider data theft costs Bank of America $10 million
IDG News Service - A Bank of America insider who sold customer data to criminals cost the bank at least US$10 million in losses.
Bank of America began notifying customers of the incident recently, but is not providing many details of the case which is still under investigation. The theft, "involved a now former associate who provided customer information to people outside the bank, who then used the information to commit fraud against our customers," said Bank of America spokeswoman Colleen Haggerty, in an email message.
The bank lost at least $10 million to the criminals, said James Kollar, a special agent with U.S. Secret Service in Los Angeles. "There was information that was coming from the bank to the outsiders," he said. "It was basically a check scam."
About 95 members of the loosely affiliated criminal gang behind the alleged fraud, including the bank employee, were swept up in a February 2011 law enforcement action, Kollar said. However, the names of the accused have not been released, and the court case is under seal as the investigation continues.
Details of the fraud were reported in the Los Angeles Times this week, which reported that the scammers had stolen, "names, addresses, Social Security numbers, phone numbers, bank account numbers, driver's license numbers, birth dates, email addresses, mother's maiden names, PINs and account balances."
It appears that this information was then used for identity theft. According to one victim, quoted in the LA Times story, the scammers ordered boxes of checks and had them delivered to a UPS outlet where they would then pick them up. They also allegedly contacted the victim's telephone company and -- to prevent BofA from warning the victim -- rerouted calls to the scammers' mobile phone.
They also allegedly contacted the bank via telephone and moved more of the victim's money into the account they controlled. All told, they stole more than $20,000 from this one victim.
It's not clear how many bank customers were actually affected by the fraud. The LA Times quoted Bank of America's Haggerty as saying there were "about 300" victims, located in the western U.S. But on Wednesday she would not confirm that this number was accurate, and she wouldn't say how many notification letters Bank of America is sending out.
"Due to the current status of the investigation, additional details can only be disclosed by law enforcement," Haggerty said.
Customers who were hit by the fraudsters will receive two years of free credit reporting, Haggerty said.
Companies have taken a special interest in the threat posed by disgruntled insiders, after all of the publicity surrounding WikiLeaks, said Kim Peretti, a director with PricewaterhouseCoopers Forensic Services practice. "We saw a lot of organizations wake up and hear the message that we've been saying for a very long time: That the insider threat is there," she said. Unfortunately, that spike in interest, "seems to be temporary," she added. "There's still a ways to go in addressing the insider threat as well as the data leakage problem."
Often leaks happen in the few months before a disgruntled employee leaves his job, Peretti said.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts