Top Banks Named in New Identity Theft Study

Credit EligibleAs a BankInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info

Shockwaves rumbled through the US banking industry this week with the release of a new report estimating the annual incidents of Identity Theft associated with the nation's top banks.

The study, published by the Center for Law and Technology at the University of California, Berkeley, draws from thousands of consumer complaints to the Federal Trade Commission over a three-month period in 2006 - reports obtained by the study's author through Freedom of Information Act requests -- and lists the number of incidents reported not just at banks, but also at top utilities and retail merchants.

Bank of America is named as the institution with the highest frequency of Identity Theft complaints, followed by AT&T, Sprint/Nextel, JPMorgan Chase and Capital One in the top five.

The top five financial institutions listed are Bank of America, JPMorgan Chase, Capital One, Citibank and American Express. Washington Mutual, Wells Fargo, Discover, HSBC and Wachovia round out the top 10 institutions listed. No credit unions are listed among the top 25.

But while the release of this study comes with caveats -- the data is two years old, drawn from a small sample in one year, and relies solely on consumers' perception of where/how Identity Theft incidents occurred - consumer advocates nevertheless hope this first-of-its-kind report turns up the heat on financial institutions to better educate and protect their customers from the threat.

"I still don't think this information is really actionable for consumers, but it is actionable for banks," says the study's author, Chris Hoofnagle, a consumer privacy attorney and senior fellow at the Center. "A lot of people in the banking industry are already writing to me and saying, 'Hey, look at this.' For now, the goal is to get banks talking, because currently they're not. Instead, they're using proxies to engage in the debate in the form of commercials that don't inform the consumer."

Click to Get Updates on the Latest Information Security News

Company* Title* Email* Subscription Type: HTML Text Healthcare Enews General Healthcare Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Need Help?

Inside the Numbers
Hoofnagle's research began in May 2007, when he filed a Freedom of Information Act request with the FTC for the names of companies and institutions identified in consumer Identity Theft complaints over the previous two years. In light of the sheer number of complaints in 2006 alone - 246,035 - Hoofnagle settled for receiving data from 88,560 complaints from the randomly-selected months of January, March and September 2006. Of those complaints, 42,262 named institutions identified by victims re: fraudulent accounts established in their names or current accounts hijacked by thieves.

In all, Hoofnagle found that the top 25 institutions - banks, utilities and retailers -- account for 50% of the identity theft complaints lodged with the FTC.

Diving deeper, looking solely at banks, Hoofnagle divided the estimated number of incidents by each bank's total deposits to arrive at an estimated rate of Identity Theft per $1 billion in deposits.[See chart.]

By raw count, Bank of America leads the pack of all institutions with 1,117 complaints per month in 2006. When projected annually and divided by per billion of deposits, however, HSBC fares the worst, with 21 incidents per billion annually (BoA has 18). ING, in contrast, has less than one incident per billion annually.

Banks Respond
Once Hoofnagle's research went public, banks quickly fired back, saying the study is flawed. Bank of America representative Betty Reiss says the study doesn't jibe with independent surveys that have shown Bank of America as one of the top banks when it comes to protecting consumers from ID theft.

What's more, says Reiss, "if somebody who is a customer of Bank of America is a victim of Identity Theft, it doesn't necessarily mean that the theft, or compromise, originated at Bank of America. A lot of times consumers don't know how the identity theft originated or where it originated."

Hoofnagle's approach may even be counter-productive, says Doug Johnson, vice president for risk management policy at the American Bankers Association in Washington, D.C. Today, he says, banks cooperate through institutions like the Financial Services Information Sharing and Analysis Center to combat fraud -- a system that could be undermined by making Identity Theft protection a competitive factor among banks. "Institutions have every motivation already [to combat ID fraud] in order to protect not only their customer, but their institution," Johnson says.

The FTC reluctantly complied with the FOIA request, says agency ID theft expert Betsy Broder, fearing consumers might misinterpret the data. There's already evidence that consumers are drawing errant conclusions based on the Berkeley study, she says.