The Virginia Watchdog

And this article below should get your attention........This was published yesterday in the Boston Globe

http://www.boston.com/business/globe/articles/2004/01/04/forget_your_bank_balance_its_available_on_the_internet/

Forget your bank balance? It's available on the Internet

By Bruce Mohl, Globe Staff, 1/4/2004

Eric F. Bourassa, a privacy advocate at the Massachusetts Public Interest Research Group, knows
how difficult it is to keep personal financial information personal. But even he was surprised at how easy it was for The Boston Globe to obtain his private bank account information. Trafficking in confidential financial information is commonplace on the Web, with a quick Google search turning up more than a dozen sites selling everything from Social Security numbers to bank balances. The Globe tested one of the sites in September, paying $125 for Governor Mitt Romney's credit report and in the process discovering a major security weakness in the nation's credit reporting network.

In November, with Bourassa's blessing, the Globe began to explore the shadowy world of asset search firms, which advertise that they can unlock the financial secrets of virtually anyone. The mystery is where these firms get their information. Does it come directly from financial institutions? Or does it come through more indirect, possibly illegal, methods?

The Globe agreed to pay Ohio-based I.C.U. Inc., whose Web address is Tracerservices.com, $475 for Bourassa's bank account information and his stock and bond holdings. Not all of the information the website provided was accurate, but the bank account information, with the balance listed right down to the penny, was so close that it made Bourassa feel violated.

"It's outrageous that my financial information is so easily obtained," Bourassa said. "On one level, it's a violation of my privacy. But more importantly, this lack of protection is an avenue that can lead to identity theft."

I.C.U.'s report identified FleetBoston Financial as Bourassa's bank and listed his checking account number, his six-month average daily balance, and his current balance.

The information was correct, except it applied to Bourassa's savings account rather than his checking account. The savings and checking account numbers differ by only one prefacing number.

I.C.U. also reported that Bourassa owned shares in 13 PBHG mutual funds. The asset search firm itemized how many shares Bourassa owned, the buying price, and their current value down to the penny. One problem: Bourassa has never owned any PBHG funds. He even called the company to verify that.

Bourassa said he suspected his bank account information leaked out one of three ways. One possibility was that I.C.U., which is based in Berea, near Cleveland, called Fleet and illegally pretended to be him to get the information. Other possibilities: that Fleet sold his information to or shared it with I.C.U., or that Fleet shared the information with another third party, which in turn released it to I.C.U.

I.C.U. was initially circumspect in saying where its information came from. Company representatives, asked about the accuracy and source of their information on Bourassa, said they obtained it from subcontracted third parties.

I.C.U. employs a private detective image on its website but is not licensed as a private detective agency in Ohio.
Later, when the Globe called seeking an official comment, the company said its information probably came from Fleet itself. Tom Jenkins, who said he worked in I.C.U.'s asset search department, said the firm does get a lot of financial records from subcontractors but obtains most bank account information on its own. Jenkins said Fleet frequently uses I.C.U. to track down people who owe the bank money and returns the favor by providing information to I.C.U. He described I.C.U. as an affiliate of Fleet and called the Fleet-I.C.U. working relationship a "two-way street."

"They know who we are and what we're after," Jenkins said.
Jenkins said he did not personally work on the Bourassa information request and didn't know why the stock and bond holdings provided to the Globe were inaccurate.

Fleet spokesman James W. Schepker said a thorough search of bank records indicated neither I.C.U. nor Tracerservices.com had ever been hired through approved channels to perform any service for Fleet. He said Fleet made several attempts to contact Jenkins or other officials at I.C.U. to ask them about their claims and had been unable to reach anyone. Schepker also questioned why, if Fleet provided I.C.U. with Bourassa's bank account information, the information was not entirely accurate.

The Fleet spokesman said the bank does not share customer financial information with third parties except in very limited circumstances. One of the third parties to which it will release information is a credit bureau. Schepker also said customer information is occasionally shared with Fleet affiliates, including Fleet Credit Card Services, but stressed that I.C.U. is not an affiliate of the bank.

Robert Jones, Fleet's director for operating risk, said the bank uses a number of techniques to block people from obtaining customer financial information under false pretenses. Jones said he did not think I.C.U. used so-called false pretexting in this case because a forensic search turned up no evidence that any inquiry to Fleet had been made about Bourassa's account.

"I don't know how they got the information," Jones said.
Jones said Fleet notified regulators at the Federal Reserve Bank, the Office of the Comptroller of the Currency, and the Federal Deposit Insurance Corp. about the Globe's acquisition of Bourassa's account information.

On its website, I.C.U. says it does not engage in any illegal activities to obtain information on individuals. It specifically stated that it complies with the Gramm-Leach-Bliley Act, which prohibits the use of false pretenses to obtain consumers' personal financial information.

The company said there are a number of legal ways to get the same information, including going through a subject's trash to obtain bank and brokerage statements. Other methods cited by I.C.U. included spying on a subject to get his or her bank account or debit card number, obtaining the subject's credit report, or culling bank account information from credit applications filed with auto dealerships or department stores.

"These are just a few of the hundreds of legal ways to obtain a consumer's banking information," the website says.
Jenkins said I.C.U. is careful about who it does business with. "We can generally tell when a stalker is calling," he said. "They don't have the right information or ask the right questions."

Yet the company's screening process isn't very thorough. On its order forms, I.C.U. says it will supply an individual's personal financial information only to people trying to track down an old friend or people involved in civil litigation.

Customers also must swear that this information will not be used for anything illegal, immoral, obscene, or violent.
The Globe, on its information request, checked that it was trying to contact an old friend, an obvious falsehood since the newspaper supplied Bourassa's address and Social Security number for the asset search.

Jenkins said I.C.U. is running a legitimate business. "Knowledge is power," he said. "There's an awful lot of information out there and people have a demand for it."

Bruce Mohl can be reached at mohl@globe.com.
© Copyright 2004 Globe Newspaper Company.

Return to Home Page