Data security a priority, says FSA

The UK’s FSA is urging banks to do more to protect customers' personal details

LONDON – The Financial Services Authority (FSA) is urging firms do more to help prevent their customers falling victim to identity fraud and other types of financial crime.

This warning follows an FSA review of systems and controls for data security at 39 firms including banks, building societies, insurance companies and financial advisers. Although there were examples of good practice across the industry, the FSA found that many firms were still underestimating the risk of data loss and fraud to their businesses, and especially to their customers.

Senior management were singled out for not recognising the value of their customers' data to fraudsters or that staff could pose a similar threat to data security as that posed by computer hackers and burglars. On occasions of significant data loss, firms seem more concerned about adverse media coverage than about being open and transparent with their customers, said the FSA. Following the review, one firm has been referred to enforcement.

Speaking at the FSA's annual conference on financial crime on April 24, Philip Robinson, director of its financial crime and intelligence division, said: "It is worrying that despite increased public awareness of the impact identity theft can have on customers, many firms are still not taking this risk seriously. Customers have a right to be confident that firms are doing everything reasonably possible to keep their personal and financial details safe.

"Some firms have made progress by adopting good practice, while others need to do more in this area to ensure they are treating their customers fairly. Firms getting data security right is a key priority for the FSA, and we expect the industry to raise its standards.”

The review showed that many firms are not proactively checking that third-party suppliers vet their employees or have adequate security arrangements in place to prevent unnecessary access to customer data. It found that many large and medium-sized firms devote adequate resources to data security risk but place too much emphasis on IT controls and not enough on staff awareness and training or regular risk assessments. It also found that small firms were wholly reliant on compliance consultants, who did not understand the importance of data security within the firm.

Andy Nicholson, managing director, finance industry sector, BT Global Services, says: “The proliferation of banking channels has offered customers greater flexibility, but also raised the need for security systems to help customers avoid becoming victims of identity theft. Security is vitally important for banks and customers alike – customers naturally don’t want to become victims of fraud and banks need to be able to protect them. From our experience, some banks have already turned to centralised identity management, allowing them to identify the lifecycle for employees and customers, from initial registration through to access provisioning, access changes and de-provisioning. Effective security will always play a crucial role in a bank’s strategy, and the involvement of the FSA will act as a catalyst to improve security solutions and boost customer confidence.”

Examples of good practice found at the firms visited included: firms encrypting laptops and transferring data via secure internet links to third parties; masking financial details where they are not necessary for staff to do their jobs; and appointing a senior manager with overall responsibility for data security.

Nicholson says: “Banks should consider three specific approaches to effectively protect their customers: effective identity authentication – technologies such as two-factor authentification dramatically increases security without increasing complexity; fraud detection – services that identify unusual or uncharacteristic behaviour; and fully networked and integrated ID theft and fraud solutions to ensure different systems talk to each other for maximum security.”