Banks still oblivious to fraud risks, says FSA

The Financial Services Authority (FSA) urged financial institutions to improve security systems after a review exposed the fact that many companies underestimate the value of their customer’s information.

The FSA assessed the systems and controls at 39 UK firms including banks and building societies, as well as insurance companies and financial advisers, many of which still do not realise the dangers surrounding the exposure of client data.

Businesses are not checking if third-party suppliers vet their employees or have adequate security arrangements in place to prevent unnecessary access to customer data, it said.

Training was also an issue, with businesses placing more emphasis on IT control procedures for data protection than on security awareness and education for their workforce, said the FSA review.

"It is worrying that despite increased public awareness of the impact that identity theft can have on customers, many firms are still not taking this risk seriously,” said FSA’s director of financial crime and intelligence division Philip Robinson.

“Customers have a right to be confident that firms are doing everything reasonably possible to keep their personal and financial details safe,” said Robinson.

"Some firms have made progress by adopting good practice while others need to do more in this area to ensure that they are treating their customers fairly,” he said.

Understanding areas of data exposure is a practical challenge for many financial services organisations, said Deloitte’s head of UK security and privacy services Mike Maddison.

“A common challenge for companies is having a complete view of their exposure to the risk of data compromise,” said Maddison.

“Many firms struggle to define what their sensitive data actually is and where that data resides or who it is provided to. They also struggle to co-ordinate management of these risks, which are owned by different parts of the business,” he said.

“The FSA recommendation to appoint a senior manager with overall responsibility for data security, in conjunction with the publication of more information to help management understand their responsibilities, will go some way towards addressing this.”

See also:

Online card fraud more extensive than reported

Original APACS figures for 2007 did not include failed attempts, says the BBC  23 Apr 2008

Privacy watchdog to get new powers

Office will be given ability to spot check central government  22 Apr 2008

PayPal to block old browsers

Payment service will warn and block old browsers as part of attempts to stop phishing attacks  21 Apr 2008

eBay welcomes alleged cyber criminal's arrest

Romanian stands accused of defrauding eBay users by accessing administrative accounts  18 Apr 2008

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!