The new staffer was supposed to help Toronto-Dominion Bank spot money laundering from an outpost in New York.
She instead used her access to bank data to distribute customer details to a criminal network on Telegram, according to prosecutors in Manhattan.
Local detectives who searched her phone allegedly found images of 255 checks belonging to customers, along with other personal information on almost 70 others.
It’s part of a little-noticed pattern popping up across US. .banking — from towers in Manhattan, to hubs in Florida and even suburban Louisiana.
As sophisticated scams targeting the life savings of Americans create headlines across the U.S., the industry’s lowest-paid employees keep getting caught selling sensitive customer information out the back door — emerging as a critical area of weakness in banks’ risk controls.
That’s an inconvenient trend as firms steadfastly argue to policymakers and the public that customers bear primary responsibility for ensuring they don’t get conned out of their savings.
While many scams seemingly target people at random, some victims have said con artists who tricked them knew a lot about their finances at the outset.
“The more employees there are inside a company with access to sensitive customer information, the higher the risk that access is going to be abused,” said R.J. Cross, a privacy advocate at US Public Interest Research Group.
“Companies need to have technical measures in place to ensure employees and contractors can’t run off with people’s information or access data that isn’t necessary for their job duties,” Cross added.
There have been warnings for years.
Almost a decade ago, New York’s then-attorney general, Eric Schneiderman, publicly urged major lenders including JPMorgan Chase & Co., Bank of America Corp. and Citigroup Inc. to strengthen internal defenses after an investigation found an identity-theft ring had enlisted tellers from the industry.
That built on a broader study by his office showing leaks by corporate insiders were already on the rise, with data “often obtained exclusively for fraudulent purposes.”
Such concerns now carry new urgency. U.S. retirees sitting atop a record stockpile of wealth are facing an onslaught of elder fraud, with estimated annual losses soaring past $28 billion. For con artists, tips on who has a lot of money can be invaluable.
Meanwhile, bank lobbyists are fending off legislative attempts to force firms to do more to protect customers or share their losses.
The recent spate of busts shows banks haven’t yet figured out how to stop employees from trying to monetize their access to highly valuable and sensitive customer information.
Some connect with local conspirators on social media for schemes as mundane as faking checks. Banks typically make those victims whole. But more sophisticated cons have proliferated in recent years, often leaving customers on the hook for their losses.
Credit Union Case
A few prosecutions, like the one against Wade Helms of Navy Federal Credit Union, illustrate how far data can flow.
Authorities in Escambia County, Florida, accused Helms of jotting personal information about customers in a notebook, creating a handle for himself on the dark web, and making it known he was seeking a buyer for information on clients at Navy Federal, the largest U.S. credit union.
In one chatroom, Helms found someone who claimed to be a broker for stolen data. The two allegedly spoke by phone, then continued the conversation on a personal computer Helms kept next to his office desk.
The broker “wanted high-dollar account information because that would sell easier on the dark web,” according an affidavit for an arrest warrant for Helms. The broker created Telegram pages called “Navy Wave,” where screenshots of customer accounts were posted.
Some were provided by Helms, who had taken screenshots of customer banking statements and pictures of their identification, according to the warrant.
“Navy Wave” had multiple handles that began with @ScammingServices with more than 2,700 subscribers. By the time the credit union’s internal security discovered the breach, Helms allegedly had exposed as many as 50 accounts. At least five postings on the “Navy Wave” pages included Navy Federal accounts that Helms provided.
In a deal with prosecutors this year, Helms pleaded no contest to 11 charges, including illegal use of personal identification, and was sentenced to 10 years’ probation. He was also ordered to pay about $9,100 in restitution to Navy Federal.
A lawyer for Helms didn’t reply to messages seeking comment.
“Navy Federal takes all necessary precautions to protect our members’ personal and financial information,” a spokesperson for the credit union said in a statement.
“We strengthen our processes on a constant basis to ensure member information is kept confidential and continuously monitor member accounts for unusual activity,” it added. The lender also said it worked with law enforcement to help secure a conviction.
Incentivizing Firms
It’s challenging for companies to adjust to trends in crime, especially as firms are scaling up workforces with thousands of staff, including high-turnover jobs, said Jonathan Lopez, a former federal prosecutor who specializes in bank crime cases.
