Banks could face prosecution over Indian call centre leak

The security leak was discovered following an investigation by a newspaper reporter from The Sun, who was able to buy bank account, credit card, passport and driving licence details of UK bank customers for just £4.25 each.

The call centre worker in New Delhi also told the reporter he could supply confidential data from 200,000 accounts per month. The newspaper handed a dossier with all the details to the City of London police.

Detective Inspector Oliver Shaw of the economic crime unit at City of London Police said in a statement: "Unfortunately we have no jurisdiction to prosecute in the UK so we have passed it through Interpol to the Indian authorities."

A spokesman for data protection watchdog the Information Commission said it is a matter of "great concern" and warned that UK-based companies who outsource their customer services to a call centre whether in the UK or overseas remain legally liable for any security failings.

"It seems likely that a criminal breach of the Data Protection Act 1998 has occurred. We will be contacting the City of London police, as well as taking the matter up with those UK companies whose customers' details have been provided to The Sun," he said.

But banking watchdog the Financial Services Authority (FSA) refused to say whether it would launch any investigation.

An FSA spokeswoman siad: "Our concerns are whether adequate security controls were in place but a determined fraudster is always going to get through."

The latest breach could ignite a backlash against the Indian outsourcing industry following the theft of $350,000 from the accounts of US Citibank customers from a call centre in India earlier this year.

But Indian IT trade association Nasscom said these incidents are rare and can happen at call centres regardless of which country they are located in.

A Nasscom statement said: "Nasscom will work with the legal authorities in the UK and India to ensure that those responsible for any criminal breaches are promptly prosecuted and face the maximum penalty. The problem is not unique to any single nation - it is one that affects us all - and each of us has a responsibility to take on the criminals. India, with its strong legal system and its independent judiciary, is a country that takes this responsibility extremely seriously."

Forum Comment

Putting aside the brand and reputation issues of this incident, which in themselves are very serious. These events strike at the core of many Financial Institutions Business Service models, which now rely heavily on Outsourcing and Third Party Call Centres. The Banking industry has gained huge benefits from the shift to the new model of Internet Banking and Call Centre usage and profits in most have soared as a result.

However, along with this increase in profit comes an even greater responsibility to ensure the KEY partners in this new model are both diligent and supervised. We at the Forum have urged greater focus on the Supply Chain for critical processes for many years, yet it seems as though there is still some way to go to develop a resilient and secure framework that is accountable in the Global Market in which we live and work.

Currently the opportunity exists to address this fully both though the Regulator, the Financial Services Authority, and perhaps even more appropriately, the Basel Committee, but there seems to be little willingness to do this.

In addition, the penalties imposed need to be reviewed and perhaps increased dramatically, to ENSURE that the issues are taken as seriously as possible.

A more united and structured approach to Security is essential in this sector and BCM could be the ideal process to ensure the proper management of KEY suppliers Policies and procedures.

We hope that those able to act on this issue, do so, clearly and forcefully, encouraging the sector to resolve these problems and provide adequate protection for all their customers and partners. Failure to do so may reverse the current Internet Banking Boom and create concerns about Call Centre Service, with both steps having a huge impact on the profitability of the sector and its future evolution.

END