Question & Answer

Question: What should we do if we believe that the bank has received a phone call that is an attempt to obtain information about a customer? We recently had a call and the questions didn't quite add up - unless we assumed that the caller wanted information like account numbers and balances. There was no "amount" of money involved. Should we file a SAR or call someone?

Answer: Yes. Don't let this kind of activity go by untended. Recent guidance from the regulatory agencies (see, for example, FDIC's FIL-100-99) stresses the importance of taking steps to prevent identity theft. This issue - pretext calling to obtain customer identity information - is taken so seriously that filing a SAR may not be enough.

Specifically, the FDIC recommends that when a bank receives such a call, the bank should take several steps: file a SAR, contact your primary federal banking regulator, notify the Federal Trade Commission, and notify appropriate state agencies (i.e., those charged with enforcing laws against identity theft). In short, this is serious. Don't sit on it.

Copyright © 1999 Compliance Action. Originally appeared in Compliance Action, Vol. 4, No. 13 & 14, 11/99