Our bank is a community bank and thinking about adding a new manner of opening accounts and I could use some help.

Our bank offers Rewards checking (high rate of interest, etc.)have been contacted by Checking Finders, who is trying to sell a package which would list our bank as one who is paying high interest on a checking account. As the Compliance Officer, I have some uneasy feeling about opening an account for a person that is not sitting across the desk from our CSR.

I told management that our low risk bank products have just gone to moderate or high risk. I know there are banks that open accounts on-line and I am wondering how they do CIP on those people. Is a copy of the government issed ID card received? How do banks get a copy of the signature of the customer? Are checks issued or only a debit card?

Any help would be very much appreciated.

There has been discussion about this in our bank - we don't currently do this but have discussed.

There is software out there that would ask customer specific questions using information off of a credit report that are both recent and many years ago to determine if the individual opening the account is actually the individual with the appropriate identifying information. This software is very expensive, so I have been told - I don't know that for a fact...

Also, this does raise the risk of the bank and has implications entity wide as a result.

We open accounts online -- we use EFunds to help us with the CIP process. The customer opening the account has to answer challenge questions that only they would know. Such as the address of the last place you lived, the phone number of the last place you lived, who you may have financed your vehicle through, the state where your SSN was issued, etc. Things of that nature. We have ours set up that the applicant has to answer 3 of 4 questions correctly, or else the account is not opened. The other information regarding SSN, DL number, address, etc. is run through Efunds as well. They have access to a SSN database, the DMV databases, etc.

We do not obtain a copy of the photo ID. In regards to the signature, we mail out the signature card after they have signed up online and pass the challenge questions. Our procedure is to not let them have access to their funds until we get the signed signature card back. We only issue a debit card so by the time they get that, we should have a signed signature card back. They could always order checks on their own, I suppose, but we don't offer that at account opening.

CSB1 - Does eFunds verify the info provided by the online customer as answers to the challenge questions?

Yes, we do nothing on our end. We only get a message that they didn't pass and then let the customer know that we will not be able to open the account.

CSB1:

Who is the vendor for your account opening online product?

It is through Jack Henry. The product is called Opening Act.

*ditto* to the above

We go through EFunds as well - but the specific vendor we use is called Andera.


We had a problem where we had a promotion that allowed for people to open an account with $500 & get a $50 bonus. The promo got on one of those websites & we had an inundation of customers from EVERYWHERE wanting an account just for the $50.

We changed the promotion so you had to be physically in a branch to get the account.

I would recommend stating somewhere what areas you will accept applications from ... etc ... or you may have a problem ... Go to other bank's websites & check out their process to get some ideas. :o)

Beckster - to test the waters, some have recommended starting out with 1 or 2 low-transaction-volume account types for online offering, such as an online special CD and maybe a savings account. That will give you an idea of what sort of new customer base you are looking at. Maybe New York or Florida or California or whatever makes your eyes bug out, but how about customers logging on from China, India, Australia, etc.? After all, all they will really need is a SSN/TIN, a driver's license, and an address that fits your online format. None of those things necessarily means the applicant is located in the U.S. You might inquire whether your vendor will let you require a U.S. state and zip code in the customer-provided address fields. Also, manually reviewing and approving every single account might be a good way to start. I personally don't want Timmy the I.T. Professional deciding whether to accept an application from Mr. Bob Launderer, so your workload volume (or the workload of someone who understands these types of risks) could increase.

One other problem these "out of wallet" questions do not address is when the identity thief is a loved one (or formerly loved one). Vendors claim they ask questions that "only" the applicant would know, such as, former street addresses and the bank name and amount of a monthly mortgage payment. Clearly this information could be available to the applicant's parents, children, boy/girlfriend, ex-boy/girlfriend, spouse, ex-spouse, roommate, ex-roommate, landlord, employer, creditor, mailman, or any family or friend or other party with access to her mail, or anyone with access to or a copy of her credit report, or anyone who knows her well enough financially to be able to answer these questions. Does that sound like it is verifying identity to you? My vendor sales rep came right out and said they make NO claim that they are performing any portion of CIP or identity verification - all they can give is a "rating" indicating the likelihood that fraud is occuring. The flaw in that system is that it does not account for some of the usual suspects of identity theft.

Some previous posters have stated that their fraud volume went WAY up as soon as they started offering online checking, and that shortly afterwards, they discontinued the offering. We haven't started yet but I can't wait to see all the new SARs.

I do agree with Maytagman to a degree. I have a dedicated person that reviews & approves the online accounts manually & she is thoroughly trained.

We have had the process for over a year now & have had no instances of fraud & maybe 27 accounts (mostly employees) that were opened online.

You have a dedicated person who didn't have to do anything for the past 12 months except review and approve 27 (mostly employee) online account apps? Man, I'll take that job! That volume surprises me. Maybe your FI isn't offering anything particularly competitive online, and/or isn't advertising with national online listings?

I have worked at banks where we offered online account opening. The automated CIP is really needed to control the risks, but is not foolproof. You will most likely see attempted fraud go up. We even found a "ring" opening accounts...turned out they were in Eastern Europe using IDs that had been stolen from a bank about a year or 2 earlier.

If you are limiting the accounts to certain geographic regions (your state or surrounding states, for example) your risk will be lower than if it is wide open. The bank needs to determine what it wants, identify the risks, what risk is it willing to accept, and put appropriate controls in place.

I wouldn't do this without a risk assessment and appropriate controls different than what we had been using for our home town walk in customers.

"Kaybee"

Do you have a copy of the risk assessment you used for the on-line account opening that you would be willing to share?