Do any of you put the account holder's social security number on their account statement? Has anyone doing this had a customer's statement stolen from a mailbox and then been a victim of identity theft? Does anyone have comments about this practice as a violation of GLBA required procedures to protect customers' privacy? Thanks.

I have seen it done, and personally I don't like it for exactly the reason you mentioned. I'm pleased to report that my bank does not do this. As a depositor, I have never found the presence of my SSN on my statement to aid me in balancing my check register, so I am happy to not have it there.

I'm with jacFSB on this one. The six banks I work for do not put SSNs on customer statements. If I observed any instance where that were to occur I would strongly suggest the practice be discontinued. I see no worthwhile purpose for disclosure of SSNs on consumer statements.

On another note, Have any of you ever seen customer checks with SSNs on them? I know of instances in the past where customers requested same. Another practice that should be discouraged.

Are banks also taking written account numbers off checks?

I don't believe that it would violate Reg. P or GLB requirements to send it in the mail. The envelope is protection and there are other laws protecting that and other NPPI. That said, it isn't a good idea and we don't include it. As Jac mentioned, it really doesn't help anything.

Communicating with a customer via unencrypted e-mail is a worse idea as there are no envelopes to protect that. While I hope banks are not doing this, I see customers sending this data all the time. The bank's response, which typically says not to do this, should edit those numbers out with other confidential data so it isn't exposed a second time. That could be a potential safeguarding customer info issue.

We do not alter the checks (images now) in any way. While there is a lot of confidential information in a bank or other billing type statement, that wouldn't be practical. It is a good sales tool for e-statements and PO boxes instead of the roadside containers.

No, I did not mean "alter" the checks. I meant, with technology what it is, banks could likely produce checks with only encoded check numbers on them. Paying someone with a check containing name, address, bank, and account number is giving them a headstart on identity theft if the payee is inclined to do so.

As for the SSNs on statements: (if anyone is actually doing this) Be careful if you have customers in the state of California; they have a new law (SB 168) that seems to prohibit this practice.

I'm not sure how we'd do away with name, address, etc. on printed checks. Every field you mention has a function, be it research, defense against fraud, or even simple(?) routing and sorting of documents. Operationally, the data in the MICR line along the bottom is critical - without the routing/transit number, your bank doesn't know where to collect the funds from. Without the account number, my bank doesn't know which account to debit. The way we're set up today, we can't operate without this data.

Maybe privacy issues & prevention of identity theft is the trigger that shifts the industry away from checks altogether?

Bart, you didn't think I was suggesting doing away with all of that information. How would the merchant know whose check it was without a name? I only mentioned those other fields of information because having that information along with the account number makes the check a do-it-your-self fraud kit.

Couldn't the account number be encoded where a thief would not be able to retrieve it but the bank can read it? The account number is not read by the human eye anyway. I am just wondering out loud as to whether banks are considering encrypting the account number so that only they can read it by machine. (You'd sell more checks too because outside vendor checks would not work without your encoding.)

The driver license # on checks is also a bad idea. Now someone has a signature, a driver license #, an address - all they need is THEIR picture to make the fraud complete! I can't tell you how many times I tried to discourage customers from putting that information on their checks to "make it faster" when they're paying by check.

Good point, zaibatsu. I have often wondered why magnetic ink has to be black. What happens if you used a transparent fluid to put the account number on the check? Why not? That way the crooks wouldn't have a customers account number.

How many bank employees and officers have their DL number on their checks?! I've always thought that was a bad idea.

I think the transparent ink, or whatever other methods we could use would be great, but it would have to be done on a wide scale, or our customers wouldn't be allowed to write checks anywhere. I could also see a thief telling a merchant that the info was on there, it was just in transparent ink.

I have seen some banks recently that still have SSN's on their statements. Their core processor is a nationally known provider.

Andy's comment above re responding to customer e-mail containing sensitive information. I am seeing this frequently. The web site may have disclaimers that the bank will never send any sensitive info over the net without proper safeguards, but if the customer does so, it is at their own risk. Then the bank has an unencrypted "contact us" e-mail link that customers use. Often, bank employees are responding to these e-mails and the sensitive information is quoted at the bottom of the bank's reply.

Do you really think a merchant is looking for an account number? And if there is an account number on the check, so what. How would a merchant know by sight whether the account number is correct?

About two years ago, I was trying to pick the right time to bring up the subject to our IT people that we should not have SSN's on statements. I figured it would take an act of god to get the SSN's not to print on the statement. In the mean time an 80 year old lady called and asked someone in IT if they could remove her SSN from her statement for security purposes. It took IT less than 5 minutes to make the change and remove SSN's from all of our statements and then they asked me why I didn't think of it before the little old lady!

I don't think merchants would look for account numbers as such, but a check that didn't have that information on it would look much different than the checks he's used to seeing. If I didn't know better, that would be enough to make me suspicious of it.

Just like the option to have a DL or SSN on a check the accountholder could be given the choice to have the account number visible or invisible.

We have to apply some logical limits at some point here, otherwise, the check printers will simply be selling pictures of Garfield and the Simpsons and calling them 'checks.' Or worse, this could lead to negotiable instruments that read something like this: "Please pay Epstein $100.00 from my account. Signed- Epstein's Mom."

It's one thing to get your statement print routine to stop printing the customer's SSN on the bank statement. It's another to find a way to suppress the printing of an SSN that's included in the description field in an ACH credit from Social Security Administration and their ilk.

That just jogged my memory--that is the exact issue that bankers in California are dealing with. There is now a law that the SSN can't be on the statement, but with the "ilk," as you call them, they have a problem.

Yes, out here in California we were to be in compliance effective 7/1/02. For the bigger bank (BofA etc.) they seem to have had an easier time with this requirement. For the community bank as we are, we had more of a difficult time suppressing the SSN on the statement. We're an ITI user and getting them to come up with the fix took some initial convincing and persistence.
As far as the "identity theft" issue last week one of our customers brought in numerous checks that he did not originate. We assume someone stole his statement from his mailbox - recreated his checks, forged his signature and had quite a spending spree. Was the SSN present? probably as we had not yet suppressed the number from a couple of months ago. I'm sure the nightmare is not yet over for our customer.

We're now having to deal with the requirement of not using a mother's maiden name for identification purposes. What next?

I always wondered about that when I called my credit card companies. The answer to "what is your mother's maiden name" seemed to be the magic response that gave you entrance to my credit card account. Big deal! Many people know my mother's maiden name, including my mother, my siblings, my wife, my father, my aunts, my uncles, my mother's neighbors, friends, and acquaintances, etc.... Things are going to have to get a lot more sophisticated.

In reply to:

---

Things are going to have to get a lot more sophisticated.

---

And out here in California (land of the fruits and nuts...), not ONLY do we have the prohibition on printing the SSN (even for a description on the ACH deposit of benefits) but there is a law pending that would FORBID the use of the Mother's Maiden Name as means for the customer to access his or her account.

From what I understand, the proposed law would not prohibit the Bank from obtaining the MMN, but we couldn't use it as an identifier for account access. If the law passes, then sometime before Jan 1, 2003, we will have to come up with a replacement for the MMN. Suggestions are Grandmother's maiden name, Pet's name, favorite food, make model and year of first car, or any other piece of trivia that the customer will hopefully remember but is not easily found out through public records.

I've left a message on my Mom's answering machine to find out my grandmother's maiden name!

To further emphasize your point, zaibatsu- I am divorced, and I know ALOT of information about my ex-wife. Her SSN, Mother's maiden name, date of birth, city of birth. This is why we use an account password rather than asking our customers for a piece of their personal information when authenticating callers.