Timeline for Bank Has Emailed My Social Security Number
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Feb 1, 2016 at 16:22 | comment | added | MusikPolice | I had a similar problem when purchasing a house this year. The bank, the realtor, the insurance company, everybody defaulted to sending sensitive information as email attachments. To be honest, it terrified me, but the process of buying a house moves so fast that I didn't have time to complain without possibly losing my bid on the property. There's good money to be made in creating an easy to use solution for this problem that financial institutions will adapt. | |
| Jan 31, 2016 at 5:41 | comment | added | Anti-weakpasswords | Quit giving banks your email address :) - make them send it postal mail. | |
| Jan 30, 2016 at 21:52 | comment | added | dave_thompson_085 | .. whichever Federal "functional" regulator applies to the given FI; OCC has a nice lookup at helpwithmybank.gov/national-banks/national-banks.html . They won't act on an individual complaint, but if they get a pattern it'll affect the scoping and perhaps frequency of their examinations of the bank -- and bank management's first priority is don't offend the regulator because that can cost us big money. | |
| Jan 30, 2016 at 21:49 | comment | added | dave_thompson_085 | @John If US (I don't know for anywhere else) I wouldn't bother with a lawyer unless (you think) you can prove big-dollar damages, since a civil action will take probably 10-15 years and cost a lot, or if you can establish they do this for many people and find a lawyer who'll pursue a class action on contingency. I would report to FTC, although they seem to focus on intentional violations (like selling the whole database) which are probably larger-scale and definitely easier to prove. I might try CFPB, although they don't have a track record yet. And I definitely would complain to ... | |
| Jan 29, 2016 at 3:58 | comment | added | John | @dave_thompson_085 I stand corrected. Would you say to contact a lawyer or the FTC and report this violation? | |
| Jan 29, 2016 at 2:59 | comment | added | dave_thompson_085 | @John PCI DSS does not list SSN as "Cardholder Data" and in any case PCI DSS only applies to payment cards, payment-card transactions, and payment-card accounts, hence the name "Payment Card Industry DSS". A mortgage is not a payment card/txn/account. What does apply in the US (at least theoretically) is Graham-Leach-Bliley epic.org/privacy/glba . | |
| Jan 28, 2016 at 23:24 | comment | added | John | How would this not be a violation of PCI req 4.2? as the social security ## is part of protected cardholder information. | |
| Jan 28, 2016 at 16:19 | comment | added | Adam Shostack | You should consider naming the bank that felt this was a reasonable practice. | |
| Jan 28, 2016 at 16:01 | answer | added | Rylan | timeline score: 2 | |
| Jan 28, 2016 at 14:49 | history | tweeted | twitter.com/StackSecurity/status/692721175680716800 | ||
| Jan 26, 2016 at 14:28 | comment | added | Eddie Studer | In all reality, it may be time to look for a new bank. If your current bank is this careless with your personal information then how long until something worse happens. There are very strict rules when handling information like Social Security Numbers and other personal information regarding clients. If they had the ability to email those documents to you they could have just as easily set up a secure signing like Docusign to accomplish this task rather than risk your info. | |
| Jan 26, 2016 at 5:14 | comment | added | Neil Smithline | You should make that an answer @tesselatingheckler | |
| Jan 26, 2016 at 4:15 | comment | added | TessellatingHeckler | But are the attachments/visible to my mail provider? - yes, Google automatically scan GMail messages to provide advertising and Google Now features (source) and GMail engineers can potentially access any account as part of necessary work, with oversight (source). somewhere, at one of Google's data farms - many data farms, and backup tapes source | |
| Jan 26, 2016 at 3:08 | history | edited | Rob P. | CC BY-SA 3.0 |
deleted 202 characters in body
|
| Jan 26, 2016 at 2:52 | history | edited | Rob P. | CC BY-SA 3.0 |
added 385 characters in body
|
| Jan 26, 2016 at 2:46 | history | edited | Rob P. | CC BY-SA 3.0 |
added 385 characters in body
|
| Jan 26, 2016 at 2:45 | comment | added | Some Dude | There is a such thing! It's called encryption :) You should talk about your concerns with the bank manager. There are a lot of red flags being raised here. If this is how they handle PII in email, think of how they handle the rest of your information. | |
| Jan 26, 2016 at 2:20 | history | asked | Rob P. | CC BY-SA 3.0 |