Why do banks seem to be indifferent about identity theft?

Question

Several years ago, I was in a terrible relationship in which my girlfriend fraudulently opened a credit card in my name. I forget the specifics, but she ended up transferring the full cash advance on the card into one of her accounts at another bank. When I found out about the card, I questioned my bank regarding the account to which my money was transferred. I asked for the account number or name of the entity on that account, and they refused to give me that information.

Further, my debit card was stolen by her on a few occasions. I asked the bank for the ATM security footage and they wouldn't give it to me. Then, she even wrote herself a check out of my account. When I asked who cashed the check, they wouldn't tell me.

Then, my best friend just recently had his account drained. Apparently, the thieves have his SSN, account #, DOB, etc. His account was through Bank of America. The thieves transferred money out of his account to another BoA account. When he asked for the information or a name associated to the thieving account, they refused. When he talked to their fraud department, he asked them if they were interested pursuing the thieving account. They said that was not what their department did.

So, my question is, why do banks seem so unwilling to deal with fraud? Now, I admit, many factors may apply here. For example, the largest fraudulent transaction by my ex was probably $400. Including the maxed out credit card she took out under name, and all other charges, she cost the bank probably $7,000 over 9 months. Likewise, my best friend was robbed of $5,100. So, it could just be that such low-level fraud is not worth the bank's time. But, I would think this adds up to a lot of money. But, then again, I have no idea if banks can write off these losses, and if so, how much net financial damage it does to the banks, and whether it is appreciable.

Answer 1

Banks are not indifferent to identity theft. They are just not sharing with you what they are doing.

As well as the privacy reasons cited in the other answer, and the inability of the banks to conduct their own criminal investigation, there is another very important reason why the banks will not share their investigation with you.

The most common kind of fraud is first party fraud.¹ This is the kind of fraud where you get your girlfriend to transfer money out of your credit card or bank account, and then you go to the bank and claim that you've been a victim of fraud and get them to reimburse you for the 'theft'. I'm not accusing you, but both incidents have all the hallmarks of first party fraud.

• The theft is by someone you know
• The theft is repeated and you have taken no steps to prevent it
• You haven't reported it to the police
• The theft was made easy by having information that you could easily have given them

In both cases the banks were probably doing their own investigation, possibly with the police, into whether you (or your friend) were responsible for the theft. Giving you information about that investigation would compromise it.

You fix this by:

1. not giving information out to people, even girlfriends, that will enable them to steal your bank accounts
2. Kicking out your girlfriend the very first time she steals from your cards, possibly reporting her to the police.
3. Reporting thefts like this to the police

Footnotes:

1. I know this to be true for credit cards, and it is probably true for banks.

Answer 2

I asked for the account number or name of the entity on that account, and they refused to give me that information.

If the transfer was made directly from the card to the destination account, then the destination account should be on the transaction record for the card. Asking the bank for this is suspicious. The account owner would have that information already, and they're not going to provide it to someone who isn't the account holder. Following the money isn't the way to go here. Instead, close the card and make sure both the card issuer and the credit bureaus flag this as fraud.

If this was done by getting a true cash advance (cash from an ATM, for instance) and then depositing that cash elsewhere, then the bank has no way of knowing where the money went. Once it turned into cash, there's no reasonable way to trace it after the fact.

I asked the bank for the ATM security footage and they wouldn't give it to me.

Potential privacy issues aside, providing this footage for someone is not as easy as they make it look on TV. Whoever you talked to almost certainly doesn't have access to this footage, there's either a security department that manages it or it's handled by an external security company. Finding the footage from the same point in time as a specific withdrawal involves time-consuming research work by multiple people on both the bank and security side. If the bank volunteered to give out that footage to anyone who requested it, they'd waste a massive amount of time and money. The bank won't even give the police easy access to that footage. Essentially, you need a warrant, court order, or similar legal demand for the footage. That will certify that there is a legitimate need for the footage and that the footage has a good enough chance at being useful to be worth the hassle and expense. It also lets the bank know that you're not some criminal asking for footage so that you can analyze camera picture quality and coverage angles in order to plan your heist. ATMs are common targets for theft so banks are extremely picky about anything that might even theoretically compromise their security.

When I asked who cashed the check, they wouldn't tell me.

You asked the wrong question. They can't tell you who cashed the check because strictly speaking, they may not know (especially if it was cashed somewhere else). You should ask for a copy of the cancelled check. After a check is cashed or deposited, your bank should make available to you either a copy or a digital image of the front and back of the check. You will be able to see the handwriting of whoever wrote the check, your forged signature, the signature of the person who cashed/deposited it, plus identification markings made by the bank where the check was deposited (institution name and location, timestamp, etc). Some banks make these available via online banking, and at some banks you have to ask for them. Banks have no problem providing these to the account owner, IIRC it's actually required by law.

When he asked for the information or a name associated to the thieving account, they refused.

There is no "thieving account" here. The transfer was a "push" type transaction. That is, it was initiated from - and presumably authorized by - the sending account. The bank won't give you ownership information for the destination account because in the general case, they don't necessarily know who owns that account. In this specific case they do (since it's at the same bank), but they still won't give it to you. Otherwise, all I have to do is transfer some money to a random account number, claim fraud and get the bank to give me all sorts of information about the owner of that account, and then use that information to help me take over the account.

If this was a "pull" type transaction (initiated by the recipient, like an ACH debit), then you could reasonably say that there was a "thieving account". Banks have a completely separate process for disputing fraudulent charges, however.

In this particular case none of this information would even be useful to you. The target account is likely also a hijacked account, and the money gets laundered through several intermediate layers across multiple institutions to make it hard to identify the culprit.

When he talked to their fraud department, he asked them if they were interested pursuing the thieving account. They said that was not what their department did.

Pursuing criminals is what law enforcement agencies do. This type of work requires a wide realm of legal authority and privilege that a bank's fraud department does not (and should not) have. The fraud department's job is to do what they can to prevent fraud from happening, to detect and identify any fraud that occurs, to comply with legal requests from the law enforcement agencies that investigate those fraudulent activities, and to assist customers with going through the bank's internal fraud reporting procedures.

The long and short of this is that you're trying to do the police work yourself. Neither you nor the bank is equipped to do this, from a practical or a legal standpoint. Report the fraudulent activity to your local authorities and let them investigate it. They have experts that can do more in an afternoon than you can do in a month. They also have a wealth of information from other peoples' reports that they can combine with yours to catch the criminal faster. Perhaps most importantly, they have the ability to collect and record evidence in ways that do not alert the suspect and that ensure that said evidence is admissible in future court proceedings. Try to collect evidence yourself and you risk a court throwing it (and the rest of the case) out for some procedural technicality. Police don't always investigate cases like this that involve small amounts but in your case, you already know or at least have very strong suspicions about the identity of the culprit. Report your ex for fraud and forgery, provide the police with all of the information that you have so far, and let them handle it. A copy of that check with your forged signature, her signature on the back, and her handwriting on the front is what the police like to call "exhibit A". The more information you can provide, the more likely it is that the case will be investigated in a timely manner.

Answer 3

I understand your frustration at feeling as though banks may not care about fraud, but they do. You have to realize though that there are limits to what they can do. It is up to the police or other authorities to pursue criminal investigations, and to the extent the local laws allow it (in most jurisdictions even the police need warrants or court orders to obtain records) banks are cooperative.

In the same way that retailers don't pursue criminal charges in every shoplifting case out of sheer practicality and expense, banks are be no different.

And just because the banks don't give you information you request or share details of their investigations doesn't mean they aren't doing ANYTHING, they just don't have an obligation to tell you.

Did you file a criminal complaint against your girlfriend for what she did? If not then why not, and why do you expect the bank to if you wouldn't? Why did you stay with her after the first incident, and where is your responsibility to safeguard your accounts? If you didn't file a police report then the bank likely viewed it as a domestic situation that you need to resolve yourself. They are not going to arbitrate a civil issue. Had you filed a police report then the bank would be obliged to cooperate with any investigation.

There are plenty of ways to protect yourself for free from people opening accounts in your name, such as locking your credit files and using credit monitoring to alert you to suspicious activity. Had you done this, your girlfriend couldn't have done any of what she did.

The point is, stop being mad at banks for not doing what you won't bother doing for yourself. And for what it's worth, banks (like any business) simply pass the costs of fraud loss on to the customers in the form of higher prices. Filing insurance claims on anything but the worst cases only drives up their premiums.

Answer 4

To answer the question as posed:

There is a trade-off where more stringent policies will cause people to use the services of the bank less, resulting in lower profits for the bank. Why else should credit card security remain so laughably bad, where you basically give a third party all the information necessary to withdraw as much money as they want from your account, and that information is physically printed on the card, which you are supposed to give to strangers? Why should so much be tied to the social security number, treating it as a secret but not guarding it?

The banks have decided that keeping things simple and insecure is more profitable for them, even if they need to reimburse victims of fraud from time to time—which is covered by the fees which are higher than they would have been had more secure policies been in place.

You can’t do anything about that other than studying your bank’s terms of service very carefully to find out who bears which risks, and switching banks if the terms are unacceptable (though don’t expect other banks to be significantly different in that regard).

Answer 5

This is all from a US perspective. I lived in Canada for a long time, but most of my complicated banking experience is based on my 30 years in the states

I think @bta has a good answer as to why the bank reacted to your pleas the way they did. If someone forges your name on a check, then the correct response is to go to the police. The bank will furnish you with a check image to use as evidence, but that's about it. Banks no longer do much signature checking on checks; check clearing is a completely automated process now. But, signatures do matter when it comes to proving a crime.

If your friend thinks that someone has stolen his/her identity, then the police are a good first step. The next step is the credit reporting agencies (Equifax, et al). If you look up "my identity was stolen" on the internet, you'll get a bunch of sludge ads for the LifeLocks of the world, but then you'll get: https://www.usa.gov/identity-theft which includes information about how to avoid identity theft and what to do afterwards.

Banks and financial institutions do have specific obligations around identity theft. Under the Red Flags Rule (https://www.ftc.gov/tips-advice/business-center/guidance/fighting-identity-theft-red-flags-rule-how-guide-business), financial institutions must have a plan for how to prevent identify theft for their customers (well, at least folks who owe them money).

Credit card issuers also have very definite anti-fraud and identity theft legal responsibilities. Because of the current legal framework they operate in (in which they are mostly responsible for fraud losses), their interests and your interests align pretty well. If you become a victim of identity theft or credit card fraud, you are very likely to find out by a notification from your credit card company's fraud department. They are very good at what they do.

Finally, credit reporting agencies (Equifax,...) also have very explicit responsibilities when it comes to identity theft. If you suspect that you have had your identity stolen, the CRAs should be high on your list of "what to do now".