Feeds

FSA fines stockbrokers for poor data security

Multiple failures put customers at risk

Choosing a cloud hosting partner with confidence

A firm of stockbrokers has been fined for failing to adequately protect its customers from the risk of identity fraud. The Financial Services Authority (FSA) said its mistakes included failing to manage the risks introduced by staff using instant messaging and web-based email.

Merchant Securities Group Limited also failed to verify the identities of customers that contacted the firm by telephone. Instead, the firm relied on being able to recognise customers' voices and talking with them informally about personal matters such as holidays or hobbies. Personal account numbers which could be used with a customer's name to access account information were included in routine letters.

The FSA also found that back-up tapes containing unencrypted customer information were stored overnight in a bag at the home of a member of staff.

The London-based firm also failed to implement adequate controls "to mitigate the risk of customers' personal data being transmitted outside the firm by failing to prevent the use of instant messaging and web-based email," according to the penalty notice (pdf) served by the FSA.

A spokeswoman told OUT-LAW that the FSA does not ban instant messaging and web-based emails in regulated firms. Its concern is focused on firms understanding and managing the risks.

"They [Merchant Securities] didn't show that they were aware of these tools being a risk or how they could manage that risk. There was no way to check what they had sent out or be able to retrieve it," she said.

"It's not about saying that firms mustn't use Instant Messaging and web-based email, it's about understanding the risks involved with those tools and how to manage those risks."

It is the first time the FSA has fined a stockbroking firm for weak data security controls. However, there was no evidence during the FSA's investigation that customer details had been lost or stolen.

Margaret Cole, Director of Enforcement at the FSA, said: "It is unacceptable that despite increased awareness of data security issues, a firm should be so careless about its systems for protecting customers' personal details. People have a right to expect their details to be kept secure and firms should be committed to treating their customers fairly in all aspects of their business."

Merchant Securities' failings came to light in September 2007, during a visit by the FSA, rather than through their own systems and controls. Merchant Securities co-operated fully with the FSA and agreed to settle at an early stage of the FSA's investigation. It qualified for a 30 per cent discount under the FSA's executive settlement procedure. Without the discount, the fine would have been £110,000.

In the last three years, the FSA has fined Norwich Union £1.26 million, BNPP Private Bank £350,000, Nationwide £980,000 and Capita Financial Administrators £300,000 for failings relating to information security lapses and fraud.

Copyright © 2008, OUT-LAW.com

OUT-LAW.COM is part of international law firm Pinsent Masons.

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.