MarketWatch
These banks are tops at protecting consumers from ID fraud
Tuesday November 6, 5:02 pm ET
By Andrea Coombes
U.S. banks vary widely when ranked on protecting consumers from fraud


SAN FRANCISCO (MarketWatch) -- Bank of America Corp. took top honors for the second year in a row in a report ranking the largest U.S. banks on how well they protect their customers from fraud and identity theft.

J.P. Morgan Chase, Washington Mutual Inc. and Wells Fargo Co. tied for second place, and Citibank came in third in the study published Wednesday by Javelin Strategy & Research.

The study looked at 25 banks that together hold 50% of U.S. checking-account deposits and counted only banks that have a brick-and-mortar presence. The study measured banks' policies for preventing, detecting and resolving fraud, focusing on measures that consumers experience, not internal bank security policies.

For instance, banks got top marks for alerting customers of unusual transactions -- say, a wire transfer to a foreign country or an unusually big withdrawal amount, said James Van Dyke, president of Javelin Strategy & Research, a Pleasanton, Calif.-based research company specializing in financial services and payments.

"Alerts are particularly important because almost one out of two cases of identity fraud are first detected by the individual," Van Dyke said. "It's easier for individuals to protect themselves when banks provide the right capabilities."

Bank of America (NYSE:BAC - News) scored 78 out of a possible 100 on Javelin's measures, followed by J.P. Morgan Chase (NYSE:JPM - News), Washington Mutual (NYSE:WM - News) and Wells Fargo (NYSE:WFC - News) with 70, Citibank (NYSE:C - News) with 69, BB&T Corp. (NYSE:BBT - News) with 68, and Wachovia Corp. (NYSE:WB - News) with 61.

On average, the 25 banks in the study scored 53. Lowest-ranked were Comerica with a score of 24, Banco Popular with 31 and Bank of the West with 35.

The banks studied did well overall on resolving identity fraud, with 77% meeting Javelin's recommended criteria, including offering consumers zero-liability for some instances of fraud and easy access to identity-theft resolution services. But more banks fell short on Javelin's measures for preventing and detecting identity fraud, with 44% meeting recommended measures on preventing fraud and 51% on detecting fraud.

Most of the banks in the top seven were also among the top scorers last year, but Wells Fargo, Citibank and Wachovia all managed to improve their scores five to 10 points overall, according to the report,

Ideal meets reality
To conduct the study, Javelin designed an ideal bank and then compared banks and credit unions against the ideal.
"We go out posing as a customer, we call the bank, go to the Web site, contact them as many as six times to make sure we get it right, to come up with a very structured rating," Van Dyke said. The study did not look at internal measures banks might have in place to protect consumers, focusing instead measures that customers will see.

"Some of these banks do an outstanding job behind the scenes, but they just don't have those customer-facing features that can make such a difference," Van Dyke said.

"People are very motivated to protect themselves ... when you work with the individual and you let them know what's going on, it's kind of like seeing a doctor. If you don't have information as a patient, you can't take the steps that you should take for your own health."

Banks got high marks for not using customers' full Social Security numbers as identifiers, as well as for allowing customers to turn off paper statements. "That mailbox in front of your house, even with a lock on it, they really aren't much protection," Van Dyke said. "The best banks allow customers to turn off paper statements."

The top-scoring banks also alert customers when a change of address is logged to the account. "We find in two-thirds of the cases where there was somebody doing an account takeover, the criminal had changed the address" on the victim's bank account, Van Dyke said. That lets scammers receive the account's bills, delaying the time that the victim detects the crime. "Roughly one-third of banks notify the customer via an alert when the address changes," he said.

Ideally, Van Dyke said, banks will offer alerts and require customers to approve unusual transactions. Plus, he said, banks should let customers make such approvals via their mobile devices. For instance, a customer would receive a cell-phone message that approval is required for a $1,500 checking-account withdrawal.

"It's really the wave of the future in consumer security," he said.