Merchant Securities fined £77,000 for security lapses

Merchant Securities Group has become the first stockbroker to be fined by the regulator for failing to protect its customers from the risk of identity fraud.


The Financial Services Authority (FSA) fined the firm £77,000 after discovering a number of datasecurity problems in a routine visit in September 2007.


There were no controls for verifying a customer's identity over the phone and staff had relied on recognising customers' voices and talking informally about their holidays and hobbies in order to determine who they were.


The firm also sent out a routine letter which included customers' personal account numbers, which can be used to access account information.


Customer details were also jeopardised when a back-up tape of encrypted personal details was stored at the home of a staff member. Although there was no evidence that the customer details had been lost or stolen, Merchant Investors had failed to address the risks involved.


Margaret Cole, director of enforcement at the FSA, saidthe firm's behaviour was unacceptable.


'It is unacceptable that despite increased awareness of data security issues, a firm should be so careless about its systems for protecting customers' personal details. People have the right to expect their details to be kept secure and firms should be committed to treating their customers fairly in all aspects of their business.'


Cole said that a recent data security report showed that many firms still needed to do more to get security right and warned that the FSA would not wait until information has been lost or stolen before action was taken.

6/17/2008

Reuters