How easy for bank staff to access account without authorization?

dunstonh

Would make an interesting complaint.

Dear bank, I wish to complain that one of your employees can access details on my bank account with you. I am not happy about that. Yours sincerely.....

It would give the complaints team a laugh. They would of course inform the staff member but as no wrongdoing has taken place then there is no complaint to answer and the staff member will not have a black mark against them. It would just result in the friendship being over.

I know for example with RBS/Natwest they are able to play the screens back to see every action that had taken on account. They could even tell you how many times you have used the delete button in the day if they wanted to lol

Are you sure they havent just told you that to scare you into being careful? It would be quite dangerous data to store as anyone viewing that could access password data of other staff members.

Back in my banking days, there was an audit trail of transactions or edits made to account and personal data but nothing on view only apart from on the main data store but you would need time/date to find that. Ok, that was a long time ago now and things will have changed but if something has only been viewed then no wrongdoing has taken place and it just seems like a petty complaint.

stclair

dunstonh wrote: »

Would make an interesting complaint.

Dear bank, I wish to complain that one of your employees can access details on my bank account with you. I am not happy about that. Yours sincerely.....

It would give the complaints team a laugh. They would of course inform the staff member but as no wrongdoing has taken place then there is no complaint to answer and the staff member will not have a black mark against them. It would just result in the friendship being over.



Are you sure they havent just told you that to scare you into being careful? It would be quite dangerous data to store as anyone viewing that could access password data of other staff members.

Back in my banking days, there was an audit trail of transactions or edits made to account and personal data but nothing on view only apart from on the main data store but you would need time/date to find that. Ok, that was a long time ago now and things will have changed but if something has only been viewed then no wrongdoing has taken place and it just seems like a petty complaint.

No ive seen it humpteen times with my own eyes Passwords are not visible its stared out or nothing shown at all depending on the system being used. They would never show you that anyway they would only show you what you need to see..

2sides2everystory

MoneySaverLog wrote: »

Banks are very strict with their data, they have to be.

With the staff turnover they have even in the UK and the multiple call centres around the world accessed by people who get paid peanuts compared to the clients?

Get real people - there's no magic - there's heaps of data and there's bent bank staff and there's internal fraud people. For every case of dodgy access they discover there must be ten or even a hundred they don't.

Take branch staff access for example, with most major banks thesedays, any person could visit any branch and expect the same service as their "home" branch and so any staff member could have a reson to access the entire record. You can imagine all sorts of scenarios where the computer might be programmed to flag up unusual examples where the customer was clearly not present and had never been present in that location before, but if the staff member was clever he might think of a way to find top level records and then not set off any particular trigger.

The only time data access audit records get accessed is when someone decides there is cause to investigate which is either when set patterns of suspect access get flagged by the computer or someone acts on a hunch. Otherwise it is just business as usual until someone complains specifically.

The banks do spend money on vetting staff but it is by no means foolproof. The numbers of 'wrong uns' are kept to 'manageable' proportions so we don't read about it too often, that's all.

Google some appropriate keywords if you want to scare yourselves/reassure yourselves

Gromitt

If you bank with co-op, then the customer services advisors know all your security questions and so could login into internet banking as you if they really wanted to (and the really dumb thing that your phone banking questions are the same as your internet banking questions). All they would need would be your account number and sort code. However, considering this is gross misconduct on a serious level, they would probably be charged with fraud, not just lose their job.

Of course, they'd still need a reasonable excuse to obtain your sort code & account number and bringing up your questions screen (such as you using telephone banking), otherwise it would raise red flags.

power2consumers

Thanks for all the responses and its good that most people agree that its a serious issue. I wonder why all accounts are not made so that they cant be accessed without a password, so employees trying to access on their own accord (not as part of role requirement) would have to answer 3 characters/digits of the account password.
One answerer asked what do I have to hide. Well, health, finance, and family life are 3 things that any man/woman should have complete control over who knows what amongst those that they know. Everyone has a right to keep their income private and not have prying/nosey people accessing their account themselves/through contacts the minute they see someone spending a bit of money. Also, this probably is rare, but also career criminals could target people with money this way. e.g, they see a local business man with a nice house nice car, find out his name, and if they know employees in different banks ran the name through and might get lucky. I have heard 2 cases of people that deposit sums to a set routine and have ended up being robbed on their way to the bank. Now, might be coincidence, individual scouting by scum bags, or tip offs by employees at the branch.

antrobus

power2consumers wrote: »

Thanks for all the responses and its good that most people agree that its a serious issue.

Which is why there is such a thing as a banker's duty of confidentiality to the customer and why we have such a thing as the Data Protection Act.

power2consumers wrote: »

I wonder why all accounts are not made so that they cant be accessed without a password, so employees trying to access on their own accord (not as part of role requirement) would have to answer 3 characters/digits of the account password.

You can't access any accounts without sticking a password in, and it might well be a 'role requirement' for all customer facing staff to have default access to all the bank's customer accounts.

power2consumers wrote: »

One answerer asked what do I have to hide. Well, health, finance, and family life are 3 things that any man/woman should have complete control over who knows what amongst those that they know. Everyone has a right to keep their income private and not have prying/nosey people accessing their account themselves/through contacts the minute they see someone spending a bit of money.

Bear in mind that your bank account is simply the record of the transactions that have taken place between; a) you, and b) the bank. The bank has the same rights to access that information as you do.

power2consumers wrote: »

Also, this probably is rare, but also career criminals could target people with money this way. e.g, they see a local business man with a nice house nice car, find out his name, and if they know employees in different banks ran the name through and might get lucky. I have heard 2 cases of people that deposit sums to a set routine and have ended up being robbed on their way to the bank. Now, might be coincidence, individual scouting by scum bags, or tip offs by employees at the branch.

Quite possibly, but the 'employees' concerned could have 'tipped off' their criminal mates about the sums being deposited to a set routine even if they had no access to the bank's systems at all. It only takes a pair of eyes to see a pile of cash being taken in over the counter.

bengal-stripe

power2consumers wrote: »

I trust him in many-ways, but I don't trust him with regards to snooping just to satisfy his curiosity and lust to know everything.

Well...............have you been telling porkies and are afraid to be found out?

Fiddlestick

power2consumers wrote: »

Everyone has a right to keep their income private and not have prying/nosey people accessing their account themselves/through contacts the minute they see someone spending a bit of money.

My boss, my director, the bank, my partner and the tax man all know my income.

I don't consider it particularly secret.

Fiddlestick

antrobus wrote: »

Quite possibly, but the 'employees' concerned could have 'tipped off' their criminal mates about the sums being deposited to a set routine even if they had no access to the bank's systems at all. It only takes a pair of eyes to see a pile of cash being taken in over the counter.

I'd be more worried about the call centre staff to be honest.

I know for a fact that fraudsters hang around outside call centres and follow staff to the pub so that they can offer them money to hand over customer account details.

I absolutely will not name the bank or the call centre in question, but I know people that have worked there and it happens regularly.

The staff are supposed to report it, but in all honesty there is little that banks can do other than trust in the integrity of their staff and their monitoring systems.

Gromitt

Fiddlestick wrote: »

I'd be more worried about the call centre staff to be honest.

I know for a fact that fraudsters hang around outside call centres and follow staff to the pub so that they can offer them money to hand over customer account details

Which makes me concerned about co-op internet banking, where you have to ring up someone in a call centre and hand over your entire security information (including PIN) for them to type into a computer to setup your account. Sure, every action they do can be logged, but I doubt there is a camera about every employee, so what is to stop them writing the information on a piece of paper and handing it to someone else at the pub for £50 ?

Whilst we don't know about how other banks work and what the call centre staff have access to, from the customer point of view they seem more secure and so the customer is more confident. For example, I got the co-op staff to tell me my PIN number when I forgot it (they asked a lot of questions, including the switching account number, but the fact is, I still got it). When I told Saffron BS I'd forgot my password, they said they would have to send a temporary password via the post so I could change my password online. They didn't know my password, nor could they change it from their 'interface'.