There had been some unusual activity on his account.
“She asked if I had made some transfers,” said Sanchez, 46. “She told me not to worry and she would call me back.”
A few hours later somber bank officials showed up at his office to advise him that his company accounts, totaling almost $300,000, had been temporarily blocked for security reasons. Sanchez says he was assured it was all “a misunderstanding.”
It wasn’t until a week later that the bank told him he had been a victim of Internet fraud. All his money was gone.
But the bank still insisted he shouldn’t worry. “They said it was being investigated and I would get my money back,” said Sanchez, a father of three and the Mexico representative for a large North Carolina electrical engineering firm, Reliance Electric.
But almost a year later Sanchez hasn’t seen a cent. And his bank — Spanish-owned BBVA Bancomer and Latin America’s second-largest financial institution — says he won’t get any.
Such is the fate, it seems, of Mexican victims of online bank fraud. Whereas banks in the United States and Europe guarantee the security of client accounts, in Mexico the rules are reversed.]]>
Clic to Enlarge
“The banks simply deny any responsibility,” said Enrique Arias, director of
financial analysis for the National Commission for the Protection and Defense of
Financial Service Users, CONDUSEF. “Unfortunately there is a lack of regulation
and clients have little recourse.”
In recent months dozens of cases have appeared in the Mexican press and on an
Internet Web site decrying online fraud. Banking authorities admit there is a
problem, with losses in the millions of dollars. But so far little is being done
to address it, or to help victims retrieve their funds.
“It’s a case of benign neglect,” said Tom Cash, a business intelligence expert
with Kroll, a U.S. risk consultancy company that has advised a number of banks
in Mexico. “Absent a customer backlash, they are going to continue looking at it
with indifference.”
Customers are now beginning to speak out, as well as file a number of lawsuits
against two foreign-owned banks, Santander Serfin and BBVA Bancomer.
One victim, Jose Luis Rojo y Arabi, a gruff former Mexican police commander, is
organizing a group of complainants in a class-action lawsuit seeking to have the
banks thrown out of Mexico.
“We are not going to win,” said Rojo y Arabi, who heads a private security firm
specializing in rooting out corruption. “But we are going to kick up such a
storm of bad publicity that everyone is going to get their money back.”
He is seething after someone fraudulently withdrew about $25,000 from his BBVA
Bancomer accounts over two days in February. The bank insinuated his company’s
long-serving accountant was responsible. After she passed a lie detector test,
Royo y Arabi is convinced the fraud was carried out hackers in cahoots with bank
staff.
“The bank doesn’t seem to care,” he said. “They behave like they are at the
beach, happy as clams.”
Ivan Forcada, a 30-year-old self-employed civil engineer, lost almost $5,000
from his account at BBVA Bancomer and can’t afford attorney fees.
Forcada was saving up to buy a car when he discovered four fraudulent transfers,
including $300 cash drawn on his bank credit card. The bank turned down his
claim and recently wrote him a letter informing him that he now owes $400
interest on the credit card debt. He says he has also been threatened with a
lien on his house if he doesn’t pay.
“They treat you as if you are the one committing fraud, or else as a careless
idiot for not looking after your password,” he said. “But it’s their internal
controls that failed.”
Forcada and others say a lack of regulation in Mexico has left the Internet
banking system hopelessly vulnerable to fraud, while banks make millions
promoting it to their clients as a fail-safe and convenient way to handle money.
The truth, they say, is that some — though not all — Mexican banks have failed
to invest sufficiently in proper security systems and fire walls since online
banking was introduced in that country about six years ago. Banks also rely on
sloppy employment practices, including outsourcing many jobs to temporary
employees over whom they exercise little control.
Arias, 36, a former bank auditor, says banks typically hide behind bank secrecy
laws to avoid divulging information that might incriminate their staff. When
staff members are caught, banks reportedly prefer not to prosecute in return for
at least partial recovery of the stolen funds. Analysts say banks seek to limit
damage to their reputations, which could undermine public confidence and cause a
run on the bank’s assets.
But critics say that policy may prove counterproductive in the long run if not
enough is done to bring fraud under control. For example, banks are eager to
sign up anyone who comes in the door, but fail to check the personal information
of new clients, creating a hackers paradise, Arias said.
Online banking is expanding rapidly in Mexico, proving lucrative for the banks.
In 2005, transactions via Internet tripled from 13.3-million to 42-million,
according to the Bank of Mexico.
Officially, Mexican police acknowledge only $2-million in reported cases of
online bank fraud. But CONDUSEF estimates the figure to be as high as $600-million,
affecting as many as one in 3,000 accounts.
The largest known case involves $1.2-million being contested in court, involving
Banamex, a U.S.-owned bank, and a stock market trading company, according to
local media reports.
“In Mexico, nothing happens,” said Cristina Ramirez, a former top bank executive
at Chase Manhattan, who saw $100,000 disappear from her account the day after
Christmas. “It comes out in the press and no one pays any interest. People here
are used to getting (cheated) and not being able to defend themselves.”
Analysts say the worst offenders are the big Spanish banks, Santander and BBVA,
which have busily gobbled up banks in this hemisphere in recent years. They
recently began moving into the U.S. market. BBVA last week announced a major
acquisition in Texas, making it that state’s fourth-largest bank.
Citibank subsidiary Banamex has also been hit hard by fraud, but in most cases
the bank accepted responsibility and reimbursed clients. Other smaller Mexican
banks have also adopted rigorous security and reportedly have a far lower rate
of fraud. One bank, Ixe, even installs special security devices on home
computers to protect users.
Santander declined requests for an interview. In a written response to questions,
BBVA said it does offer fraud guarantee to its clients, as well as special
antifraud services, including a system whereby a client can request that he be
advised by cellular text messaging of any transaction over a certain amount.
But the bank denied it was at fault, instead asserting that online fraud
targeted “the weakest link in the chain: the client.”
In most cases the victims were long-time bank customers, with “preferred client”
status. Typically the fraud took place either at the weekend or after hours. The
fraudulent transfers were also wildly at variance with the clients’ normal
account activity, but the banks took no action to intervene.
Alejandro Sanchez said it wasn’t until 40 days after the fraud on his accounts
that BBVA Bancomer informed him that his money could not be retrieved.
“I nearly fell off my chair,” he said.
BBVA Bancomer gave Sanchez a letter saying that the missing money had been
transferred by use of his confidential password, which the bank said was “the
exclusive knowledge of the account holder.”
It went on: “We regret to inform you that the operations were carried out
without the responsibility of the (banking) institution.”
The bank later contacted him to say it had recovered about $50,000. But the bank
refused to give it to him until he sign a letter waiving any legal claim against
the banks over the outstanding amount.
“I told them to go to hell,” he said.
Meanwhile, Mexican authorities are studying bank reform. A new bank law approved
by Congress in March was six years in the making. But analysts say it is already
out of date and doesn’t tackle bank secrecy issues.
While the law does force banks to give up information about the destination of
fraudulent transfers, Arias says it does not go far enough.
For instance, banks are not required to provide the names of staff who handled
accounts hit by fraud, or the times they had access.
On the positive side, banks must now warn clients about the risks of online
banking, as well as updating their security systems.
The new rules “will make the use of Internet banking in Mexico one of the safest
in the world,” said Carlos Marmolejo, a spokesman for the Banking Commission.
But Sanchez and the other victims aren’t holding their breath. All have either
switched banks or stopped accessing their accounts online.
“They expect us to deposit our money and our faith in banks,” he said. “But the
way things are, we might be better off going back to the days when we kept our
money under the mattress.”
Times Latin America correspondent David Adams can be contacted at dadams@sptimes.com.
Gina Manfredo is a freelance reporter based in Mexico City.
http://www.sptimes.com/2006/06/17/Worldandnation/In_Mexico__bankers_ma.shtml
]]>