Banks at risk of ID theft charges

HIGH Street banks have been warned that they risk being prosecuted for allowing customers' identities to be stolen by call centre workers in India.

Fraudsters are buying bank and credit card details for only £3 a person, enabling them to raid the accounts of Britons or clone their cards.

The scare came to light when an undercover reporter paid Kkaran Bahree, a 24-year-old website analyst, £3,000 for the details of 1,000 British customers.

As authorities in the UK and India began inquiries, banks came under fire for moving thousands of call centre jobs abroad to save money.

Fraud experts warned that the security breach was likely to be the 'thin end of the wedge' as more financial institutions switch jobs abroad.

Steven Philippsohn, a lawyer who advises the Home Office on technology-based crime, said: 'People have no idea of knowing just how far and wide their details are circulated. Any cost savings for UK businesses need to be offset by the damage to consumer confidence and the rising tide of identity theft.'

Bahree, who has gone on the run, worked for Daksh eServices, a subsidiary of IBM, in Delhi's Gurgaon district, where nearly 40 call centres are based. He said he could get up to 200,000 account details a month. He handed over account holders' secret passwords, addresses, phone numbers and details of their credit cards, passports and driving licences.

He even had the issue and expiry dates, and the three-digit security number from the back of the credit cards. The details could allow a fraudster to drain someone's bank account, buy goods over the internet or telephone using their credit card or apply for credit in their name. Bahree claimed he got the information from corrupt call centre workers.

Banks such as Barclays, HSBC and Lloyds TSB have all recently moved call centre jobs to India. Yesterday, the data protection watchdog said the suspected breach could lead to banks being prosecuted under the Data Protection Act 1998.

The Information Commissioner's Office said: 'There are clearly questions for them to answer regarding the steps they are taking to ensure the security of customer data that call centre staff have access to.'

The City of London Police began an investigation after being given a dossier about the alleged fraud by The Sun. But it was unclear what jurisdiction they would have over an alleged crime in India, which does not have data protection laws. In Britain, the maximum penalty under the Data Protection Act is £5,000.

Many banks said it was too early to say if their customers had been affected. They also defended their procedures for checking staff. Ian Mullen, of the British Bankers Association, said: 'Staff are vetted but with over a million people in the business you occasionally get a bad apple.'

But the Amicus union accused the banks of profiting at the expense of consumers' security. A spokesman said: 'We have quite robust data protection legislation in the UK, and you can regulate more effectively. It's much harder to do that in India.'

The Financial Services Authority said Indian call centres posed no greater security risk than ones in the UK. It said staff at the centres were not allowed to use mobile phones or cameras, and the computers did not have hard drives or access to the internet or e-mail.