Stolen Laptop May Contain Personal Info
Bank Rhode Island has announced the theft of a laptop computer that held personal information for as many as 43,000 BankRI customers, more than half the bank's customer base. The theft of the laptop containing the missing information — including customer names, home addresses, and Social Security numbers — was first reported by Fiserv, Inc., the principal data service provider for BankRI.
BankRI stressed that key account access data for the customers in question — such as personal identification numbers, account passwords, debit or ATM card information, and other financial data — was not present on the stolen laptop. "There is no risk to any BankRI accounts as a result of this incident," said BankRI President and CEO Merrill Sherman. Fewer than 100 BankRI account numbers were included, according to bank representatives, and these were not identified by account name.
"We believe disclosure is the right thing to do," said Sherman in a BankRI press release. "We have a relationship with our customers based on trust. Part of that trust comes from an expectation of honesty and transparency. Disclosure to our customers also will further lessen any risk, however small, for potential misuse of this information."
What the company's announcement failed to note, however, is that although the absence of account information may well nullify the risk to existing accounts, bank customers whose Social Security numbers were on the stolen machine are still at risk for what fraud investigators call "true identity theft."
Fraud experts distinguish between two primary classes of economic crime related to identity theft. Account takeover occurs when an identity thief acquires a person's existing credit or bank account information and uses the existing account to purchase products and services. The scam is generally first noticed with the arrival of a monthly bill or bank statement. In true identity theft, on the other hand, the perpetrator uses a victim's Social Security number (SSN) and other identifying information to fraudulently open new accounts, using a false address to avoid detection by the victim. Because a victim may be unaware of true identity theft for an extended period of time, the ruse — and the damage to the victim's finances and reputation — may continue for months or even years, with victims' information often passed on from criminal to criminal.
An ongoing investigation into the theft had produced no announced results at press time, and the laptop has yet to be recovered. BankRI representatives have emphasized that they have, as yet, no indication that the information has been misused or improperly accessed. As a precaution, the bank has notified all customers whose information may have been on the stolen laptop and has established a dedicated hotline for affected BankRI customers at 877-540-5541. BankRI has also established a toll-free hotline to TransUnion, a nationwide credit reporting agency, which affected customers can use to confidentially review their credit accounts and discuss specific steps they can take to avoid fraud.
"Fiserv has been proactive in addressing this incident," said Sherman, "and we are assisting them, the FBI, and law enforcement agencies in their investigation." Representatives of Fiserv General Counsel Charles Sprague, when asked whether customers should be made aware of the risk of true identity theft posed by the missing data, called such concerns "speculative" and declined further comment. 
