How Outsourced Call Centers Are Costing Millions In Identity Theft
A former Chase call center rep tells the story about this one thief who was able to rip off one customer for over $40,000, thanks to his constant outwitting out the internationally out-sourced security department. It wasn't that hard. Over and over again, he was able to commit credit card fraud just knowing the guy's name, social, and mother's maiden name.
The Americans would beg and plead with the Filipinos to not unblock the account, and over and over again they would. Says our insider, "if US security had been able to intervene from the get-go, he would never have been able to do so much financial damage. For the rest of his life, the true owner of that account will be dealing with the effects of this crime." It's not the outsourced place's fault, though. They're just following orders. It's whoever designed the laminated binder they were blindly following that should really be held accountable. Read the whole messed-up story below.
Our insider writes:
A guy calls up on the direct number, his voice is distinctive: deep, but nasal, like he has a cold. I ask for his name and account number. He tells me his name but says he doesn't have his card with him. Step two: I ask for his social security number. He "ums" and "uhs" for a second and I'm certain I hear a faint rustling of papers in the background. The number he gives me isn't linked to any account on file. As soon as I tell him this, he hangs up. It was odd, but I wrote it off. Calls came at a snails pace and it wasn't unusual to have 20 minutes in between them. So when a couple of minutes later I got another one, it was strange. Once again it was a call from the direct number. I ask for name and number and the voice is strikingly similar. The name he gives is different but again he has no number. I ask for the SSN and again I can hear papers rustling while he stalls. This time an account pops up. He fails verification of the mother's maiden name and immediately hangs up. By this point I'm laughing about it with my co-workers because he seems such an inept thief. As the nights go on, we start to get more calls from him. I say "we" because this was the only call center that the phone number goes to and there were only about 15 of us on staff at any given time. He had the same mannerisms for every interaction and it became such that as soon as any of us got one of these calls we immediately put him on hold (usually making up some innocent sounding excuse) and tried to put him through to security. The problem with the Philippine security department quickly became apparent.The US security department had access to LexisNexis. If you're not familiar with it, it's basically a encyclopedia of everybody's life. Previous addresses, family member's names, jobs, schools, anything and everything that could be linked to your name and/or social security number. As an example of how incredibly (and frighteningly) thorough it is, when my now 30 year old brother was a tot, he liked to respond to junk mail with a fake name; this fake name came up as a former occupant of my parent's address when I got a chance once to do a search on myself (we had it in collections). Chase didn't trust the Philippine department to have it though. In fact, the only information they had the ability to verify was what was on the account: name, social security number, mother's maiden name, and recent purchases if they felt like being that diligent.
Here's the part of the story where some poor guy's account get's completely f-ed. This thief had been bounced to the out-sourced to security so often that he must have made a check list of any possible questions they would ask him. Through whatever means, he managed to get the answers to these questions. Now when he called, he could give us the information we were asking for, but by this point we knew his voice so well that we still tried to get him to security. It worked like this: We put him on hold and dial the extension for security. We get a security rep and start to explain the situation; we tell them he was able to give the right information, but that we know is the same guy that's been calling for weeks and we are certain he is not the account holder. They begrudgingly take the call. Minutes later another one of us gets a call from a security rep saying they are giving us a customer who has been cleared by them. And here the thief was back in our department. For those of us who had come to know him, the fight waged on night after night.
Chase is a revolving door. If you work there longer than a year, you're considered to have seniority. The few of us who knew this account was being raped could do nothing to protect it. Some newbie wouldn't know about the situation and would let the thief have his way with the account. The US security department became aware of the issue and put blocks on the account as well as incredibly long notes that explicitly said to not remove the block for any reason at any time. But sure enough, over and over, the guy would call in overnight, talk to the out-sourced security, and the block would be removed. Again, they were only able to verify with him with information that he was already known to have, yet that never seemed to deter them from clearing him.
Things got quiet for a while, and we thought maybe he'd finally been stopped from unblocking the account. Turns out that he'd actually been caught, but only after more than $40,000 in fraudulent charges on this one account. I cannot stress enough that if US security had been able to intervene from the get-go, he would never have been able to do so much financial damage. For the rest of his life, the true owner of that account will be dealing with the effects of this crime.
I wish I could this was the only time I saw the security department failing at securing an account. There was a consistent problem with the overt cultural difference. A man calls in and says he's the cardholder "Angela" and you find yourself trying to explain to security that Angela isn't a man's name and the odds of it really being his name are slim. And they just see it as cut and dry: He says he's Angela, so he must be.
To be fairer than Chase deserves, I'll note that I've been out of there for almost two years, so it's quite possible that it's all ponies and rainbows now. I'm gonna go ahead and assume though that it's run as poorly as ever.
(Photo: brycej)
Post a comment
Comments:
Maybe I'm missing or misunderstanding something, but why the hell would Chase give outsourced security the power to override US-based security?
Seems like a pretty easy way to fix/prevent this problem!
Just last week Chase called to tell me that my card number had popped on a list of numbers that may have been compromised. They asked if I had made any purchases in Greece lately, and after I let them know that I had never been Greece, let alone Europe they realized that it was fraud. The sad part is that while they denied each of the charges to my card (3, totally more than $4k) they waited 13 days before calling me to ask about the odd activity. I check my statement online daily and nothing ever showed up on my account.
To be honest part of it is poor training and also cultural differences. People in the Philippines many not know Angela is not a unisex name. Add to the fact that a rude caller can push around a foreign call center worker much easier to get what they want then if they were to get a statside based rep on the line. I think that and like the OP said, the high turnover rate in the States makes it seem a better option to outsource since they workers abroad will most likely stay on the job longer.
"The few of us who knew this account was being raped could do nothing to protect it."
Please cue comments about insensitivity to rape here.
I wonder if the money saved by the companies is less then the loss due to the outsourcing or is it another divisions problem. Its sad to say but lots of time theres no one looking at the big picture.
I love the new nationality that has been invented in this post! Phillipinians! Filipinos would be most accurate but I kind of like the new moniker.
@frodo_35:
Well, it could very well be that someone has done the math and said:
X= savings from outsourcing the call center
Y= expected increase in fraud costs to the issuer from outsourcing the call center
X>>>>Y, so do it.
@starrion: And sadly, the executive will look at this situation as good. Sure, they might be out 40k, but that's what a decent call rep costs a year (if you include bennies and stuff). So they will look at it as the difference of x number of employees making $40k/year minus Y number of employess making $8k/year, and see that they are still rolling in the dough). The screwups and ineptititude are just a cost of doing business.
Why not notify the victim of the fraud directly? Or notify law enforcement directly? Sure, it means admitting that your fraud department is ineffective even against known fraud, but I'd bet the victim or law enforcement could do something about it.
"It's not the outsourced place's fault, though. They're just following orders. It's whoever designed the laminated binder they were blindly following that should really be held accountable" Thank you for putting things in perspective. I see so much misplaced hatred, anger and frustration at the call center employees, they are just doing their jobs, feeding their mouths, following orders, speaking with the the accent they were born with. If some one has to be held accountable its the management team that decides out sourcing is the way, the quality team that runs their performance metrics, the security team that hasnt done their homework and int he end us who want to pay the cheapest prices possible.
Customer service is a huge issue for me when I pick a store or a company to do business with. One of the main reasons I bank with Wachovia (I hope Wachovia's customer service remains in house after the take over) is that when I call with a question or an issue I get a friendly person in NC that understand me (I understand them), understands the account that I'm calling about and can actually solve my problem. I happily pay more for better service.
I long ago severed ties with Citibank (who took over an MBNA account that used to be a Fleet account - sigh) but a mortgage on one of our investment properties was sold to Citibank. I received no notification of the sale or purchase, no notification that my payment date and procedures had changed and when I called Citibank to ask for the $45 bank (fee for late payment due to no notification on change in payment date or change in procedures) I was connected with someone who I could not understand and who could not understand why I had not paid Citibank on time (uh, maybe because I had paid the othe rbank on time and had no knowledge of the sale). After going round and round I gave up and took the $45 hit, but I will never/would never chose to do business with Citibank ever.
@JustThatGuy3: I was actually wondering if they weren't even putting the defrauded money in the loss column, or at least not without a great deal of maneuvering to prevent it. We've all read stories here about identity fraud leading to fraudulent charges that get sent to collections, and those collectors come after the actual account holder. The account holder is hounded and repeats over and over that the charges were illegitimate, only to be told that they don't care, and to just pay.
Are there perhaps people out there doing that? Or do they not count the defrauded charges as a loss while they're still harassing the account holder to pay the charges anyway?
In any case, it's clear that the amount of money that corporations are losing through employees who are either not empowered or capable enough to put an end to identity thieves getting access to the account isn't high enough to get them to remedy the situation the way most of us would like them to...by creating a system that makes it nigh impossible for an identity thief to gain access to your accounts.
Part of me wants to suggest a fine levied on any company that allows such thin, artless thievery to succeed, to compensate for the time, trouble, and difficulty experienced by the customers they are not doing enough to protect. It's only an impact on the bottom line that will make them take action to make our accounts more secure, after all, and apparently the current level of thievery isn't enough to do that.
If you knew the account was being taken advantage of, couldn't you have reported this to the FBI?
Especially if you knew it was an ongoing thing. A one-hit wonder they wouldn't have much luck catching, but this guy could have been caught I'm certain.
Then again, I don't know the rules and laws and such, but I'd have felt obligated to go elsewhere with this information.
@VidaBlueBalls: But at the same time, they never let them post - maybe they were dealing with the charges internally first?
Identity theft is a lot easier than most people think. I recently worked on purchasing a home that was left vacant after the owner died. Trying to get it probated I went to the county records office and asked for a copy of that persons death certificate. No questions asked, I was handed a copy. There it was, the persons social security number, address and parents names. I was shocked I could get that information so easy.
Well, they've already done all that can be done in this broken system to stop the fraud from proceeding. The only thing the customer can do that they cannot is demand the account be closed. (And, uh, no.)
@SadSam:
Yeah, when we're talking about a service industry, and when service is pretty much all you have and all you do, it becomes pretty important.
Once I got locked out of one of my own accounts, and I did sort-of what this guy did -- I kept calling customer service and trying different passwords, on the theory I'd hit on the one I'd set the account up with eventually. (Which I did.)
If you don't get it right on the first try, they tell you that to prevent fraud, they cannot now allow you to access the account. But you could call back every 30 seconds as many times as you want with no consequences or notes in the account.
Pretty crappy security, although since they had no OTHER way to regain access to your account (most places have some kind of verification procedure or affidavit procedure or whatever, I'm sure you guys know), I appreciated it at the time. I had called originally to explain the problem and they told me repeatedly there was "nothing" they could do unless I knew the password.
Why is he telling this story if it happened 2 years ago, and he no longer works there? It would seem like if he had been a diligent employee, he could have marked the account as lost or stolen or told his manager or something.
Aren't there federal regulations that require him to report suspicious activities?
If only we had some sort of bureau of investigation, perhaps at the federal level, to report this kind of thing to instead of knowingly and willingly allowing illegal activity to occur "night after night."
Seems like the FBI would be rather interested in bank fraud, it's amazing that people are solely trying to blame "outsourcing" while overlooking the incompetence of this insider's department.
@frodo_35:
I think the calculation was made a long time ago that it is cheaper to write off bad accounts and stupid losses than to have fewer customers and to spend time on security. The companies just make up for it by charging fees and interest that not too many years ago would have been considered usury. I mean, 25% APR when the prime rate is something like 1.5%???
Also, when identity theft happens, it;s not the company that suffers, but the poor shmoe who has to spent hundreds of hours and thousands of dollars trying to repair their credit.
@starrion:
You are false in a number of regards. I worked in an Out-Sourced Technical Support call center in Canada for a number of years providing Sr. Level HelpDesk support. Our call center beat the client at Customer Satisfaction, Handle Time, and Call Resolution on a fairly consistent basis.
Site bonuses, as well as employee bonuses were based entirely on Meet-or-Beat the client system for measuring metrics.
Now, I agree that many overseas out-sourced centers have issues but do not lump all out-sourced people into the same pile.
In our situation we had less resources then the client yet out preformed them on satisfaction and call resolution - this would indicate our agents had a better knowledge of the issues and products because we did not need all of the tools and hands on equipment the client had to out preform them.
@kathyl: Actually, when the card company realizes the charge is fraudulent, their first response is to take back the money from the merchant. "We're sorry, it appears that YOU took a stolen card, we will be crediting your account $xxx less this quarter..." Try fighting that, it you're a small business...
@67alecto: I think there are *incentives* to get him to disclose fraudulent activity he suspects, but there is likely protocol that he has to follow, which in turn covers his ass, which in turn gives the company to a degree limited liability over the matter until it becomes a national concern.
So while there may be a moral obligation to tell the truth, the truth doesn't always pay the bills. You can't expect everyone to be fair and just.
@firefoxx66: My guess is that the outsourced security was given the ability to remove a block so they wouldn't have to call US security to do it. Saves time and money and such. US security DID leave notes on the account, but I can tell you after having worked customer service for years in a place where notes on an account are paramount, people don't read them. Especially new hires. But either way, people have a hard time taking the time to familiarize themselves with an account by reading the notes, because it increases handle time which makes their bosses mad, and you get the point. It's a retarded system that sets the customer up for getting screwed.
@htrodblder: What state was this? I know that the laws involving vital records are different from state to state, but this seems a little ridiculous. In Texas you have to be dead for 25 years before the death certificate becomes public record. Maybe they let you have it because you were an interested party in the probate case (did you have to show proof of such?).
@StellaBella07: Sorry if that comes off harsh, I used to work in my local country records office, so I'm just really interested in how/why you were given access to that.
I have to deal with outsourced centers all the time. One time I had a guy overseas ask me if I could speak english. I was like yes I can, can you understand english.
@67alecto:
FTA: "The US security department became aware of the issue and put blocks on the account as well as incredibly long notes that explicitly said to not remove the block for any reason at any time."
I deal with tech support centers all the time, and funnily enough, the one I have the most trouble with is in... Texas.
I have enought foreign customers that I can often figure out what they are trying to say, eventually, but the Texas accent gave me no end of grief. Too bad, as they are also the most knowledgable and friendly tech support people I know (we communicate through email, too).
@Acolyte:
The question is, why is there such high turnover in call centres here?
I'll explain why (having not only worked in one myself, but my wife having worked in one too): They treat employees like trash. Seriously, there is no job you will be treated worse in. Having done call centre and temp work, only one of the temp jobs was worse than the call centre (it involved polishing freshly made [HOT!] plastic chair bases with boot polish steaming in one's face), and the nice thing is you can just tell the temp agency how bad it sucks and they'll move you into something else.
My wife's call centre was to support ExpressVu satellite TV (the call centre is "Nordia"). She was hired into "Technical Support", level 2 (ie: You get to her after level 1 gives up).
Some requirements for her position as straight technical support (no sales calls):
- 3 sales pitches per call. This is a fireable offence.
- Minimum sales figures must be met, I think it was $500 a month at one time. Yes, this is for a tech support position. This is also a fireable offence.
- Never transfer the customer unless they specifically request it, or the computer/manual specifically says to (for example, if you figure out a customer has hacked equipment). One of the exceptions to this was if a customer wanted to cancel.
- All service discounts provided count *against* your sales score.
- Complete all followup work within 3 seconds. (No, it's not a typo, after three seconds the next call is forced onto your headset, you cannot control this).
- Be at work ~5 minutes early (unpaid) to setup your workstation, do the same at lunch by shortening it ~5 minutes (unpaid). This is an position that pays ~$8 US/hr.
- Shift bids are done by AHT and other call quality factors. Note that this is a 24x7 call centre. You never get a steady shift, it will change every ~3 months. Nobody is ever assigned a steady shift, those who have part time work are assigned the same ever-changing schedule.
- Washroom breaks are counted against your (government mandated) paid breaks. They may only be taken with permission, and if you're desparate, you'll need to puke in the garbage can at your desk (happened more than once). If you just up and take it and press the "agent not available" in the three seconds you have between calls, the call centre monitor will undo your change so you drop calls and are fired.
- The place is covered by the united steelworker's union. You can only imagine just how much they care about... well... anything at all to do with telecommunications.
I won't go into my experience at a call centre, but to say they didn't provide a working headset (ever), they provided 10 year old monitors that were generally broken, and the "supervisor" (ie: team leader) would specifically want you to put people on forever hold rather than talking to them. There's plenty of other WTFs, but those are a good start.
Hopefully that explains it for you all! One secret you will learn from this is if your call involves anything more than asking "Do you offer service such-and-such?" you should always tell the agent "I'd like to hold until you've completed entering the information, so I can get a comment ticket number (or whatever they use)." That way the agent will have enough time to punch the right keys *and* you'll have proof (that magical number) that things were done right.
I can only imagine telemarketing boiler rooms are worse... But it makes me cry to consider that.
@BrianDaBrain: If you read the story it seems like the guy was always calling in overnight USA time which would mean daytime in the outsourced Phillipines security offices.
@htrodblder: "There it was, the persons social security number, address and parents names. I was shocked I could get that information so easy."
Dead peoples ss numbers are typically made public. There was a famous ID theif in the late 90's who was busting out alot recently deceased wealthy people's accounts "(cc's, retirements, banks, etc) by using the NYT obits and alot of social engineering.
This isn't just an outsourced problem folks. I worked at a Canadian call center and I can clearly recall at least 5 employees being canned for fraud/identity theft.
They were collecting names, addresses, SSNs and credit cards numbers for tons of customers. I believe one of the employees in question bilked customers out of close to $100, 000. For the record criminal charges were brought against all these people.
That's what happens when you put people with little more than a high school diploma on the call floor.
@omniomi: Since you are like the 51st state that never realized it should be part of the US even after we gave you several chances, Canada doesn't really count as outsourced.
@omniomi: Ditto that. I used to work at an outsourced call centre for a large British energy supplier. We had less resources and less pay than their directly employed staff, but consistently outperformed them in both sales (from inbound calls) and quality.
The only time it dipped was when the outsourcing company decided to make us redundant.
@BrianDaBrain: Plus some outsourced centres in other countries can't even ACCESS the notes - I'd leave notes on a file and would then be told that the agent in India who dealt with it couldn't see the notes and had screwed up the file.
I agree totally with your views however note not everyone in the United States understands each other perfectly. From east coast to west coast sometimes the accents can be so thick it sounds like they are not even speaking english
@QuantumRiff: And customers leave... So cost of doing business going up. And I will never deal with couple of companies that offered me abysmal service.
@omniomi: YOU speak English well. In India/Philippines, on the other hand, reps often have horrible accents, which make interactions very, very difficult. Plus they always concentrate on rules, with no insight in common sense.
@omniomi:
Sorry- No.
Our Canada call center, while staffed with people who try very hard, may beat the statistics, but they do it by having the field techs do ridiculous make work to get them off the phone. The tech then gets someone else who starts all over. Our field techs hate dealing with the call center because they rarely work the problems correctly.
The techs then use terms that confuse the level 1 guys who escalate it to us to resolve correctly.
I deal with this every day. My "time to answer" may not be as good, but I don't leave the customer with a system that is down.
Metrics can be used to show they are doing are "good" job of answering the phone, but this outsourcing experiment has been a miserable failure.
The only thing worse than the call centers has been our offshored manufacturing which is now partially being brought back to the US.
Always funny to see former employees trashing their former paycheck.... they usually do this after getting canned for some violation of ethics at work or some other silly offense.
I do not know if this story is true or not.... especially since it comes from a former employee who may or may not have quite (or been fired) 2 years ago... might have been 2 weeks ago and they are pissed off and making up something....
The ONE thing that I do know FOR SURE!
No matter what is said here, the fact is that JPMorgan Chase & Co. are at the top of the heap of banks recently for having the bravado to stay out of the Mortgage mess for the most part and bail the Government out of taking on all this recent bad debt... Love em or Hate em this shows a company that is run incredibly well.
@kayfox: Yeah, I read the whole thing - it just seems like if he was monitoring the account and saw it reactivated, he should have reported it to someone higher up. heck, if it was me, I'd have started to suspect that the outsourced help was in on it!
Is this unexpected?
Outsourced call centers save money on US employment and benefits costs. They -will- have poorer quality of service, they -will- be less likely to resolve cases, they -will not- have as good surveys, they -will- have higher likelyhood of security issues and they -will- have higher turnover leading to higher training costs. Period.
Executives making the outsourcing decision either enter the agreement knowing this or they haven't done their homework. Sometimes the executive making the decision is hoping they will have recieved thier bonus/promotion for the cost improvement before the consequences land.
Seen it/lived it