Consumerist
If you're an HSBC customer, check your account, as there may be a wave of fraudulent activity hitting your bank. Two days ago we wrote about the guy in the U.S. who discovered his account had been drained by someone in Bulgaria. Later that day we received an email from Emily in NYC who was having similar problems, only her fraud-buddy was in California and Canada making withdrawals on her account.
Emily's fiancé wrote back to us today with an update, and according to Emily, the HBSC Fraud Investigator who spoke to her "said that their fraud department was so overwhelmed, it was 'still in the developing stage of how we're going to handle' it. I asked if she knew how many customers were affected and she stated 'We don't even know.'"
First, here's Emily's original email from two days ago:
I am sitting here in amazement after reading your post "HSBC Won't Tell You Someone in Bulgaria is Stealing $2,000 From You" because the exact same thing happened to me today, just substitute Pasadena and Canada for Bulgaria. I logged in to my personal internet banking this afternoon to review my account so that I could pay some bills. I noticed that my bank balance was about $3600 while my available balance was $300. There were no transactions listed after Friday, 2/15. I knew I had used my debit/atm card all weekend, all around Manhattan and Brooklyn. I called customer service and encountered, almost to a script, the same spiel as your reader from someone named "Dar". There was some sort of hold, but he couldn't get information about it. Eventually he found that there were two withdrawals of $500 each at a Wachovia bank that seemed suspicious. I confirmed that I had not made those withdrawals. He was not able to tell me what state the withdrawals were made in. I asked if the best thing to do would be to go to an HSBC ATM and take out the last $300 in my account, so that I wouldn't lose that too- he agreed. So, I left work early to get to the ATM. Dar advised that because today is a national holiday in the US, none of this information would process in my account until at least 6 am Tuesday, but that I would not be able to file a fraud report until WEDNESDAY! He had no answer for me when I asked why I hadn't been alerted to suspicious activity when my card had been used on opposite coasts and in ANOTHER COUNTRY all during the same weekend.And here's the update sent in today, after Emily was finally able to get some more information from HSBC's fraud department:The ATM did not allow me to make any withdrawals. I tried various amounts from $300 down to $60 and each time got an error message that the "Amount Requested Exceeded the Limit". I called customer service again and this time was luckily connected to someone named Maria (and I hate to say this, but Maria, unlike Dar, sounded like a native English speaker). Maria went through various fraudulent transactions- $800 withdrawal in Pasadena, $500 twice in Canada, another $62 in Pasadena, as well as $1000 in Santa Monica. She was able to process a fraud report today- interesting, since Dar said that couldn't be done until Wednesday! My account will not be credited for 10-11 business days and I should receive a new card in 7-10 days. I also was able to immediately change my PIN. I was told that I would be able to withdraw the remaining amount from the branch tomorrow morning. (let's hope).
On Tuesday morning, I went to a local branch to get additional information and withdraw the remaining balance in my account. The associate at the local branch was helpful and contacted the fraud department on my behalf. Eventually I was provided with the name of the Fraud Investigator handling my case. I tried calling her several times on Tuesday afternoon, but kept getting voicemail. I left a voicemail around 5 pm. I attempted to call her again this morning. When I got voicemail, I dialed a random extension, to try to get to speak to a person (there is no operator). I did get someone in the Internet Banking department, who was kind enough to get me connected to someone in the fraud department (after both he and I waited on hold for about 30 minutes- no exaggeration). I was connected to someone named Ella _____, who said that she only dealt with Fraud in applications, so therefore she wouldn't be able to help me. As I tried to explain the situation, Ms. _____ was hostile toward me and escalated the tone of the conversation unneccesarily. I attempted to deescalate the conversation by explaining that I was quite upset that almost my entire bank account had been drained, that I was having a very hard time reaching someone who could help me and that her tone was not exactly helpful. She was then able to connect me to the Investigator handling my case, Sharon _____.
Ms. _____ was kind and helpful and explained that the extent of this fraud was essentially unprecedented for HSBC. She said that their fraud department was so overwhelmed, it was "still in the developing stage of how we're going to handle" it. I asked if she knew how many customers were affected and she stated "we don't even know." I asked if the magnitude of the fraud would delay the bank's ability to get everyone's account credited. She assured me that the bank's first priority was to credit every affected customer within 10 days. She explained that the bank was "probably" going to forego its usual requirements of paperwork such as fraud affidavits for affected customers, because the fraud here was obvious.
Ms. _____ stated that HSBC was trying to contact its customers and would be sending a letter regarding the fraud, but that it was so widespread that it didn't have the manpower to make a phone call to each affected customer, particularly where the focus was on trying to get the accounts credited. She advised that I monitor my account daily to check for the credit, because I would likely not receive notification from HSBC about it.
I'm appreciative of the information that I was able to receive today, and the reassurance that HSBC's priority was to get accounts credited as quickly as possible. However, I am dumbfounded that it took me three days to get the "full story" from HSBC, due to no lack of effort on my part. I think that the media needs to be alerted of this fraud, as HSBC is not able to contact all of its customers. People may be affected and not even know it yet. I obviously plan to change banks after this debacle, but do want to see that this is made public.
(Thanks to Corey & Emily!)
Comments
Well its public now cause of the consumerist,Wonder if CNBC or CNN will be picking this up soon.
Glad I don't have an account with them.
I wonder how this happened, I want to know who dropped the ball security wise.
And this is why I have accounts at MULTIPLE banks.
I wonder why 10 days to get a credit - was it just because of the volume, or is that their standard reaction? I've gotten provisional credits for challenged transactions on the spot from Citi...
Has anyone contacted the FTC about this, or are the individual losses so small that they won't get involved? What about the FDIC?
There's no excuse for a bank not being more proactive about fraud. Isn't that what we pay them for, via fees?
wow, i was just thinking of opening a savings account with them. so much for that.
I had a 2nd td with them on a previous house. They used to like to have someone in their Indian call center call on Sundays to threaten me BEFORE the payment was due. This outfit is the pits.
are these account local branch accounts or the online high-yield accounts?
And this is why you don't bank with HSBC.. c'mon people. Get real. Bank with a REAL bank.
Hi this is Emily's Fiance, Corey...
@structuralpoke: Emily has both a traditional Checking acct thats she's had since college and the higher interest HSBC Direct online savings acct.
I have already spoken to a Wall St Journal reporter, who is looking into this...and is waiting to hear back from HSBC (good luck with that!).
That can't be good for business.
Now i'm wondering if I should withdraw everything in my HSBC account until this all gets sorted out...
Hasn't HSBC laid off a bunch of people in the USA recently (both Group and HSBCUSA)?
@HykCraft: Yeah! A credit union! /obligatory
Fraud indeed sucks and I feel sorry for those people affected, but on a positive side, only big losses for banks and other financial institutions will make them change.
I recently had a credit card fraud problem myself, and I use Chase. The fraudster successfully made a $1 transaction at what I think is a subway fare vending machine in New York and then tried to make a $600 then another $400 purchase at a Home Depot in Brooklyn. They caught and denied the Home Depot charges and so only had to suck up the $1 charge. They also called me to verify those charges. I'm not saying that Chase is perfect, but it at least shows that they're better prepared to handle fraud.
It would be nice if companies had some sort of fraud preparedness rating you could check out before doing business with them.
"I knew I had used my debit/atm card all weekend, all around Manhattan and Brooklyn. "
I bet it got lifted at a restaurant, bar or a hacked ATM. Never use a card at a restaurant or ATM that's not at a bank. Its too easy for a waiter to copy the number down. Never use your card at an ATM that isn't at a bank, its very easy to have another card reader over the real one and a camera that watches you type in your PIN.
I learned my lesson after my bank card showed a donation transaction at a montessori school in Arizona soon after a trip to New York where I used my card in the exact same way. I fired an email to the montessori school and they said they didn't even have a donation page up.
They got back to me later in the day and confirmed that someone had found their old donation page and had rung up 10,000 one dollar donations with 10,000 different credit cards. They were testing all the cards.
I was pretty lucky because I caught the transaction right away. My bank seemed uninterested what I discovered. They even told me that the type of transaction required the card to be presented in Arizona, which was impossible because I was in Michigan at the time. I cancelled my card and got a new one.
What's interesting is the speed at the fraud happened here, and how quickly the money got removed from the account.
I was affected by this fraud as well. The thieves knew what they were doing, verifying accounts first (every affected account started with a $1 bank authorization from AOL - a service I've never used). They managed to get $1500 from my account! I went to my branch today and managed to get the 10 day waiting period reduced to 1-2 days. So anybody this happened to should get into their branch and politely (and pathetically) request an expedited resolution...
@ChrisC1234:
Why, so you have MULTIPLE chances to get defrauded?
@darkjedi26:
I just tried to do that--the "bank to bank transfer" tab gives me a message that it's "down." I'll keep trying though. I want my money out of there.
This is Emily, under Corey's login. Yobitch, how were you able to get the waiting period reduced? I asked multiple times about this and was told that they would do their best to expedite, and that 10 days was a maximum, but there was no way they could give me a shorter timeframe. And trust me, I gave a long but true spiel about bills to pay (including hsbc's credit card and several student loan payments).. if this branch was in nyc, please let me know and i'll try them!!
Yeah I just transfer money from my checking into this account. I never use the ATM card supplied.
I can't believe that there is a "10 day window" to return the money to Emily's account. HSBC seems to have really screwed the pooch on this one.
@theblackdog: someone probably left their lap top unattended at a starbucks and someone ripped it off. Too bad the laptop had all the companies client info on it.
I had trouble with a credit card owned by HSBC. I had purchased something on ebay, and filed a fraud claim. I called these goofballs and they even sat at their computer and looked at the item with me. They agreed to chargeback the seller. Well, the idiots charged back the WRONG ebay seller!!! I could not get it straightened out, even on a three-way conference call with a manager and Paypal. I had to tell the poor seller to go to her bank and file a claim against them. I hope she got her money back!
I was affected by this fraud as well, as was a good friend of mine.
This same thing happened to me and one of my firends over the weekend. Both on Sunday, both with HSBC, both $2000 stolen from checking, withdrawals in Montreal. Completely sucks, but when it happened to my friend too it was obviously a larger scam. I was also told 10 days to credit. I am so opening an account somewhere else tomorrow.
@shadow735: You think that employee was a former VA employee?
@coreynyc: Emily (per coreynyc)... The fraud consultant (Mark) I spoke to at the 800# told me I may have some luck by visiting the branch I opened my account with (5th ave @ 41st). They were adamant about their policy to make customers wait the 10 days, but because someone told me differently on the phone, they agreed to expedite my reimbursement. It wasn't the branch that finally agreed though, it was a voice on the phone... I guess they didn't want to be contradictory... Go figure.
I just got a call from them tonight about a possible theft of my pin # at an ATM. That was HSBC Canada.
Does anyone have any specific fax numbers, emails, etc. for HSBC for a carpetbombing? I've had an unresolved fraud complaint with them since Summer of 2007, and I'm so sick of their telephone run-around, I've pretty much accepted the fact that it's easier for my sanity to EAT the $100 fraudulent charge. I stopped using their card, but now with this latest fraud news, I might as well CANCEL the card.
I opened an account with them several months ago, and deposited just $1. I haven't looked at it since -- I was looking into funding it as a savings account. But now I'm just holding onto the account for no other reason than to have it. Looks like I won't be putting any more money into it anytime soon.
I am wondering if there was another gigantic security breach & a whole bunch of customers' info got stolen and HSBC never reported it?
You'd be screwed if you were single and had no one to depend on - much like in my situations with Banks being dicks.
Ramen and calling in sick, it is!
UPDATE: I just tried to do a "bank to bank transfer" again. Still not able to do it....I think they have it turned off so people like me can't take their money out.
@mamacat49: Whew! Boy am I glad I withdrew my money 2 weeks ago.
So... most of the victims are Internet Bankers...
No way in hell is my account going online!
This is starting to sound like a class breach -- that is, a systemic problem with a single underlying cause rather than a series of individual problems with multiple causes. The pattern isn't clear yet (and probably won't be until many more instances are put on the table for comparison) but I think it's already obvious that this isn't the result of one person's activities.
@CoreyNYC: if the WSJ runs a preliminary article and provides a response mechanism, it would be interesting to see how many other people report similar problems -- and then multiply that by 10-100 to account for the serious undersampling in play.
Emily again.. just to clarify, while I do have an online savings account with HSBC, the fraud occurred in my regular checking account. This has nothing to do with an online account not being secure.
@Angryrider: If your money is in just about any bank in the US, your account is probably already online. You just don't know about it.
@CornwallBlank:I am hopeful that the WSJ will run the article, the reporter we are speaking to is definitely pursuing the situation.
Just wanted to chime in that this happened to me as well - over $2000 taken out of my checking account at HSBC this weekend through ATM withdrawals in Canada. I also got the "we'll try to expedite it but no promises" line when I asked to get my money back before the 10-day window.
The guy I spoke to in Fraud today said that it was definitely a widespread problem and that they aren't sure of the cause yet...
this is so stupid.
HSBC has really "tight" "security" practices, like not letting you set a pin online or on the phone, having to wait for their paper mailing to reach you with a default pin before even starting their account, now all this.
but for those of you think that HSBC is not a "real" bank, they are actually one of the largest banks in the world, they just have a much smaller US presence. as of 2004-2007, by various measures, they were either the largest bank, or top 5 in the world:
[en.wikipedia.org]
@mamacat49:
i just put in a bank-to-bank transfer, and it worked. you might want to try again.
@plim: As far as online security goes, yeah...HSBC is near fanatical wrt security. It is a pain in the ass to log on and doesn't play nice with Quicken automatically downloading records (you actually have to go through the tedious, and it IS tedious, process of logging on to download a .qfx file).
As for the people teasing about using an online bank vs. a brick and mortar bank...how many of you earned $300 in interest last year from your local bank's savings account?
It sounds like someone installed a card skimmer and camera on a public ATM and got a bunch of matching card-and-pin combinations that way. That would explain why the fraudulent withdrawals apparently took place at ordinary ATMs (as opposed to normal CC fraud, which usually involves people buying things in such a way that don't necessitate the physical presence of the card).