Chase SSN Loss Pattern?

A quick Google search of Patricia O. (O My God I've Lost Customer's Social Security Numbers) Baker came up with a similar situation to my recent SSN loss.

Click here to read the notice at Datalossdb.

Seems Chase notified the state of New York in late 2006 that a tape with customer's SSN could not be found at a vendor's off-site facility. Want to bet it's the same vendor as my loss? Want to bet that Chase didn't change any policy from 2006 to 2009?

Of interest in the 2006 notification, Chase offered $10,000 in identity theft protection to each victim. Unfortunately for the 34,266 New York residents affected, the footnote to the letter to the NY state attorney general says that the theft protection is not available to NY residents.

Chase'ing My SSN Away

When comparing Citi and JPMorganChase (Chase bank), it's not hard to see how Chase is doing better. Citi's in the hole for $45 billion of taxpayer money and Chase returned the TARP funds it never wanted in the first place. Citi's got a revolving management team and board while Jamie Dimon has led Chase for five years. Their stock tells the story as Chase (JPM) is up 17% over roughly five years since Dimon joined and Citi is down 91%. Click here for an interactive chart.

Unfortunately, my belief in Chase's attention to detail and looking out for its customers was smacked by this letter I received yesterday. In short, Chase backs up its customer information on a tape and uses a vendor to store that tape. Chase's vendor can't find the tape that includes my name, address and social security number (SSN).

Click on pages to view the letter.

While Chase might be correct that the tape can "be read only with special equipment and software", let's not kid ourselves that this is rocket science. The larger question is why Chase's data wasn't encrypted so that even if it was able to be read (which it can be) that the data would be useless without the key to un-encrypt the data.

It's not even six weeks since I was Schwab'd by Chuck who's team also lost my SSN and personal information. Like Schwab, Chase is offering to monitor my identity with an Experian product. That's standard. Their offering to monitor it with their own branded product (Chase Identity Protection) that they hope I will like and will pay for in the future. That's Priceless. Leave it to Chase to turn an internal control and process f-up into a marketing and revenue opportunity.

Chase's letter is signed by Patricia O. Baker. That's 'O' as in O' My God, I just lost customer Social Security Numbers.

Perhaps now's the time to short Chase's stock as they've once again made the Companies Acting Badly list, this time by losing my Social Security Number and ID information. Or perhaps it's time for Chase to get a new CIO who can enforce protocols with a data storage vendor. Or perhaps it's time for Chase to get a new data storage vendor. Who's in charge of this at Chase?

JPMorganChase joins Charles Schwab, IBM, Intuit and BNY Mellon as Companies Acting Badly for managing to lose my social security number and other personal information.

Blink Goes Your Credit

A number of credit card companies have started embedding RFID (radio frequency) chips in credit cards so they can be read over the air without having to swipe the cards at a terminal. The advantage to these credit card companies is that paying with a credit card becomes faster.

The risk to individuals is that your private information usually retained on the card may now be transmitted over the air and readable by someone with the right technology. Some banks encrypt the data. Some don't. You can read more about the risk here and here. Some people like the technology. Some don't. I don't want it in my credit card.

Citibank makes RFID an option for its customers. You have to specifically request the technology if you are comfortable with it.

What does Chase bank do with it's Blink branded RFID chip? It ships it without your request when your card is up for renewal. Chase includes a pamphlet that says the card now has 'blink!'. I bet that many Chase customers don't know they have Blink and don't know what it does.

Would Chase make a customer whole if someone stole their id off a Blink card and used their credit? I'm not waiting to find out.

If Chase doesn't replace my credit card with a non-Blink version, I'll resort to a drill or punch press to get that chip out. Click on the image below for a video on how one guy removed his RFID chip from his credit card.



Chase is a company acting badly for assuming I want technology in my wallet that is broadcasting my credit card information.