Report: Majority of Lenders Putting Financial Data at Risk

As companies like Target and Michaels Stores continue to take a drubbing over high-profile data breaches, a ""report"":http://www.prnewswire.com/news-releases/halock-investigation-finds-that-over-70-of-mortgage-lenders-may-be-putting-sensitive-financial-data-through-their-application-processes-242564181.html from cybersecurity firm ""HALOCK Security Labs"":http://www.halock.com/ suggests mortgage lenders may not be doing enough to protect applicants' sensitive financial data.

[IMAGE]

After investigating practices at 63 lenders of varying size, HALOCK found more than 45 companies (70 percent) permitted applicants to send personal and financial information--including tax documents and W-2s--through unencrypted email attachments.

That group includes eight of the top 11 U.S. lenders, HALOCK reported.

Furthermore, the firm says nearly 70 percent of surveyed lenders encourage faxing sensitive data. More than 40 percent of surveyed companies provided a postal mail option, while only 12 percent offered a secure email portal.

[COLUMN_BREAK]

When asked why a secure email portal was not offered, HALOCK says one of the most common replies was that it had to do with what the customer was ""most comfortable with.""

Said one former lender: ""Oftentimes it was easier to have my clients send documents like W-2's through email because everyone has access to an email account. Most of us didn't want to take the time to explain what a secure portal was and how to use it.""

""While these responses suggest that lenders prioritize their customers' ease-of-use over their security, they also suggest an unawareness that their customers are losing confidence in their banks' commitment to customer privacy,"" HALOCK said in its report.

The company points to a study published by the Ponemon Institute in October in which 65 percent of surveyed consumers disagreed with the statement, ""My bank is committed to ensuring the privacy of my personal information is protected.""

""[A]s the public becomes more demanding of their banks to ensure privacy and security, it's no longer feasible to rely on unsecure email for the transfer of financial documents,"" said Terry Kurzynski, senior partner at HALOCK. ""Any type of weak link in a system involving sensitive information exposes people to unnecessary risk. It takes months to recover from an identity theft and minutes to log into a secure portal. Do the math.""