I've Been Mugged

Bank of America Merchant Services And Money Network Announce New Payroll Solution

Earlier this month, Bank of America Merchant Services (BAMS) and the Money Network(R) announced the launch of the Money Network(R) Payroll Distribution Service sponsored by Bank of America. According to the press release on MarketWatch:

"The program enables employers to comply with complex payroll distribution laws, such as the need to offer a paper paycheck and free check cashing locations, while providing a safe and convenient pay alternative for employees who do not have access to a deposit or checking account. With the Bank of America-issued Money Network(R) Service, the payroll process is efficiently streamlined through more than 17,750 Bank of America ATMs and 43,000 Allpoint(R) Network surcharge-free ATMs..."

This is huge news. The benefits for employers are numerous. I'd written previously about a version of this payroll solution at Walmart. Most employers would stop printing paper checks as paycards allow them to avoid check printing expenses. The benefits for consumers seem questionable.

This payroll solution enables companies to essentially provide selected banking services to their employees. Where is the line between a company and a bank? It seems blurred with payroll services like these. Have you asked your employer for check-cashing services? I doubt it. Something else is going on here.

Notice that the press release includes this statement: "for employees who do not have access to a deposit or checking account." The banking industry uses the term "underbanked" to identify consumers that have a checking account or a savings account, but not both. The industry uses the term "unbanked" to identify consumers who don't have both types of accounts.

According to a 2009 FDIC study (Adobe PDF document), only 7.7% of U.S. households are unbanked. Those unbanked households typically make less than $30,000 per year, and 66 percent of them use services with high fees: non-bank money orders, non-bank check cashing, pawn shops, payday loans, and rent-to-own services. The same study also found:

"Minorities more likely to be unbanked include blacks (an estimated 21.7 percent of black households are unbanked), Hispanics (19.3 percent), and American Indian/Alaskans (15.6 percent). Racial groups less likely to be unbanked are Asians (3.5 percent) and whites (3.3 percent)."

Those percentages are probably higher given the prolonged economic downturn of the last couple years. I doubt that BAMS and Money Network targeted this new payroll service at only the 7% unbanked slice of the market. The same study found that about 18% of U.S. households are underbanked. The market for this new payroll service seems to be both unbanked and underbanked consumers who currently use high-fee banking services, plus the upside potential:

1. More consumers might become underbanked or unbanked during economic downturns,
2. Employers with operations in developing countries have a larger percentage of unbanked employees,
3. Employers with a large percentage of seasonal or contract workers, and
4. If positioned a certain way, the new payroll service could capture more market share from employees that already have both checking and savings accounts

Upsides #3 and #4 worry me. This new payroll service seems to me to be a slick method to force consumers to use certain banks -- to restrict freedom of banking choice. Think of it this way: employees that are paid by their employer via a Bank of America-branded Money Network(R) PayCard, are being paid with a customized debit card. Use that PayCard within Bank of America and Allpoint networks and there are few or no surcharges. Use that PayCard outside of its network, and more fees and charges apply. Where do you think employees will shift their banking to?

If a company uses the Money Network Payroll Distribution Service for all its employees, then those employees who already have checking accounts (at the banks of their choice) either lose their freedom to bank where they choose, or pay more in fees to bank where they choose.

This reminds me of the old "company store" practice from the 1800's where companies forced their employees to shop only at the company store which effectively kept them in debt bondage. Haven't we learned from this history?

Perhaps, we are now seeing the future of banking and the big banks' response to customer fury about checking account fees. The big banks could co-mingle employer payroll solutions with limited consumer banking services -- all without having to highlight the embedded debit/checking fees to consumers and let the employers take the heat. Afterall, employees may not complain if they are afraid for their jobs.

This 2005 State of California study (Adobe PDF) researched the advantages and disadvantages of payroll paycards:

"... Pay Cards give an employee who does have a bank account an alternative to carrying cash or cashing a check, which may require a fee. Employees who do not have bank accounts gain the convenience of using a debit card. However, depending on the program chosen by an employer, Pay Cards may or may not reduce payroll costs for the business and/or for the employees."

This study documented a variety of fees charged to employees' pay cards:

• Monthly maintenance fee
• ATM balance inquiry fee (per transaction)
• ATM in-network domestic withdrawal fee (waived or a limited number of withdrawals per month)
• ATM outside-network domestic withdrawal fee (per transaction)
• ATM in-network foreign withdrawal fee (per transaction)
• ATM outside-network foreign withdrawal fee (per transaction)
• ATM transaction decline fee (per transaction)
• Domestic customer service automated inquiry via phone fee (per call)
• Domestic customer service live-person inquiry via phone fee (per call)
• Point-of-sale pinless signature purchase fee (per transaction)
• Point-of-sale cashback fee
• Emergency cash transfer fee (annual)
• Emergency cash transfer fee (per transaction)
• Bill payment fee (per transaction)
• Funds transfer fee
• PIN change fee
• Paycard replacement fee
• Paycard replacement fee (express delivery)
• Negative balance fee
• Account closure fee
• Duplicate statement fee
• Research fee (per hour)
• Tax levy or garnishments fee (per occurrence)

And, all of these fees for employees are in addition to fees the bank charges the employer directly for the payroll service. So, costs for employees go up when multiple fees apply, or to use a payroll paycard outside of the network at the bank of their choice. More fees apply if the employer negotiated a poor deal for its employees. These fees are effectively an economic incentive to force employees to do business at certain banks.

It is easy to find paycard solutions. This guide for employers' human resources department professionals lists ten branded payroll paycard services.

If you think that this is enough, there's more.

Similar to the Walmart Money Centers, the Money Network PayCards are insured by the FDIC (via MetaBank). So, as more employers provide limited banking services, the federal government (via taxpayers) is responsible for insuring more accounts. It would be preferrable for more public discussion about whether we want to insure more non-banks doing banking during a time of limited government budgets. 

My first impression of this payroll solution was that it may be a security issue, since it allows consumers to easily move money around the globe, with Allpoint ATM locations in the USA, Mexico, Australia, and the United Kingdom -- today. In the future, Allpoint may serve more countries. In a world where governments are concerned about terrorism, this payroll solution struck me as a potential security risk.

Then again, this payroll solution could make it easier for employees to send money to relatives in their home country -- assuming the relatives have paycards, too.

After researching this investigative article, I have learned to keep an eye on both Bank of America Merchant Services, and Banc of America Merchant Services LLC. With this latest announcement, I have learned to also keep an eye on Money Network(R), a First Data Company.

What's your opinion? If your employer pays you with a payroll debit card or paycard, please share your experiences below. I've Been Mugged readers are interested.

KPMG Survey: A Typical Corporate Fraudster Is...

KPMG recently released its 2011 Who Is A Typical Fraudster? report, describing the profile of a typical corporate fraudster, the impacts and amounts stolen, industries where fraud tends to concentrate, and the conditions which enabled the fraud. The report included 348 events in 69 countries. The fraud events included "white collar" crimes such as:

"... misstatement of financial results, theft of cash and/or other assets, abuses of expenses, and a range of other fraudulent acts."

The report excludes acts of no material value and misconduct.The report does not mention names. The average duration of the fraud was almost three and a half years from the start until its detection. In 74% of the incidents, fraudsters exploited weak internal controls. Companies fail to read and act quickly on the warning signs:

"The number of fraud cases preceded by a red flag rose to 56 percent of cases in 2011, from 45 percent in 2007... Just 6 percent of initial red flags were acted on in the 2011 analysis... Rarely is an act of fraud a one-off... In 2007, 91 percent of fraudsters were repeatedly fraudulent, compared with 96 percent in the 2011 analysis."

The average loss was $1.4 million in Asia Pacific, $1.1 million in the Americas, and $900k in Europe. The report described the following as one of the most interesting cases in the United States:

"At a U.S. financial institution, a larger-than-life chief executive surrounded himself with an inner circle of "yes men." The fraud, which involved subterfuge and complex bundling and unbundling of loans and transactions to make bad loans appear good... The investigation quickly uncovered conflicting stories told by the CEO's inner circle and the people working with the loans and customers. This case illustrates, in particular, how dominant and bullying behavior can coerce others to participate in fraudulent activity."

The corporate fraud includes identity theft. A case from Switzerland:

"Fraudsters attempt to extract money from dormant accounts or they assume the identity of a customer to trick advisers into making payments or transfers. Often this involves the collusion of an external party with an internal ally..."

I also found the consequences interesting:

• Disciplinary action: 40% of cases (54% in the Americas; 23% in Asia Pacific)
• Regulatory, legal enforcement: in 45% of cases
• Civil recovery: 23% of cases
• Resignation/voluntary retirement: 17% of cases (25% in Asia Pacific)
• Out-of-court settlement: 6% of cases
• No action taken: 3% of cases

The profile of a typical corporate fraudster:

• Male (87% were men)
• 36 to 45 years of age (41% were ages 36 to 45; 33% were ages 45 to 55)
• Committed the fraud against his own employer (90% committed the fraud against their employer)
• Works in the finance function or in a finance-related role (32% worked in finance; 26% were CEOs; 25% were in operations/sales)
• Holds a senior management position (29% were in management; 53% were in senior management)
• Employed by the company for more than 10 years (33% employed more than 10 years; 29% employed 3 to 5 years; 26% employed 6 to 10 years)
• Committed the fraud in collusion with another employee (61% acted with others)

The report mentioned this about collusion:

"... male perpetrators (64%) are almost twice as likely to collude than women (33%). After taking account of male dominance in the perpetrator group, collusive females account for just 4 percent of activity. Perpetrator groups are most typically all-male or mixed gender."

KPMG is a tax, auditing, and advisory firm operating in 144 countries. A KPMG auditor caused a data breach in May 2010 when the auditor lost a flash drive containing 4,500 unencrypted patients records.

Breach Notification And Privacy Laws

Australia may be falling behind other countries in implementing data breach notification laws to require companies and government agencies to notify consumers when their personal information has been exposed or stolen. ZDNet Australia reported:

"Australia currently doesn't have any legislation to force companies to disclose breaches, even though it was recommended as part of the Law Commission's report on privacy, released in 2008."

The article summarized existing breach notification laws or pending legislation in several countries:

"Internet and telecommunications service providers in the UK are also already required to disclose when they have experienced a breach. However, the EU commissioner said last month that she wanted to extend this to all businesses... New Zealand doesn't have any breach notification laws... Canada has a Bill that is proceeding through parliament that will require businesses to disclose data breaches if they may result in a "real risk of significant harm". Until this is passed, its Federal Privacy Commissioner has issued guidelines for organisations to follow in the event of a breach, but these are voluntary."

According to the National Council of States Legislatures (NCSL), at October 2010 about 46 states in the USA plus Puerto Rico and the U.S. Virgin Islands have breach notification laws requiring notification when consumers' personal information is disclosed. The four states lacking breach notification laws are Alabama, Kentucky, New Mexico, and South Dakota.

If you live in one of those four states without breach notification laws, you might want to ask your elected officials why.

The need for legislation in the USA is driven not just by data breach notifications but also to protect consumers' privacy. The Do Not Track opt-out setting for consumers is largely ignored by advertisers. Plus, ARS Technica reported:

"... the United States and Turkey are the only developed nations in the world without a comprehensive law protecting consumer privacy. European citizens have privacy rights, Asian citizens have privacy rights, Latin American citizens have privacy rights. In the US, however, in lieu of a comprehensive approach, we have a handful of inconsistent, sector-specific laws around particularly sensitive information like health and financial data..."

Given the state of privacy legislation in the USA and the tendency of consumers to avoid reading the terms of use and privacy policies for products and websites, the result has been that companies':

"... risk-averse lawyers have figured out that the best way to not violate [FTC guidelines] is to not make explicit privacy promises at all. For this reason, corporate privacy policies tend to be legalistic and vague, reserving rights to use, sell, or share your information while not really describing the company’s practices. Consumers who want to find out what’s happening to their information often cannot, since current law actually incentivizes companies not to make concrete disclosures."

Various legislation proposed in the U.S. Congress:

• The Data Breach And Security Act of 2011: re-introduced in June by U.S. Senators Mark Pryor (D-Arkansas) and John D. (Jay) Rockefeller IV (D-West Virginia) to require businesses and nonprofit organizations that store consumers’ personal information to put in place strong security features to safeguard sensitive data, alert consumers when this data has been breached, and provide breach victims with tools to protect their credit and finances.
• The Secure and Fortify Electronic Data Act (a/k/a the SAFE Data Act) introduced by Mary Bono Mack (R-California),Chairperson of the House Subcommittee on Commerce, Manufacturing, and Trade, to establish national standards for data security and breach notification.
• The Best Practices Act introduced by Bobby Rush (D-Illinois) in February 2011
• The Consumer Privacy Protection Act introduced by Cliff Stearns (R-Florida) in April 2011
• Do Not Track legislation introduced in the State of California Senate

I have not yet read the entire text of all four bills, and will do so once the content settles after revisions and consolidations.

Sony Playstation Network Hacked Again

While trying to get its customers up and gaming again after its massive data breach, the Sony Playstation Network suffered another hack, even though the company doesn't call it a hack. The Playstation Network blog reported on Wednesday:

"We temporarily took down the PSN and Qriocity password reset page. Contrary to some reports, there was no hack involved. In the process of resetting of passwords there was a URL exploit that we have subsequently fixed. Consumers who haven’t reset their passwords for PSN are still encouraged to do so directly on their PS3. Otherwise, they can continue to do so via the website as soon as we bring that site back up."

The timing of this latest security problem couldn't be worse. The Sydney Morning Herald reported:

"Sony chief Howard Stringer has warned he can no longer guarantee the security of the electronics giant's gaming network in the "bad new world" of cybercrime..."

What? Bad new world of cybercrime? Data breaches are not new. Stringer's comments are disappointing, at best. If I were a Playstation Network customer, I'd cancel and close my account.

Earlier this month, Sony suffered two data breaches at its Playstation Network and at its Online Entertainment units. In testimony before the U.S. Congress, a security expert stated that Sony allegedly used obsolete data security software.

A former hacker and lead architect at MyKonos Software, Kyle Adams, said that the hackers may have accessed Sony's servers via its blog, which was running an obsolete version of the WordPress blogging software. Adams also suggested that the hack attack probably was not random and was persistent.

Google Apologizes to Australians For Its WiFi Data Collection By StreetView Cars

In July, Karen Curtis, the Australian Privacy Commissioner announced the conclusion of her office's investigation into the collection of consumer WiFi data in Australia by Google Street View cars:

"... I am satisfied that any collection of personal information would have breached the Australian Privacy Act... Collecting personal information in these circumstances is a very serious matter. Australians should reasonably expect that private communications remain private."

Other Australian government agencies are still investigating the data collection. The Commissioner wants to ensure that this type of personal data collection does not happen again. So, Google has agreed with the Commissioner's request to comply in four ways to the investigation:

• Perform a Privacy Impact Assessment (PIA) on future Street View data collection activities in Australia,
• Provide a copy of these PIAs to the Commissioner's office,
• Consult regularly with the Commissioner about personal data collection activities with future Google product launches in Australia, and
• Publish an apology to Australians in the official Google Australia blog

Portions of the apology in the Google Australia blog:

"We're sorry. A couple of years ago, Google started collecting WiFi network information via our Street View cars to improve location-based services like search and maps. In May, we announced that we had also mistakenly been collecting publicly broadcast payload data (information sent over the network)... and as soon as we discovered our error, we announced that we would stop collecting all WiFi data via our Street View vehicles and removed all WiFi reception equipment from them... In Australia, we have been working with the Privacy Commissioner to support her investigation into what happened... We want to reiterate to Australians that this was a mistake for which we are sincerely sorry. Maintaining people’s trust is crucial to everything we do and we have to earn that trust every single day. We are acutely aware that we failed badly here."

Good for Australians. Where is the apology for everyone else? The Europe Google blog and official Google blog both announced only a collection policy change. Apologies only happen when a government demands it?

80% of Australian Companies Had at Least One Data Breach Within The Last 5 Years

If there ever were alarming statistics, these are it. Smart Company of Australia reported:

"A new survey reveals almost 80% of local companies have experienced data breaches in the past five years, with 40% recording between six and 20 breaches. The Symantec Australian data loss survey shows 59% of businesses suspect they have been the victim of data breaches, but are unable to identify stolen information."

And the costs of data breaches are substantial:

"A whopping 34% of respondents report an average breach cost them $5,000, while 14% say breaches cost them between $100,000 and $999,999, and 7% over $1 million."

How did these data breaches happen?

"... the main cause of data breaches, the survey reports, was lost laptops at 45%, while human error accounted for 42% of cases. Malicious attacks were responsible for 28% of breaches, while hacking and malware were responsible for 24%."

Geez! Don't these companies train their employees (and contractors) on effective data security habits? Don't these companies teach their employees (and contractors) the company's data security policies? Apparently not.