IT WAS ONLY £233,000, and it was only about 20 British customers who were bilked, but HSBC’s discovery this week that an employee in their Bangalore call centre had fiddled accounts and helped himself to customers’ money should be yet another wake-up call in a cacophony of alarm bells.
Of course, the bank says they caught the crooked employee before he had a chance to do much more serious damage, and that they will reimburse their customers for all the losses. And, of course, a spokesperson for India’s booming outsourcing industry insists that this was a rare occurrence, which, he says, could have happened anywhere else in the world.
But therein lies the rub. It is not rare in India and it is happening in other parts of the world, which suggests that trusting bank accounts and credit card information to call centres is madness.
A few months ago a dozen people working at Tesco’s main call centre in Dundee were sacked or suspended when the company discovered fraud involving false discount vouchers. Around the same time a man in Reading was convicted of conspiracy to defraud for his role in a £1 million scam which began with him stealing the passwords of two customers, while working in a bank’s call centre. If British companies can’t guarantee to protect our most sensitive financial identities at home, how can they justify outsourcing the problem?
Over the past five years, the trend in financial services is to outsource back-office operations to places such as India, Pakistan and the Philippines. Yet surveys show, overwhelmingly, that most of us resent foreign call centres. A Mintel study revealed that 80 per cent of us don’t want to discuss our financial dealings with anyone overseas, while a KPMG report claimed that two thirds of us are concerned that our personal banking details are held in another country.
This trend can’t be about the customer. Nor can it be about customer security. “Insider fraud” is among the most serious threats faced by the financial industry, with insiders perpetrating nearly 40 per cent of financial crimes. The situation is even more worrying, in light of a recent Department of Trade and Industry report that suggests that only 1 per cent of the UK’s financial services companies have put into practice all the safeguards necessary to prevent insider breaches.
That means 99 per cent are failing. Look no further than the over- reliance on utility bills, date of birth, first line of the home address and mother’s maiden name. Last year a reporter for The Sun purchased bank account details on more than 1,000 UK customers from a call-centre employee in Delhi. Despite the evidence, the case against the man evaporated. The banks involved did not press charges, which left the Indian police powerless to act. In response to the Sun story, the National Association of Software and Service Companies (Nasscom) — the Indian trade group desperate to protect the country’s reputation — claimed its members had been entrapped by an over-zealous journalist intent on maligning the industry. India’s Minister of Information Technology and Communications highhandedly wrote off the matter as “a freak incident”.
Hardly. Within the past two years: a call centre employee in Bombay helped himself to credit card numbers that he used to buy airline tickets that he subsequently sold; employees at a call centre in Poona defrauded Citibank account holders of $300,000 by doing little more than transferring funds from customers’ accounts to their own; and two American conmen arrived in Bangalore, set up a call centre to handle credit card information for internet users accessing porn sites, then systematically bilked customers of their money.
For India, call centres are a £3 billion industry, with the prospects of 40 per cent growth and 100,000 new jobs this year. Not surprisingly, politicians and call centre executives are anxious to protect their golden-egged goose.
The easiest way is to accuse the media of exaggerating the threat, of undermining Indian competitiveness and of waging an undeclared, low- intensity trade war. Yes, they acknowledge, incidents like the Citibank thefts were a wake-up call. And yes, they concede, there’s a need for more due diligence. But then they point to problems with call centres in the First World and say that the real danger is not national boundaries, it’s people.
Good point. But when those people have no loyalty to their ultimate employers; when those people are paid lousy wages to work in sweat-shop conditions (staff turnover rates can exceed 40 per cent); and when those people are working in countries where law enforcement and call-centre operators have a vested national interest in making the world believe that the emperor does have clothes, then the risks are already beyond unacceptable for our banks, credit card companies and, especially, us.
Now consider this: Indian call centres are being purchased at an alarming rate. Three or four are reportedly sold every month just in Bangalore. To whom? The answer is, to anyone with enough money to buy one. What’s to stop a well-organised criminal group from coming into the market? The answer is, vetting by faceless functionaries in some Third World authority. Huh?
Then consider this. In March 2005 Delhi police shot three men and captured two others who were planning to blow up call centres. They were members of a Pakistani terrorist group fighting for an independent Kashmir. But what happens next time, when the terrorists are smarter, better organised and more determined? What happens when a terrorist deliberately infiltrates a call centre and waits, patiently, until he’s in a position to push the button to empty bank accounts, overload credit cards, turn off ATM machines and generally wreak havoc?
Are most of people working in Third World call centres honest? Who cares. It only takes one. And he may already be in place.
Jeffrey Robinson is author of The Sink: How Banks, Lawyers and Accountants Finance Terrorism — and Why Governments Can’t Stop Them
