Bank customers and pensioners have been given a sharp reminder this month of the risk of identity fraud after a series of failures by large organisations to protect the security of personal information they hold.

The Department for Work and Pensions was forced to admit that it had sent banking details of 26,000 individuals to the wrong addresses. Meanwhile, two Times Money readers have highlighted glaring weaknesses in the way banks handle personal information and standard security checks.

Dennis Hall was horrified by the information he received when he asked American Express to provide details of all records they held on him. Apart from his own information, the charge card company also produced personal details of two strangers.

Mr Hall, a financial planner from West London, says: “These two people had no connection with me. In both cases I was given the person’s name, address, date of birth and mother’s maiden name, along with telephone numbers and card details. I was also given details of one individual’s signature, name of employer and date when he moved into his current house. The other person’s information included his card balance and renewal date, the name of his bank, branch, sort code and account number.

“I alerted the individuals concerned, shredded the documents and told American Express what had happened, so in this case I trust that no harm has been done. But the information I was given would have been enough for me to steal the identity of both these individuals. I could have had their mail redirected, taken out further credit in their names and gone on a spending spree. If this has happened to me it is probably happening up and down the country and vital information could be falling into the wrong hands.”

One of the two people whose personal details were disclosed was Alexander Hall, who is currently working in Tanzania. His mother, Maureen Hall, says: “This is sloppy work by the bank. It has handed out just about everything that a thief could require to steal my son’s identity. When he returns I am sure he will want to ask American Express some awkward questions.”

The other person whose details were wrongly disclosed is Christopher Barratt-Phillips, from London. “I was stunned when Dennis Hall rang me,” he says. “It appears American Express’s security checks are nonexistent. While I am shredding my statements and receipts, American Express is sending out my personal information to a stranger.

“Someone could have used the details to apply for a mortgage or run up a huge credit card bill. I will be making a complaint to American Express and may seek legal redress.”

A spokeswoman for American Express says: “This is an isolated incident due to human error. We take data protection and the security of our card members very seriously and have tightened our processes to ensure this does not occur again. We apologise for the distress and inconvenience this has caused.”

In a related case, a woman with a special interest in researching family trees has uncovered what she believes is a serious flaw in the security systems of most banks and building societies. Mary Bond, of Harrogate, says that the standard security check of asking for your mother’s maiden name has been rendered useless by websites assisting research into family history. She says: “It is possible to identify the mother’s maiden name of anyone born in England and Wales between 1837 and 2004 through the reputable family history site www.ancestry.com.

“My boss watched in horror as, simply by knowing that he’s a Yorkshireman and was 63 last month, I identified his mother’s maiden name [his bank’s security check], his marriage details and hence his wife’s maiden name [their children’s bank check]. Delving deeper I also found his wife’s mother’s maiden name [her bank security check]. So a whole family’s security checks can be compromised with a few clicks of the mouse.”

Richard Cook, head of the financial crime section at the British Bankers’ Association, the industry trade body, says: “We take your reader’s comment seriously. Historically, banks used to rely on checks such as your mother’s maiden name and that is still quite common. But we are moving away from that approach because we are aware of how easily identity thieves can obtain that sort of information.

“Many banks are now introducing more subjective checks, such as what is your favourite colour or your first car. The problem is that many customers, especially elderly ones, are happy with their current security check and would not like us changing it. We have to strike a balance between maintaining security without being overly prescriptive.”