THE manager of an Indian call centre revealed to The Times yesterday the ease with which workers can steal confidential information despite claims by British banks that security is tight.

His revelation came as the Information Commissioner said that banks, building societies and credit card companies could be prosecuted after 1,000 British bank and credit card details were sold to an undercover newspaper reporter in Delhi. Police in London and India are investigating the sale.

Call centres, however, say that they take stringent measures to prevent data theft. They limit access to customer information and ban pens, paper and camera phones to stop customer details being copied or photographed.

Staff who take the calls cannot access complete databases, only single entries corresponding to individual customer calls.

But the manager of a call centre in Gurgaon, a suburb of Delhi, told The Times that it was relatively simple for workers to steal data if they were technically minded or in a managerial position with greater access.

“You just have to open the interface where the data is stored, copy it and take it home,” the manager said. “I have never accessed it, but if I wanted to I could. If the data is stored here the tech guys can get to it too.”

Call centres typically ask for three references for new employees but managers say that the rules are often bent, for example if a prospective employee is referred by a current worker or if a referee is unavailable. The high turnover of staff also results in laxer hiring practices and poor workforce loyalty.

Kkaran Bahree, the alleged middleman who sold the details to a reporter from The Sun, claimed to have gathered them from a network of call centre workers in Gurgaon and said that he could get up to 2,000 account details a month.

He said he had gained his knowledge of the business while working at Daksh e-Services, now an outsourcing subsidiary of IBM, where he was a technical trainer.

The reporter paid £2,750 for the data and was asked for another £275 to be sent later.

The information included account holders’ addresses, passwords, credit card details, and passport and driving licence information. In some cases there were also the issue and expiry dates of bank cards, as well as the three-digit card security number.

Mr Bahree works at Infinity, a web marketing company in Gurgaon and his employers were stunned yesterday to hear the allegations against him.

He joined them less than a month ago as a content writer, a non-technical position. He said that he had no references because he had been volunteering at an aid organisation for several months since graduating.

In fact, he had left Daksh in January last year after three years, before moving to Infinity.

Rohini Dutt, the head of personnel at Infinity e-services, said she had no qualms about hiring him despite his lack of reference. “I thought, he’s such a cute kid,” she said. “I wasn’t fussed about the reference because I thought he had vision.”

The Information Commissioner’s staff are in contact with the fraud squad at the City of London Police who have been given a dossier by The Sun. Companies whose customer details have been leaked will also be questioned.

A spokesman said that companies using third parties to provide services personal data were required to ensure the reliability of those parties. Companies remain liable for security failings whether the call centre is in Britain or India. Failure could lead to a criminal prosection and £5,000 fines under the Data Protection Act 1998.

The Halifax, the Royal Bank of Scotland, Nationwide and NatWest, all said yesterday that it was unlikely that they had been affected as they did not have call centres in India. But Barclays, the Woolwich, HSBC and Lloyds TSB, said they were working with police.

Philip Robinson, the head of financial crime at the Financial Services Authority, said an FSA report last month on security in offshore call centres including India concluded that it was “pretty robust”.

Explore UK News

• Crime News

• Education News

• Health News

• Science News

• Scotland News

Times Recommends

• Donor organ allowed child’s own heart to heal
• Michael Jackson: Not the final chapter
• Sacha Baron Cohen forced to tone down Brüno