Print the value of index0
Philadelphia Police & Fire Federal Credit Union PFFCU Breach of Security - Personal Information Disclosed to Another Party without Authorization or Subpeona Philadelphia Pennsylvania
I wrote a letter to Anthony LaRosa – the Treasurer & CEO of the Philadelphia Police & Fire Federal Credit Union - to make him aware of a breach in security at the PFFCU that involved my personal information. Days before, I contacted a PFFCU representative by phone at the PFFCU in reference to a cashier’s check that was issued by the PFFCU – a check issued on the PFFCU funds, not a personal bank account. I provided the PFFCU rep via fax with a copy of the cashier’s check that was released by the PFFCU, along with the names of the 3rd parties that were disclosed this information. I also provided him with my account number, in order to review the transactions on my account dating back to 2007. The PFFCU rep informed me that no one should have received a copy of this check - other than the 3 individuals listed on the check - without a subpoena or a release from the parties named on the check. The PFFCU rep also indicated that if this check was released to anyone, that my account number would have been “blackened” out - because personal indentifying information is always removed when providing information to anyone- which is Bank policy. I received a phone call back from the PFFCU rep within 35 minutes of my original call and was informed that there was no suspicious activity with my account dating back to 2007, but he would have to check with the PFFCU Legal Department to inquire about any subpoena being requested for the cashier’s check. A few days later I contacted the PFFCU rep asking for a follow-up to what information they may have received concerning the release of the cashier’s check. I informed the PFFCU rep that I was aware of there being no subpoena for the cashier’s check, nor was I notified by the PFFCU requesting a signed release for this information. The PFFCU rep told me that he was still waiting to hear back from the PFFCU Legal Department for confirmation. A week later the PFFCU rep contacted me and informed me that they could not determine who, or when the cashier’s check was released. He went on to say that the PFFCU had a change to their computer System and that you were not able to go back to 2007 to retrieve any information –the records only went back to 2008. He also indicated that a 3rd party, a person that NO personal attachment to the cashier’s check what-so ever, may have been provided a copy by a teller, by deceptive intentions . I expressed my concern as to what additional information may have been provided to the 3rd party – my Social Security number, date of birth & address – and he could not deny this information was not provided. I feel the PFFCU rep’s explanation is UNACCCEPTABLE. To say I am livid at this point is an understatement! The PFFCU stance on matters like these is like any other company dealing with personal & confidential information – NO TOLERERANCE! The PFFUC claims that every transaction is tied into a PFFCU employee’s PIN , then why can’t the employee that provided this cashier’s check be located? To say the PFFCU’s records only go back to 2008 when this cashier’s check was issued in 2007 is unrealistic! Records by law have to be retained for a minimum of 7 years. I informed the PFFCU rep that the cashier’s check was only recently obtained by the 3rd party….or it would have shown up as Court discovery long before this year. This court case has been on- going since 2004! As a side note – I later was informed that one of the individuals of the 3rd party that was disclosed this cashier’s check is a person allegedly accused of forgery, insurance fraud and pretexting – all of which is public record in the Delaware County PA Courts. I am so adamant about protecting my personal information - I just may be their next victim. For the record, I don’t have a business or personal relationship with either 3rd party. I meant absolutely nothing to these individuals. And now as result of a breach of security at the PFFCU – everything about me personally has been divulged and acquired by these individuals with what seems to be without concern or responsibility on the PFFCU’s part, according to the PFFCU’s rep. The PFFCU rep’s response to my inquiry is that these kinds of incidents happen all the time – this is just one more, why be concerned?...!!! It’s my personal information that has been disclosed! I’ve been a member of the PFFCU for 40+ years…I come from a long line of family members that are police and firefighters- these are loyal people of the PFFCU organization – the foundation. I would think loyalty being one of the core values of the PFFCU would result in the PFFCU being loyal to its longtime members! Their business practices are not based on this philosophy any longer….the PFFCU is “big” business now….their response to this matter was that if I’m concerned about the security of my account, that I should place what they call a “TAC” number on my account for “added security and peace of mind”. Seriously! This is the best response the PFFCU could come up with? My personal information was release to a 3rd party by the PFFCU and the PFFCU cannot explain When the information was released, How the information was release, Who released the information or to Whom the information was released to! Mr. LaRosa as Treasurer& CEO of the Philadelphia Police & Fire Credit Union you are responsible for daily operations of the PFFCU – you were personally notified of this matter. If your staff cannot provide the answers to how a breach of security occurred at the business you are elected to run….maybe the membership needs to elect a New Treasurer & CEO that will get the job done right – and GET answers!
2 Updates & Rebuttals
Jon
Pennsylvania,THE PFFCU Customer is correct per company policy
#3UPDATE Employee
Tue, August 06, 2013
I’m an employee of the PFFCU and I have worked for them for years - the PFFCU makes its members jump through hoops to prove their identity BEFORE any information is released. The PFFCU requires a member’s driver’s license to be scanned into their computer system and before any member begins a transaction, their account number is compared to the picture the PFFCU has on file – right on our computer screen. If there is any question about a person’s identity, we have a check list of procedures we must go through to ensure the identity and privacy of each member. Every employee upon being hired is provided with a PIN number and every transaction an employee completes through the PFFCU is tied to that employee.
There is not a one transaction that cannot be traced back to any single employee – a phone call, email, online transaction, an in person visit to a bank or mail – everything is traced to an employee and everything is recorded on security cameras. This is the PFFCU’s policy on a Cashier’s Check - only the individual(s) listed on the check can make inquiries about the check – or a Court, if a subpoena is issued – even with a subpoena, the PFFCU member would be notified by mail about the Court inquiry and would have 10 business days to address the inquiry.
The author of the letter -( customer)- above is 100% correct about the bank policy. Someone at the PFFCU screwed up and provided that information. A copy of a cashier’s check would not walk out the door of the bank unless an employee provided a copy to someone - and that employee can be traced back to that transaction without a doubt! For this customer to be told anything else, by any employee, is a lie. The PFFCU is hiding information for reason – or protecting someone. There’s no other reason for this to have happened. As an employee I would know.
Jim
Anaheim,California,
I Am Trying To Understand Intent??
#3Consumer Comment
Sun, August 04, 2013
So far, you've definitely provided evidence of the bank releasing information they should not have. The question becomes whether the CU was just as much a victim as you were? I'm trying to understand where in your story is the CU's actions intentional, and so far I don't see it. By your own admission, information was issued as a result of deception by others who would have needed to provide additional fraudulent information in order to get a cashier's check issued and then copies issued to unauthorized people. Do you have a right to be concerned about identity theft?? Sure, but are you really saying there's intent by the CU?? You haven't really made that case.
The CU should assume some level of responsibility - and I would ask them to secure credit monitoring services for a 3 year period based on what you've found out. They've already asked you to putting alerts on your bank account - so that's pretty acceptable. If you don't get a response from the letter - I would close the account.
BTW - just because the computer information isn't there doesn't mean the information isn't available. It just means the information is now only in hardcopy form and someone has to retrieve the information. The bank is allowed not to have seven years of information available on computer if they're unable to. Someone could pull the information from a closet or from storage. Best of luck to you!!