Financial Institutions Frequently Asked Questions (FAQ)
Question: Do financial institutions need to register with
the Department of Banking and pay the $100 registration fee?
Answer: No, banks are not required to register through application
with the Department of Banking nor pay a $100 fee to use CANS
(Closed Account Notification System). CANS is an electronic
notification system and financial institutions only need to
set up a master account through a secure web connection to
use the system.
Question: What does my financial institution
need from the customer in order to report a compromised account
through CANS?
Answer: In to report a customer's information
through CANS, you must have (1) a police report or case number,
(2) a signed sworn statement,
and (3) the signed authorization form from the customer authorizing
your institution to report their information through the secure
system.
Question: During registration, I was asked
for a MICR#. What is this?
Answer: Magnetic Ink Character Recognition (MICR),
or routing number, is a nine digit bank
code,
used in the United States, which appears on the bottom of negotiable
instruments such as checks that identifies which financial
institution it is drawn upon.
Question: What is the retention period for
the sworn statement and affidavit?
Answer: The retention period
is not addressed in the law or rule. Given that the deposit
account is closed, the general business practice is to retain
documents on a closed account for 5 years. We suggest that
you confer with your bank counsel or compliance officer.
Question: If we are dealing with a joint account should we enter the
information for each person?
Answer: You are to report the
information for the person who is the victim. We have contacted
several check verification companies who have informed us that
they decline checks based on the account number and routing
number only.
Question: Is CANS only intended for consumer
fraud?
Answer: CANS can be used to report any compromised deposit account. This includes commercial accounts, if the
financial institution has received proper notice from a commercial
account holder.
The following are common scenarios
posed to the Department by financial institutions:
Scenario 1:
Customer calls to report a lost or stolen checkbook, stating
that he already filed a police report. The financial institution
closes the checking account and assigns him a new checking
account number. No fraudulent checks have cleared the account
because of the customer's timely report, but the perpetrator
who stole or found the checks goes out and writes checks
to various merchants. When those checks are presented to
the financial institution, it returns the checks marked “closed
account.” In this circumstance, where the customer
does not incur losses because of timely action, is the financial
institution still obligated to report the identity theft
to CANS?
Answer:
Yes. If the customer appropriately requests and authorizes
the financial institution to notify the major check verification
services, the financial institution is obligated to report
the closed account information (not the identity theft) to
CANS. However, a telephone call from the customer would not
by itself constitute an appropriate request and authorization,
which requires a sworn written statement.
The
scenario you describe is exactly the situation the legislature
attempted to address with this new system. Identity theft
losses can continue to mount long after the victim first
tries to correct the problem. A timely closing of the account
may prevent direct losses but it doesn’t immediately
stop the fraud. Each check returned unpaid imposes a fraud-related
loss on a payee that had in good faith accepted a check from
the thief, perhaps even after consulting a check verification
service.
Losses incurred by payees can also indirectly create additional
problems for your customer through the accumulation of negative
information in his or her consumer credit report files. Your
customer will bear the burden of clearing his or her consumer
credit report files of this false information even though
the information was generated solely by the thief's actions.
CANS will facilitate prompt and secure communication of
account closings, if attributable to fraud, to all major
check verification services simultaneously, thereby better
controlling losses. While the new law does not require financial
institutions to inform their customers of this notification
option, we strongly encourage all financial
institutions to help customers take advantage of this service.
Scenario 2:
If a customer reports that his or her ATM or debit card
is lost, stolen, or counterfeited, the financial institution
may cancel the card but not change the account number. In
this circumstance, where the customer does not incur losses
because the link between the compromised card and the customer's
account is severed, is the financial institution still obligated
to report the identity theft to CANS?
Answer:
No. In this situation, the deposit account itself appears
not to have been compromised. Reporting the card number through
CANS is not an option, and submitting the account number
to CANS would likely result in merchant rejection of any
check drawn on that account.
Your scenario includes a situation in which the customer
may have simply lost or misplaced the ATM or debit card.
In general, notification through CANS is not available unless
the customer believes that he or she is a victim of identity
theft, files a police report as a tangible demonstration
of that belief, and closes their account.
Scenario 2b:
Under the scenario described in either Question 1 or Question
2, is the financial institution obligated to change the account
number(s) even if the financial institution does not know
how much information was actually compromised?
Answer:
No. With respect to Question 2, closing the account is a
decision the customer must make with the assistance of the
financial institution. If the existing account will not be
closed, the account number should not be reported through
CANS.
With regard to Question 1, we do not have authority to require
a financial institution other than a Texas state bank to
take any specific operational action, even in connection
with notification through CANS. However, we believe that
any account number reported through CANS will be fully compromised
and invalid for future transactions. The law prohibits a
check verification service from recommending approval or
acceptance of a check or similar sight order drawn on an
account that is the subject of a notification through CANS.
Scenario 3:
The customer lives in Texas and has traveled to Chicago
for business. His checkbook is lost or stolen in Chicago
and the customer contacts his financial institution (a credit
union) about this loss or theft. The credit union changes
the checking account number, but not the primary account
number for the customer’s savings (share) account which
oversees all of his accounts. Is the credit union obligated
to report the identity theft to CANS even though it did not
change the primary account number?
Answer:
Yes with respect to the former identifying number of the
compromised checking account, assuming that the customer
files a police report and appropriately requests and authorizes
the financial institution to report the closed account through
CANS. Our response further assumes that the stolen checks
actually have the checking account number magnetically encoded
on the face such that a check verification service can match
a check inquiry with the CANS data.
Scenario 4:
A customer’s savings (share) account at the customer's
financial institution (a credit union) has been compromised
with wire fraud, online banking fraud, or ATM fraud. The
credit union changes the primary account number but does
not change the checking account number. Is the credit union
obligated to report this to CANS?
Answer:
Yes with respect to the former identifying number of the
compromised savings (share) account, assuming that the customer
files a police report and appropriately requests and authorizes
the financial institution to report through CANS. Although
the savings (share) account may not be generally accessible
by check, any potential for attempted access to the account
funds in a manner that might trigger submission of the account
number to a check verification service would be sufficient
to make the notification through CANS effective for its intended
purpose.
Scenario 5:
A husband and wife are going through a divorce. The husband
contacts the financial institution and requests that the
wife be removed from the checking account. The financial
institution changes the checking account number and issues
new checks to the husband. The wife still has the old checks
with both his and her name on the account and continues writing
checks to various merchants. Is the financial institution
obligated to report the closed account number to CANS?
Answer:
Not unless the customer (the husband) files a police report,
alleging identity theft with respect to the wife's possession
of the old checks, and appropriately requests and authorizes
the financial institution to report the closed account through
CANS.
Scenario 6:
A financial institution has its main office in Texas and
a number of branch offices throughout the United States.
Is the financial institution obligated to make notification
through CANS available to its customers that are residents
of states other than Texas?
Answer:
The financial institution
is obligated to make notification through CANS available
to its customers only at its banking
locations in Texas. Further, the customer must
be a victim of an alleged crime subject to the jurisdiction
of the State of Texas, as described in Section 32.51, Penal
Code. Within those constraints, the requesting customer need
not reside in Texas.
|
