Scenarios for Reporting in CANS


Frequently Asked Questions

Question: Do financial institutions need to register with the Department of Banking and pay the $100 registration fee?

Answer: No, banks are not required to register through application with the Department of Banking nor pay a $100 fee to use CANS (Closed Account Notification System). CANS is an electronic notification system and financial institutions only need to set up a master account through a secure web connection to use the system.

Question: What does my financial institution need from the customer in order to report a compromised account through CANS?

Answer: In order to report a customer's information through CANS, you must have (1) a police report or case number, (2) a signed sworn statement, and (3) the signed authorization form from the customer authorizing your institution to report their information through the secure system.

Question: During registration, I was asked for a MICR#. What is this?

Answer: Magnetic Ink Character Recognition (MICR), or routing number, is a nine digit bank code, used in the United States, which appears on the bottom of negotiable instruments such as checks that identifies which financial institution it is drawn upon.

Question: What is the retention period for the sworn statement and affidavit?

Answer: The retention period is not addressed in the law or rule. Given that the deposit account is closed, the general business practice is to retain documents on a closed account for 5 years. We suggest that you confer with your bank counsel or compliance officer.

Question: If we are dealing with a joint account should we enter the information for each person?

Answer: You are to report the information for the person who is the victim. We have contacted several check verification companies who have informed us that they decline checks based on the account number and routing number only.

Question: Is CANS only intended for consumer fraud?

Answer: CANS can be used to report any compromised deposit account. This includes commercial accounts, if the financial institution has received proper notice from a commercial account holder.


Scenarios

The following are common scenarios posed to the Department by financial institutions:

Scenario 1:

Customer calls to report a lost or stolen checkbook, stating that he already filed a police report. The financial institution closes the checking account and assigns him a new checking account number. No fraudulent checks have cleared the account because of the customer's timely report, but the perpetrator who stole or found the checks goes out and writes checks to various merchants. When those checks are presented to the financial institution, it returns the checks marked “closed account.” In this circumstance, where the customer does not incur losses because of timely action, is the financial institution still obligated to report the identity theft to CANS?

Answer:  Yes. If the customer appropriately requests and authorizes the financial institution to notify the major check verification services, the financial institution is obligated to report the closed account information (not the identity theft) to CANS. However, a telephone call from the customer would not by itself constitute an appropriate request and authorization, which requires a sworn written statement.

The scenario you describe is exactly the situation the legislature attempted to address with this new system. Identity theft losses can continue to mount long after the victim first tries to correct the problem. A timely closing of the account may prevent direct losses but it doesn’t immediately stop the fraud. Each check returned unpaid imposes a fraud-related loss on a payee that had in good faith accepted a check from the thief, perhaps even after consulting a check verification service.

Losses incurred by payees can also indirectly create additional problems for your customer through the accumulation of negative information in his or her consumer credit report files. Your customer will bear the burden of clearing his or her consumer credit report files of this false information even though the information was generated solely by the thief's actions.

CANS will facilitate prompt and secure communication of account closings, if attributable to fraud, to all major check verification services simultaneously, thereby better controlling losses. While the new law does not require financial institutions to inform their customers of this notification option, we strongly encourage all financial institutions to help customers take advantage of this service.

Scenario 2:

If a customer reports that his or her ATM or debit card is lost, stolen, or counterfeited, the financial institution may cancel the card but not change the account number. In this circumstance, where the customer does not incur losses because the link between the compromised card and the customer's account is severed, is the financial institution still obligated to report the identity theft to CANS?

Answer: No. In this situation, the deposit account itself appears not to have been compromised. Reporting the card number through CANS is not an option, and submitting the account number to CANS would likely result in merchant rejection of any check drawn on that account.

Your scenario includes a situation in which the customer may have simply lost or misplaced the ATM or debit card. In general, notification through CANS is not available unless the customer believes that he or she is a victim of identity theft, files a police report as a tangible demonstration of that belief, and closes their account.

Scenario 2b:

Under the scenario described in either Question 1 or Question 2, is the financial institution obligated to change the account number(s) even if the financial institution does not know how much information was actually compromised?

Answer:No. With respect to Question 2, closing the account is a decision the customer must make with the assistance of the financial institution. If the existing account will not be closed, the account number should not be reported through CANS.

With regard to Question 1, we do not have authority to require a financial institution other than a Texas state bank to take any specific operational action, even in connection with notification through CANS. However, we believe that any account number reported through CANS will be fully compromised and invalid for future transactions. The law prohibits a check verification service from recommending approval or acceptance of a check or similar sight order drawn on an account that is the subject of a notification through CANS.

Scenario 3:

The customer lives in Texas and has traveled to Chicago for business.  His checkbook is lost or stolen in Chicago and the customer contacts his financial institution (a credit union) about this loss or theft. The credit union changes the checking account number, but not the primary account number for the customer’s savings (share) account which oversees all of his accounts. Is the credit union obligated to report the identity theft to CANS even though it did not change the primary account number?

Answer:  Yes with respect to the former identifying number of the compromised checking account, assuming that the customer files a police report and appropriately requests and authorizes the financial institution to report the closed account through CANS. Our response further assumes that the stolen checks actually have the checking account number magnetically encoded on the face such that a check verification service can match a check inquiry with the CANS data.

Scenario 4:

A customer’s savings (share) account at the customer's financial institution (a credit union) has been compromised with wire fraud, online banking fraud, or ATM fraud. The credit union changes the primary account number but does not change the checking account number. Is the credit union obligated to report this to CANS?

Answer:  Yes with respect to the former identifying number of the compromised savings (share) account, assuming that the customer files a police report and appropriately requests and authorizes the financial institution to report through CANS. Although the savings (share) account may not be generally accessible by check, any potential for attempted access to the account funds in a manner that might trigger submission of the account number to a check verification service would be sufficient to make the notification through CANS effective for its intended purpose.

Scenario 5:

A husband and wife are going through a divorce. The husband contacts the financial institution and requests that the wife be removed from the checking account. The financial institution changes the checking account number and issues new checks to the husband. The wife still has the old checks with both his and her name on the account and continues writing checks to various merchants.  Is the financial institution obligated to report the closed account number to CANS?

Answer:  Not unless the customer (the husband) files a police report, alleging identity theft with respect to the wife's possession of the old checks, and appropriately requests and authorizes the financial institution to report the closed account through CANS.

Scenario 6:

A financial institution has its main office in Texas and a number of branch offices throughout the United States. Is the financial institution obligated to make notification through CANS available to its customers that are residents of states other than Texas?

Answer:  The financial institution is obligated to make notification through CANS available to its customers only at its banking locations in Texas. Further, the customer must be a victim of an alleged crime subject to the jurisdiction of the State of Texas, as described in Section 32.51, Penal Code. Within those constraints, the requesting customer need not reside in Texas.