13 WTHRWTHR finds mortgage and title companies jeopardizing client information

WTHR finds mortgage and title companies jeopardizing client information

Bob Segall/13 Investigates

It's not just drug stores that are trashing their customers' privacy. WTHR has discovered mortgage and title companies are doing the same thing.

Inside the unsecured dumpsters of Indianapolis-area mortgage and title companies, 13 Investigates found thousands of documents containing personal financial information on hundreds of people.

Among the information found: customers' social security numbers, bank account numbers, credit card numbers, credit scores and detailed loan information that accompanied other personal information such as names, addresses, phone numbers, birth dates, and copies of customers' paychecks and drivers licenses.

"It's all information that could lead to identity theft and it should never, ever be in there," said Kelly Miller, executive director of the Indiana Association of Mortgage Brokers. "It's a complete violation of our code of ethics."

WTHR's privacy test included more than 60 businesses around the metro area. WTHR found private financial information in mortgage and title company dumpsters in Indianapolis, Carmel, Fishers, Greenwood, Beech Grove, Avon and Brownsburg.

The privacy test was prompted by tips from mortgage and title company insiders who, after seeing WTHR's 2006 Prescription Privacy investigation showing pharmacy dumpsters full of customers' highly-sensitive information, contacted 13 Investigates to report the same practice taking place within the financial industry.

Representatives at all of the local mortgage and title companies contacted by 13 Investigates said they have longstanding policies that require clients' personal information to be shredded. WTHR's investigation shows those policies are not always followed.

At Premier Mortgage Funding in Fishers, a trash bag containing personal information on dozens of clients was sitting next to a dumpster in the parking lot.

Ryan Pratt, assistant manager at Premier, said WTHR's discovery was "bothersome" because the company hires an outside contractor to shred and dispose of all discarded customer information.

"Unfortunately this happened and I apologize to anyone it happened to," Pratt said. "I'm sure it happens everywhere. I don't know how anyone can be 100%."

Supervisors at American Acceptance Mortgage on Indianapolis' west side expressed surprise that their dumpster also contained very sensitive financial records.

"We have shredders in every office," explained company president Tim Wood in a written statement. "It has always been our policy to shred all documents that contain any personal information of our clients and/or employees."

At Hamilton Title Security in Carmel, where discarded trash contained clients' social security numbers and other personal information, the company has locked its dumpster and implemented a more rigorous policy for destroying client records.

"We've instituted a 100% shredding policy for all of our documents," said David Olsen. "That [information] should not have been in the dumpster and it upsets us and we regret that."

Hamilton Title says it plans to offer a free credit monitoring service to those customers whose information was retrieved by WTHR "to help minimize any concerns about identity theft."

Despite the apologies, customers like Russell Biegel say their confidence in the mortgage and title industry is shaken by the lack of attention regarding personal privacy.

"When I come to find out all of my personal and financial information is dumped in the trash, it's very frightening," said Biegel, who recently purchased a new home.

WTHR found Biegel's complete credit history -- including bank account numbers, credit card numbers, social security number, credit score, and salary and employment information -- in Hamilton Title's dumpster just three days after the title company closed on his home loan. "They best clean up their act because ... for an identity thief, there's everything he needs."

Peter Beyer is also concerned about identity theft after Lock Financial Group, a mortgage company located on the south side of Indianapolis, placed his home loan application in its dumpster.

"This has everything on it," Beyer said as he looked through the document at WTHR's studio. "That's my social security number, my bank accounts, my credit card accounts, pretty much everything.... To me this ain't trash to be thrown in a dumpster."

The owner of Lock Financial told WTHR the company usually does shred client information and that it was likely a recently-fired employee who failed to follow company policy.

Failing to destroy clients' personal information isn't simply a violation of company policy. In many cases, it is also a violation of state and federal law.

According to Indiana law, "a person who disposes of the unencrypted, unredacted personal information of a customer without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable" could face penalties that include both fines and jail time.

In addition, mortgage companies that engage in dishonest or unethical practices could face license suspension or revocation, according to the office of the Indiana Securities Commissioner.

"Privacy issues are taken very seriously and we do investigate all complaints that come in to our office," said Jennifer Fanger, a spokeswoman for the securities division of the Secretary of State's office.

The Indiana Department of Insurance, which regulates the state's title companies, says it also welcomes complaints from consumers who believe their private information has been compromised.

The Federal Trade Commission enforces national privacy regulations mandated by Congress. The FTC's Safeguards Rule, enacted under the Gramm-Leach-Bliley Act, requires financial institutions, including mortgage brokers and title companies, to implement reasonable policies and procedures to ensure the security and confidentiality of sensitive customer information.

"This is an area we're very concerned about, and we do bring enforcement actions against companies that violate these rules," said Jessica Rich, assistant director of the FTC's Bureau of Privacy and Identification Protection in Washington, DC.

Rich said the FTC has already filed civil action against 14 businesses (including some mortgage companies) for failing to protect customer information, and she said more action is possible if consumers file complaints about mortgage and title companies that dumped personal information in central Indiana.

"This is about securing data and not letting it get in the wrong hands, so we are very interested in what you discovered and will be watching your report closely," Rich added.

All documents obtained by WTHR during the investigation have either been shredded or returned to the individuals identified on the records.

Industry leaders say the investigation will serve as a wakeup call.

"Finding that much information in the garbage is very, very serious," Miller said. "This will get people talking and it will give us a good opportunity for education. That information has to be protected."

Last summer 13 Investigates discovered prescription labels and healthcare records dumped into unsecured drug store dumpsters around Indianapolis and a dozen other U.S. cities. The documents contained protected healthcare information on more than 2,000 people. The Prescription Privacy investigation prompted separate investigations by the Indiana Attorney General and the U.S. Department of Health and Human Services' Office of Civil Rights, and led to significant reforms at more than 15,000 drug stores nationwide.

Related links

To learn more about identity theft and prevention and laws to prevent it:

US Dept of Justice  - ID theft info

Federal Trade Commission - ID theft info

Fair and Accurate Credit Transactions Act

How to file a complaint

To file a complaint about a mortgage or title company with the Federal Trade Commission, call 1-877-FTC-HELP (1-877-382-4357) or fill out an online complaint form.

To file a complaint against a mortgage company with the Indiana Secretary of State's securities division, call 1-800-223-8791 or fill out an online complaint form. 

To file a complaint against a title company with the Indiana Department of Insurance, call 1-800-622-4461 or fill out an online complaint form.