Bank Lawyer's Blog

The City With Big Shoulders: Bank Robbbers' Paradise

Because that's where the money is.
---Bank robber Willie Sutton, in answer to the question "Why do you rob banks"?

While most serious bloggers attempt to close out a year with a retrospective of important issues germane to the central core of their blog, here at Bank Lawyer's Blog, we like to focus on the oddball and trivial. Such as this curious statistic:

Bank heists in the Chicago region reached record-breaking numbers in 2005, and the pace hasn't let up as the year comes to an end, with three robberies Thursday alone.

The three bring the year's tally to 230 in the Chicago area. There were 160 last year, 151 in 2003, 191 in 2002, 156 in 2001 and 128 in 2000.

The previous record number of heists was 195 in 1995. FBI officials cannot explain the spike in bank robberies but say there are more repeat bank robbers and more violent takeover bank robberies.

Chicago, Chicago That toddlin' town..
On state street, that great street, I just wanna say,
They do things they don’t do on Broadway...

Apparently, that includes robbing banks.

According to an FBI agent quoted in the linked article, drug addiction fuels many of the current robbers' need for dough. Only a person as addled as an addict would play a sucker's game where (a) the crime is always a federal one, (b) the agency charged with apprehending the evildoers (while it may not be able to differentiate a jiahdist from your grey-haired granny) is expert at catching bank robbers, and (c) the federal sentencing guidelines usually mandate much stiffer penalties (longer prison sentences and larger fines) than many state laws covering the same type of crime (armed robbery).

Ya' know, a bank lawyer with a head for business and a bod for sin might just be able to show those punks a thing or two about robbing banks. But then, that would be wrong. It would be more than wrong. It would be a travesty. A travesty of a mockery of a sham of a mockery of a travesty of two mockeries of a sham.

And for a mere $10,625 ($1.7 million divided by 160) per robbery? Heck, any lawyer worth his salt could bill that in half a day. Less, if he managed to travel across the International Date Line going the right way while working simultaneously on several client files, billing in minimum increments of a half-hour.

Y'all have a Happy New Year.

Merry Christmas: We Lost Your Personal Information

I'm certain that the irony was unintentional, but sending a notification to consumers on Christmas Eve that you've lost their personal information seems a tad...insensitive.

Marriott Vacation Club International (MVCI), the vacation ownership division and subsidiary of Marriott International Inc., had a nasty Christmas Eve surprise for 206,000 of its customers: a report that backup tapes had been lost containing sensitive personal data, including Social Security numbers, and bank and credit card numbers.

MVCI released a press release Dec. 27 reporting that the tapes had "disappeared" from the corporate office in Orlando Fla., -- in mid-November, according to some reports. The company said that the letter to affected customers and associates had only gone out Dec. 24 because they were first trying to find the tapes, and then conducting an investigation to figure out what data was on the lost cartridges.

It was unclear how many tapes were lost, or how they were lost; the company does ship its tapes off site, but MVCI corporate spokesperson Ed Kinney said that the tapes were not lost by a courier or off-site storage firm.

At least they didn't claim: "My dog ate the tapes."

The company sent four separate letters to all its customers: one indicating the customer's credit card number was among the data lost on the tapes; one for Social Security numbers; one for bank account numbers; and one letter to unaffected customers. Customers whose data fell into multiple categories were sent multiple letters.

MVCI said it had also notified state and federal officials, credit card companies, credit reporting agencies and the U.S. Secret Service of the loss.

The company has also established a special contact telephone number, (800) 952-8145 and a Web site, or impacted individuals may e-mail the company here.

Finally, MVCI is offering free credit-report monitoring with Intersections Inc. The service includes a three-bureau credit report, and assistance reviewing the report and placing a fraud alert. The company had previously enrolled customers with identity theft insurance, and mentioned in its letter to impacted individuals that they were eligible for up to $2,500 in financial reimbursement, with a $250 deductible for certain expenses associated with identity theft.

MVCI's response seems to be what will become "industry standard" for such occurrences. When you think about how expensive the responsive measures are to implement, regardless of whether or not any of the lost information is ever used to commit fraud or identity theft, and what damage to reputation they can cause, any business, including especially the banking business, has to accord data protection a high priority.

I think that the "free credit monitoring service" is a remedy that will come to be expected. I would not be surprised to see regulators impose it as a customary remedy in the event of security breaches (especially where the compromised data is not encrypted). That is one of the many reasons that in their contracts with outside vendors who transmit, store or process customer and other confidential information, banks should insist that the vendor fully indemnify the bank from all third-party claims and "other liability and damages" that the bank might suffer by reason of the vendor's breach of its confidentiality and security obligations to the bank. Such indemnifications should not be subject to disclaimers, exclusions or limitations on liability or damages that might otherwise protect the vendor.

The linked article's call for encryption of data "throughout its life cycle" is also a sound proposition. Yes, it can be expensive, but that expense has to be seriously weighed against the benefit, including the "armor plating" that encryption can provide from (a) triggering notification obligations (which will vary depending upon the applicable state law) and (b) the expense of remedial measures in the event of a security breach. Although the article notes that Iron Mountain (a major player in the off site data storage game) offers an encryption service, that type of vendor service wouldn't have helped Marriott, which managed to lose the data tapes before they made it off site. Nor would it have helped in ABN AMRO's case, where the data was lost in transit to the vendor. Encryption needs to start when data is first entered, not when it is transmitted off site.

Unitended Consequences of Two-Factor Authentication

In an editorial comment in the most recent issue of the Financial IT Security insert to the American Banker (no online copy available), Editor-in-Chief Holly Sraeel has some savvy observations for bankers about the recent FFIEC Guidelines that require banks and other financial institutions to enact dual-factor authentication procedures by the end of 2006.

The authentication guidance...has been labeled onerous, burdensome and, with compliance set for 2006, costly. What many industry players fail to note is that such guidance is also long overdue. Current levels of authentication-generally single factor-is clearly inadequate, opens institutions up to greater vulnerabilities as criminals put their Internet skills to use and leaves little room for institutions to take security beyond the tactical and into the strategic realm.

In other words, if banks, even small institutions, haven't been thinking "strategically" about enterprise security, they should take this opportunity to do so. As Ms. Sraeel points out, such strategic thinking is necessary "given the pace of technological change and how adept criminals are at keeping pace with innovation."

It was bound to happen. With the Internet's meteoric rise for commercial use over the past seven years, it's surprising that multi-factor authentication was not mandated sooner. Think of it this way: The more that institutions do to safeguard customer and corporate information, the less likely they are to incur losses (obvious) and other damages such as the lack of proprietary information affecting mergers, stock performance and product launches (becoming more obvious).

Most important, though, the guidance could prompt financial institutions to look beyond what is expected; for larger institutions, this could mean giving customers and partners secure access to more online services. This can only be good for business, and well worth the investment in multi-factor authentication. For smaller institutions, the guidance will require that they identify third-party providers whose technology meets or exceeds the FFIEC guidelines and, in doing so, opens new doors of opportunity.

Obviously, Ms. Sraeel is a "glass-half-full" kind of woman. Another, less optimistic, observer simply asserted "that banks should just quit whining." Holly put it much better than that other guy, whoever he was.

My Curve's Inverted!

What we've been fretting about for months came to pass: an inverted yield curve. Yesterday, yields on 10-year US Treasury notes slipped slightly below those on 2-year notes. As many online and offline articles have intoned, the "inverted yield curve " in the past it "has often preceded a recession."

For now, though, many analysts - while keeping close tabs on the behavior of bonds - are not ready to ring the alarm...Against this backdrop, "I think the message in this inverted yield curve is muddled," said Mark Zandi, chief economist at Moody's Economy.com.

As I observed last month, economists are all over the place on the importance of the inverted yield curve to banks. Some assert that banks aren't as sensitive to a flat or inverted curve because of the use of derivatives. Nevertheless, an Associated Press reporter nails the "conventional wisdom" as to the principal risk to banks of a sustained "flat" yield curve.

If the flip seen Tuesday were to be sustained and the gap between the yields on the two-year and 10-year Treasury notes were to widen, it could spell trouble, analysts said.

Credit could get seriously crimped, they said. Banks normally borrow money at short-term rates and lend out the money at longer-term rates.

"When the yield curve inverts, banks' funding costs rise above what they earn by lending. This can produce a credit crunch," said Greg McBride, senior financial analyst at Bankrate.com.

The housing market also could be hurt if the pool of money available for lending were to dry up.

As I also noted in August, the mismatch between the costs of borrowing and the yields on loans causes banks to look to sources of income other than interest, one of which is fee income. Overdraft charges, for example.

I agree that it's too early to tell what the effect of the inverted yield curve will be on banks, much less on the economy as a whole. However, I wouldn't be as cavalier as some of the experts quoted in these articles about dismissing the potential harm of not only the inverted yield curve, but, even if the inversion is not sustained, the continuation of the flat curve we have been experiencing over this past year. Banks (for the most part) aren't run by dummies. Therefore, if you don't like your banks "nickel and diming" you for fees, I'd say that you're likely to be in a constant state of agitation for some time to come.

Extra CRA Credit

Last Tuesday, the Office of Thrift Supervision issued an advisory to "confirm" that the OTS will give favorable CRA consideration to activities by institutions that are supervised by the OTS "that provide lending, investment, or service activities to revitalize or stabilize" areas affected by Hurricanes Katrina and Rita, and will also recognize activities that benefit displaced individuals. Although the OTS cautions institutions not to "overlook local neighborhoods and needy individuals" within their normal assessment areas, it "will favorably consider such activities" and will "give significant weight to activities that benefit low-to moderate-income individuals or areas."

This "extra credit" for CRA assessment purposes is justified by "the magnitude of these disasters and their impact on the country." The advisory indicates that the areas affected are not just in the Gulf States, but on other "local economies" throughout the U.S. I assume that, for example, investments, loans and services meant to aid Katrina or Rita victims who have been evacuated to other areas (Houston, San Antonio and Dallas, for example) would be given "favorable consideration."

To answer one sardonic inquiry I received, I do not think that investing in a new "land-based casino" in Mississippi, is exactly the type of investment CRA the OTS had in mind (although I can't state flatly that it would not be), but that investments, loans or grants to aid in the building of affordable housing for the service personnel that would work in the casino would appear to be exactly the type of investment that would be covered. I'm sure your local OTS Regional Office would be happy to clarify the issue for you.

Home Sales Take A Hit

The US Commerce Department released data last Friday that shows that home sales in this country plunged 11.3% in November from October's record high. According to press reports, Wall Street had been expecting an 8.7% drop off (why the expected drop off was 8.7% as opposed to, say, 8.6%, I'm not certain). Of course, October's home sales were a "record high," so anything less than the top is not exactly surprise. Still, as I've been wondering for some time now: are mortgage lenders in for "bad times"?

While sales of both new and existing homes are still on track to set records for a fifth straight year in 2005, analysts are forecasting sales will decline in 2006 as the housing boom quiets down.

Sales of existing homes dropped nearly 3 percent for the month of October, the National Association of Realtors reported late last month. That decline pushed the number of unsold homes to 2.87 million, the highest level in more than 19 years.

Sales of existing homes outpace those of new homes by a rate of nearly 6 to 1.

“The data must be considered confirmation of a clear slowing in the housing sector,” said Alan Ruskin, research director at 4CAST Ltd.

[...]

Some economists are worried that housing prices in some areas have been driven higher by a speculative frenzy that could see prices plunging as sales slow in the hottest markets. That scenario would evoke memories of the sharp declines that occurred when the stock market bubble burst in early 2000.

But other economists contend that housing is unlikely to exhibit the same collapse that the stock market did although they believe that the declines in sales expected next year will act as a drag on the overall economy.

Obviously, the "dismal science" is filled with men and women much like lawyers. Depending on who pays their bills, they "feel strongly, both ways."

The best case scenario is that the housing bubble may pop in certain speculative areas of the country (In this case, do you think "What happens in Vegas, stays in Vegas"? No, me either), while the rest of the country has a relatively "soft landing." In either event, the days when everyone and his pet cat "Snuggles" could make money as a mortgage broker appear either to be long gone or about to be long gone.

As I've warned before (and will have more to bloviate about in the near future), if you're a bank or thrift who's a mortgage lender and you think "alternative mortgages" are now THE ANSWER to this downturn, think again. Then think some more. At that point, prepare for your next regulatory examination.

Expansion and Retraction

A couple of follow-ups on earlier posts:

Apparently, The American Banker "jumped the gun" (if not the shark) in its December 7 report that the White House would nominate New York State Superintendent of Banks Diana Taylor to head the FDIC. According to Ms. Taylor's office, although she'd be willing to consider the job, no one from the White House has spoken to Ms. Taylor about the position. Well, that's never stopped George W. Bush before! Heck, why actually ask the candidate in advance if she'd be interested? Just nominate her and...you know...see what happens. If the first one thrown against the wall doesn't stick, they're plenty more from where she came from.

On another front, I may have underestimated the problem of mortgage fraud by only discussing the problems in North Texas. A much richer vein of mortgage fraud has been mined in-of all places-the land of The Kiwi.

A mortgage scam involving inflated house sale prices is understood to have fleeced large amounts of money from banks in the Auckland and Waikato regions.

[...]

Real Estate Institute national president Howard Morley said the scam involved people applying for mortgages using a fraudulently obtained or altered sale and purchase agreement with inflated sale prices.

[...]

Mr Morley, who is a registered valuer, said competition for mortgage customers meant some banks no longer required independent valuations before extending loans, relying on the sales agreement alone.

In the US, a bank that relied solely on the sales price stated in the contract to set the Loan-to-value ratio, and that did not obtain an appraisal prepared by a licensed, independent appraiser, would be violating safety and soundness standards (and federal regulations, for those governed by them), and would be boiled in oil. In laid back New Zealand, apparently, it's "no worries mate" when it comes to verification of the fair market value of collateral.

Don't Bank on Banks in 2006, Says Merrill Lynch

While mortgage lenders delve into yesterday's announced "guidance" from the federal bank regulators on "Nontraditional Mortgage Products" (a subject for a post-holiday post), a Merrill Lynch analyst is looking at bank stock valuations for 2006, and...yawning.

Economists and market strategists everywhere believe the Fed's run of interest-rate hikes is getting near the end. That should be bullish news for bank stocks, which typically enjoy a good ride at the end of a tightening cycle, as loan demand steadies and yields on their long-term investments outpace short-term interest paid to customers.

But Merrill Lynch banking analyst Edward Najarian doesn't see it that way for 2006. Full valuations, a flat or inverted yield curve (which bumps up interest expense) and expected increases from historically low loss rates on loans and credit cards are reasons not to bank on a strong run for the sector next year, he said.

Because I represent banks, I stay out of bank stocks. Who needs even the appearance of an impropriety? My ill-tempered nature is enough of a handicap to my professional life without that grief. Mr. Najarian just gave me another good reason.

I guess Wall Street has overcome its recent scandals involving analysts who are pressured to tout the stock of clients. Or, perhaps, "The Bull" doesn't "run with the banks" much these days. 

Mortgage Fraud: The Second Oldest Crime In Texas

"If prostitution is the oldest crime, mortgage fraud has got to be the second-oldest – at least in Texas," said U.S. Attorney Richard Roper.

I always thought it was cattle rustling or murder, but that just shows you I'm merely another carpetbagger.

The Dallas Morning News (free registration required) recently highlighted the increase in mortgage fraud in North Texas. North Texas, of course, is not alone.

"This type of fraud has really been reaching epidemic proportions throughout the U.S.," said FBI Special Agent Lori Bailey.

Most commonly, the crooks:

• Recruit a paid "straw buyer" who signs a loan application for a home with an inflated market appraisal – sometimes more than doubling the property's actual value.
• Submit those documents to a bank either directly or through a mortgage broker who finds a willing lender.
• Pay off the first mortgage, pass any equity on to the seller, and then split up the profits from the inflated loan.

The loan eventually goes into default, ruins the straw buyer's credit and leaves the defrauded banks and authorities to sort out whether a crime has been committed.

Hillary Clinton said it "takes a village" to raise a  child. Maybe or maybe not.

There's no arguing, though, that it takes a gang to pull off a scheme like this. You need criminally inclined sellers, "straw" buyers, brokers and appraisers. Apparently, there's no shortage of them.

Suspicious Activity Reports filed by federally insured banks – about a third of the total – point to a dramatic growth in suspected mortgage fraud.

Back in 2001, banks reported roughly 4,200 instances in mortgage-related fraud may have occurred. In the last year, that number hit 21,994.

The Dallas-area FBI office received 297 suspicious-activity reports from local banks last year, a 60 percent increase over the previous year, Agent Bailey said.

And that number doesn't include reports from banks not federally insured or reports from other federal agencies such as the U.S. Department of Housing and Urban Development.

The article contains this excellent sidebar on how the FBI believes that consumers can spot the warning signs of fraud:

Get referrals for real estate and mortgage professionals. Check their licenses.

Check the property's title history to see if it has been sold repeatedly within a short time; that could signal that the property has been "flipped" and the value falsely inflated.

Look at written information to include recent comparable sales in the area.

If it sounds too good to be true, it probably is. Promises of extraordinary profits in a short time should be a warning sign.

Never sign loan documents that contain blanks. That would leave you vulnerable to fraud.

If you don't understand documents you are about to sign, reread them or get help from a lawyer.

Make sure the name on your mortgage application matches the name on your identification.

Know and understand the terms of your mortgage. Check your information against the information in the loan documents to make sure they are accurate and complete.

Oops, I Did It Again

The news about data security breaches just keeps getting better and better, doesn’t it? Today, La Salle Bank announced that last month, somewhere between its data center in Chicago and an Experian credit bureau office in Allen, Texas, a backup tape that contained the apparently unencrypted personal information and other data concerning 2 million loan customers of La Salle’s ABN AMRO Mortgage Croup, Inc. subsidiary was lost, perhaps by carrier DHL.

“We have begun notifying our customers and are dedicating resources to assist them and to answer any questions they may have,” said Thomas Goldstein, chairman and CEO of ABN AMRO Mortgage Group, in a prepared statement.

On the other hand, a spokesman for DHL stated that “[a]lthough we have not yet closed our investigation, at this time we have uncovered no error in protocol, indications that this package was stolen, or evidence that the contents of the shipment have been disclosed or used for any improper purpose.”

There’s a curious bit of “disinformation” contained in the linked article.

The rash of announcements doesn’t reflect a new cyber-crime wave, says Michael Lamprecht, managing director with A.J. Gallagher & Sons. Rather, a new privacy law in Illinois now requires companies to share news of breaches with customers.

“They’re being more forthcoming on the disclosing because they have to be,” says Mr. Lamprecht, who specializes in technology and security issues.

I don’t claim to be an expert on Illinois law. Nevertheless, I believe that the “new privacy law” to which Mr. Lamprecht refers is HB 1633, which has an effective date of January 1, 2006. If Illinois banks and businesses have been more forthcoming about data security breaches, it’s not likely due to a law that is not yet effective. Financial institutions, of course, are already subject to the federal banking agencies’ guidelines concerning data security breaches that were issued this past March. Those guidelines require notification of customers only when the institution determines that the misuse of the data has occurred or is reasonably likely to occur. Illinois law does not contain such a “triggering threshold.”

Perhaps La Salle decided to be cautious, or perhaps it made a determination that misuse is “reasonably likely." If it made the latter determination, it certainly has made no public indication of it, and it certainly didn’t communicate that judgment to DHL.

If I had to bet, I’d bet on “caution.”