IE 11 is not supported. For an optimal experience visit our site on another browser.

Bankrupt lenders throwing away your privacy

As recently as August, First Magnus Financial Corp. was the subject of a magazine feature hailing it as a “technological powerhouse” ready for the future thanks to its “tech-savvy management team.”

Just two weeks later, First Magnus, one of the nation’s largest mortgage lenders, whose headquarters was one of the biggest employers in Tucson, Ariz., was out of business, another victim of the disintegration of the U.S. mortgage industry.

Among the revelations about Magnus was that it wasn’t quite as technologically advanced as had been billed. Most of its borrowers’ records were still on paper, as Floridians learned when thousands of loan documents were discovered in boxes in an unlocked trash Dumpster in Fort Lauderdale.

The documents included borrowers’ Social Security and credit card numbers and all the rest of the sensitive personal and financial information that Americans turn over when they seek a home loan.

‘Private information in a Dumpster’
The First Magnus data dump was not an isolated incident. Across the country, the mortgage crisis is causing a double hardship for borrowers who are exposed to identity theft as companies toss out sensitive financial records when they go belly up.

A Dumpster, after all, isn’t just a garbage can — it’s a potential treasure trove of information.

That’s what Faye Wenzlick, who directs senior programs for the Better Business Bureau in northwestern Ohio, learned when the records of hundreds of former customers of the defunct Alpha Mortgage Services — including Social Security numbers, wage statements and checking account numbers dating back to 2000 — were left in a recycling bin behind a grocery store in Toledo.

Wenzlick reported the improper disposal after an older man called her over to the bin. “He said two cars ... were filled up with this stuff and dumped everything and left,” she said.

After Union Mortgage Services of Ohio shut down last month, confidential files on hundreds of people were thrown out in a Dumpster behind a pizza shop in Cleveland.

“That’s appalling,” said Ken Knabe, a lawyer in the Cleveland suburb of Lakewood whose bank accounts, credit reports, tax returns and other personal information — including his Social Security number — were recovered by NBC affiliate WKYC-TV. “This is private information in a Dumpster.”

Hazy law leaves abundant leeway
Such breaches would seem to be a violation of the 2003 Fair and Accurate Credit Transactions Act, or FACTA, which requires businesses to dispose of sensitive financial documents in a way that protects against “unauthorized access to or use of the information.”

The FTC advises businesses to burn, pulverize or shred paper documents so they can’t be reconstructed. But one of the weaknesses of FACTA is that it doesn’t actually require physical destruction of data; instead, the regulations, known collectively as the Disposal Rule, offer only what the agency calls a “flexible ‘reasonable measures’ standard.”

“The FTC realizes that there are few foolproof methods of records destruction and that entities covered by the Rule must consider their own unique circumstances when determining how to best comply with the Rule,” the agency said when it published the new standard.

FTC pursues only one case so far
Another apparent weakness has been enforcement. More than 2½ years after the Disposal Rule went into effect in June 2005, the FTC has brought only one case.

The FTC announced in December that it had reached a settlement with American United Mortgage Co. of Northbrook, Ill., which left hundreds of borrowers’ financial documents, some of them including Social Security numbers, in an unlocked Dumpster, many of them in open trash bags.

Although the FTC said the company was found to have repeated the practice at least twice after it issued a warning in March 2006, the agency agreed to settle the case for only a $50,000 fine and American United’s promise not to do it again.

“Every business, whether large or small, must take reasonable and appropriate measures to protect sensitive consumer information, from acquisition to disposal,” FTC Chairwoman Deborah Platt Majoras said in announcing the settlement. She promised that the FTC would “continue to prosecute companies that fail to fulfill their legal responsibility to protect consumers’ personal information.”

How do you prosecute a dead company?
The FTC was able to impose some penalty on American United because it’s still in business. But when a company no longer exists, how do you protect its customers?

That’s the conundrum facing regulators and consumer activists in several states where recently defunct mortgage companies tossed sensitive papers in the trash as they turned out the lights:

  • Sheriff’s deputies in DeKalb County, Ga., outside Atlanta, found the mortgage records of at least 1,200 former customers of Ameriquest Mortgage Co. in a Dumpster behind an apartment complex in October, two years after the company, once one of the nation’s biggest subprime lenders, went out of business.
  • In December, the state of Ohio filed suit against the former president of Randall Mortgage Services Inc. four months after it closed up shop, leaving behind the unsecured records of its customers, including Social Security numbers, credit reports, wage statements and bank account numbers. The best the state can hope for is a $25,000 fine and a promise not to do it again.
  • In Honolulu last year, a handyman hired by the former president of the defunct Fidelity Escrow Services dumped 39 boxes of financial records in a recycling bin. “Social Security numbers, bank account numbers, credit reports, credit card statements — you name it, everything was in there,” said Jim Kelly, a business journalist who stumbled on the boxes when he took out his own recycling.

“It’s kind of amazing — in this day and age, given how sensitive people are about asking for your Social Security number, about putting it on paper — that this sort of stuff would end up getting tossed away so carelessly,” Kelly said.

For the former customers, there is little recourse, since there is no company left to pursue.

“I’m furious, I’m angry, I’m hurt,” said Tonya Brown, a former Ameriquest customer in Atlanta. “Who could be that irresponsible?”

Kim and Edwin Soeder, of Mentor, Ohio, are worried about their retirement plans after their accounts were found among the Union Mortgage records in Cleveland.

“It makes you wonder how bad your credit rating becomes if people get this in their hands,” Kim Soeder said.