The US Office of the Comptroller of the Currency (OCC) has updated risk management guidance for banks dealing with third party payments processors working for merchant clients following its probe into a scam at Wachovia which found that a lack of oversight and control allowed telemarketers to swindle thousands of elderly customers.
Wachovia Bank agreed to pay up to $144 million to settle claims that it engaged in "unsafe or unsound practices" with several telemarketers and third party payment processors that harmed consumers.
Reporting on its 18 month probe into the scam, the OCC says telemarketers obtained bank account information for thousands of customers - many of whom were elderly - over the phone by offering "questionable products and services".
The scheme involved the use of remotely created cheques (RCCs) by telemarketers and payment processors that maintained account relationships with the bank. Using the account data obtained during the call, the telemarketer or payment processor would create an RCC and deposit payment into an account at Wachovia, causing funds to be withdrawn from accounts.
The payment processors and telemarketers involved were Payment Processing Center, FTN Promotions, dba Suntasia, Netchex and Your Money Access.
A large percentage of the RCCs were returned to Wachovia by individuals, or their banks, who said the cheques were never authorised or that they had not received the products or services offered by the telemarketers. The OCC says in some cases, RCCs returned to the bank exceeded 50% of the total deposited.
Although bank staff noticed the high return rates, Wachovia "failed to take quick action to terminate these account relationships or otherwise correct the problem", says the OCC.
Under the settlement agreement Wachovia has agreed to pay customers up to $125 million in restitution. The bank is also required to contribute $8.9 million to consumer education programs directed at the elderly and to pay a $10 million civil money penalty to the US Treasury.
In its risk management bulletin - which was released ahead of the Wachovia settlement - the OCC warns that certain merchants, such as telemarketers, pose a higher risk to banks and require additional due diligence, underwriting, and monitoring. The risk is heightened if third party processors are involved because the banks often have no direct customer relationship with the merchant.
The banks need to implement controls to reduce the chances of "establishing or maintaining an inappropriate relationship with a processor through which unscrupulous merchants can gain access to consumers' bank accounts", says the regulator.
The OCC warns banks "may be viewed as facilitating a processor's or its merchant client's fraud or other unlawful activity" if they don't have adequate controls in place.