The weaknesses in Norwich Union Life's systems and controls allowed fraudsters to use publicly available information including names and dates of birth to impersonate customers and obtain sensitive customer details from its call centres. They were also, in some cases able to ask for confidential customer records such as addresses and bank account details to be altered. The fraudsters then used the information to request the surrender of 74 customers' policies totalling £3.3 million in 2006.
During its investigation, the FSA found that Norwich Union Life had failed to properly assess the risks posed to its business by financial crime, including fraudsters seeking to obtain customers' confidential information. As a result, its customers were more likely to fall victim to financial crimes such as identity theft.
Margaret Cole, director of enforcement, said:
"Norwich Union Life let down its customers by not taking reasonable steps to keep their personal and financial information safe and secure.
"It is vital that firms have robust systems and controls in place to make sure that customers' details do not fall into the wrong hands. Firms must also frequently review their controls to tackle the growing threat of identity theft.
"This fine is a clear message that the FSA takes information security seriously and requires that firms do so too."
Norwich Union Life also failed to address the issues, highlighted by the frauds, in an appropriate and timely manner even after they were identified by its own compliance department. The failings happened at a time of increasing awareness across the UK about the importance of information security.
Norwich Union Life co-operated fully with the FSA in the course of the investigation. It has taken a number of remedial actions including co-operating with the police to identify and arrest the fraudsters and carrying out a review of its information security processes. Norwich Union has reinstated all fraudulently surrendered policies in full.
Norwich Union Life agreed to settle at the early stage of the FSA's investigation and qualified for a 30% discount under the FSA's executive settlement procedure - without the discount, the fine would have been £1.8 million.
Notes for editors
- Norwich Union Life is one of the UK's largest life insurance businesses with 6.8 million customers in the UK.
- The full text of the Final Notice[1] issued by the FSA, includes the background to the case, the relevant statutory provisions, regulatory requirements contravened, and the factors taken into account when setting the level of the fine.
- In the last two years, the FSA has fined BNPP Private Bank £350,000, Nationwide £980,000 and Capita Financial Administrators £300,000 for failings relating to information security lapses and fraud.
- FSA Principle 3 states that a firm must take reasonable care to organise and control its affairs responsibly and effectively, with adequate risk management systems.
- In November 2004 the FSA published a report entitled 'Countering Financial Crime Risks in Information Security[2]'. Since then the FSA has issued a number of speeches and publications to raise awareness within the financial services sector of the need for firms to take action to combat the risks of financial crime. In addition, the FSA is currently carrying out a major project examining the systems and controls used by a range of financial services firms to protect their customers' data; the findings from this work will be published in 2008.
- The FSA regulates the financial services industry and has four objectives under the Financial Services and Markets Act 2000: maintaining market confidence; promoting public understanding of the financial system; securing the appropriate degree of protection for consumers; and fighting financial crime.
- The FSA aims to promote efficient, orderly and fair markets, help retail consumers achieve a fair deal and improve its business capability and effectiveness.