The UK regulator has fined Merchant Securities Group £77,000 ($150,000) for not adequately protecting its customers from the risk of identity fraud.  This is the first time the Financial Services Authority, the UK's financial regulator, has fined a stockbroking firm for weak data security controls.

Merchant Securities had inadequate procedures for verifying the identities of customers that contacted the firm by telephone.  Instead, the firm relied on being able to recognise customers’ voices and talking with them informally about personal matters such as holidays or hobbies.  Personal account numbers which could be used with a customer’s name to access account information were included in routine letters.

Furthermore, back-up tapes containing unencrypted customer information were stored overnight in a bag at the home of a member of staff. Merchant Securities did not address the risk involved in its staff being able to use instant messaging and web based e-mail. 

Although there was no evidence that customer details had been lost or stolen, Margaret Cole, director of enforcement, said: “We will not wait until information has been lost or stolen before taking action against a firm.  The level of the fine for a firm of this size should serve as a warning to others to take data security seriously.”

In the last three years, the FSA has fined Norwich Union £1.26 million; BNP Paribas Private Bank £350,000 and Nationwide £980,000 for failings relating to information security lapses and fraud.

Merchant Securities’ failings came to light in September 2007, during a visit by the FSA, rather than through their own systems and controls. The firm co-operated fully with the FSA and agreed to settle at an early stage of the FSA's investigation. 

In April 2008, the FSA published the findings of a major project reviewing how well financial services firms protect their customers' data.