It's a local bank you trust with your money and your personal information. But the M&T branch in Rodgers Forge didn't shelter all of some peoples' secrets. As ABC2 News Investigator Joce Sterman discovered, some of the documents that contain them didn't get shredded, they got dumped.
It's the little machine experts say you've got to have to keep your personal information safe. Banks are supposed to use the same technology to protect you. But we found one Baltimore County bank didn't send your stuff through the shredder, they simply tossed it.
Sandi and Ray Watts are angry. We got our hands on their social security numbers, their bank account info and we even know their mother's maiden names. And we got it from their bank. The couple says they’re outraged with Ray telling us, "You get letters from them that they're protecting your identity and then they do this."
What the bank did was dump the Watts’ documents and dozens of others without shredding them. We found them in a bright red dumpster in Rodgers Forge, outside the M&T that recently took over Bradford Bank. We sifted through the trash to find stacks of cancelled checks written just days ago. We also found page after page of papers that list not only who banks here but their account numbers and how much dough they have.
Jana Lovell’s information was among the pile. We found a letter she wrote describing how someone had used her ATM card to steal hundreds of dollars over the summer. The bank threw it in the trash along with her account number, her statements and even a copy of her driver’s license. Lovell’s mother, Yvonne, was surprised. She says, “I don't understand. They have shredders. I just don't know what to say."
And you're supposed to use those shredders or other tools to destroy any sensitive information. It's a federal guideline this bank didn't follow in this case, potentially leaving customers in danger. Chris Zoladz is the former President of the International Association of Privacy Professionals. He tells ABC2, "You don't know who else may have seen this information as well. You clearly have seen it. There may be other parties who have seen it as well and duplicated it or recorded the information off those documents separately."
That's why privacy experts say all this sensitive information is supposed to be protected and kept out of the hands of anyone who doesn't need to see it. Zoladz says it’s standard policy among financial institutions. But even that policy got trashed in this bank's transition – we found copies of their privacy policy tossed in among the trash.
And it’s consumer privacy for some that was not protected when M&T took over. The bank’s Vice President of Corporate Communications, Philip Hosmer, says, “When Bradford became a part of M&T, their customer information became M&T’s. We had strict controls in place to regulate the way that we inventory, archive and protect that information, but it’s clear that some material was mishandled.”
The company called our findings a “clear violation of our policies”. Hosmer also says, “We’ve reviewed the materials, and the vast majority of it is old and invalid. There’s no risk whatsoever for most of this information.” M&T says it has contacted federal and state regulators about what we found in the dumpster and also issued new account numbers and free credit monitoring to customers involved in 52 items that caused them concern.
As for those customers, Lovell says, "We're just lucky you found them (the documents) and not other people." People who know that when a bank dumps its trash, your trust could go with it. But Hosmer says, “We are conducting an extensive internal investigation, and at this point, it appears to be an isolated circumstance involving a single human error.”
Statement from M&T Bank
"When Bradford became a part of M&T, their customer information became M&T's. We had strict controls in place to regulate the way that we inventory, archive and protect that information, but it's clear that some material was mishandled.
This is a clear violation of our policies. We are conducting an extensive internal investigation, and at this point, it appears to be an isolated circumstance involving a single human error.
Most importantly, we're working to make sure that our customers are protected. We've reviewed the materials, and the vast majority of it is old and invalid. There's no risk whatsoever for most of this information.
But there were 52 items that we're concerned about, and we're contacting every one of those customers directly to provide them with new account numbers, free credit monitoring protection and other safeguards. We have also notified our state and federal regulators of this matter."
Philip Hosmer
Vice President, Corporate Communications
M&T Bank
