BPO Fraud - Future of security in financial institutions

It was the morning of 27th June,2006. I was poring over the morning newspapers. All newspapers carried the same headlines that spoke of the HSBC fraud involving a BPO employee who reportedly had leaked out customer bank account details to third party. Not to mention the siphoning of money from HSBC customer accounts that eventually had to happen when the anti-social elements got their hands on privy information. As I was picking up the bits and pieces of story several points registered in my brain

This was the second security related fraud that saw the light of the day in the BPO industry in India. The first had been the MPhasis related scam that had struck the then fledgling BPO industry in the early years of the new millennium. Though doubts had arisen about the continued viability of the BPO industry in India then, other factors that had initially driven outsourcing to India were all too compelling for companies to even think of searching for immediate alternatives in terms of new centers, lower costs, higher security, English speaking resources, etc. However, this time around the fallout of incidents like these could turn out more disastrous for 2 reasons.

• One, companies are already on the lookout for new BPO incubation centers to fend off rising employees costs in India, which is past incubation stage and has become a voracious resource consumer too. They are readily discovering such centers in Latin America, South East Asia, South Africa, etc.

• Two, the very concept of maintaining data privy to the customer at offshore locations has been dealt a death blow. As highlighted in both cases, BPO employees who had access to such data at offshore centers were the ones who played the devil. Housing of data in the customer's home country would mean that BPO operations would shrivel up in terms of the host of services that they are currently in a position to offer the customer. The end result would be that of the customer being tossed back and forth between call centers in his country and offshore centers located elsewhere depending on his service requirements.

It really is a non-enviable position that the BPO centers are in currently. They are really caught between the devil and the deep sea. At one end you have the customers who have got used to low service charges and high quality services. Shifting back offshore operations would mean incurring all the high costs back at home that the financial institutions can ill-afford. Not doing so would raise the big question mark in the customer's mind about security concerns of his/her data. Treading the middle path would be walking the razor edge.

Two days later, when my mind was still receptive to any new developments in relation to the BPO fraud that had been unearthed, I received a thick packet via courier from HSBC. The packet contained a small plastic tab with a LCD screen and a single button. The accompanying letter said that HSBC was issuing this device as an additional security fence to be crossed while accessing our HSBC accounts online. The device at random generated a 6 digit code based on a internal algorithm every time I press the button. This code was to be submitted along with my account details and password every time I access my online HSBC account. I was perplexed as to how the six digit code could be authenticated when the plastic device in my hand never communicated with the HSBC systems. My only close guess was that the six digit code was being generated with a strong tie-up to the current date and time and the HSBC systems used the same algorithm to validate the code so generated. Quite ingenuous, I would say, because what HSBC has done is remove part of the customer account access details completely from their system and place it in the next safest place : the customer himself. This would render any of the information passed on to outsiders by dishonest BPO employees almost useless unless they also have my code generating device with them. A perfect example of how technology can be harass you or be harnessed to work for you. A perfect example of also how each scandal drives the paranoid being within us to erect one more security barrier around our data. Either way you take it, there is no denying that the technology vortex is dragging use deeper and deeper with every passing day.

Latest Indian IT News - Click for details

Technorati Tags: HSBC, fraud, BPO, security, India, Bangalore, bank, call center