UK financial data breach: Outsourcing to India may come under scrutiny

The case for outsourcing work to India both in Britain's private and public sectors has come under scrutiny amid reports that the bank details of thousands of British credit and debit card holders held in Indian call centres are being sold on to fraudsters for minimal amounts of money.

In an undercover investigation, The Sun , a tabloid, spoke to one India-based seller, who claimed to sell details of 80,000 customers every week to four clients. The man said he received the data from 25 workers at nine companies, providing his clients with credit card details, including the security number on the back of the card, account and sort code numbers, and personal details such as whether a person had taken out a personal loan. Credit card details cost 50 pence each, while bank account and sort codes cost 25 pence, and profile data 50 pence a person.

The revelations add to the pressure on the outsourcing industry, already facing concerns about privacy as well as rising costs. Earlier this month, New Call Telecom said it was moving its Mumbai call centre back to the UK to the northern city of Burnley, as a result of rising salaries, and real estate in India. Then Spanish bank Santander said it was replacing its Bangalore and Pune call centres with three in the British cities of Glasgow, Liverpool and Leicester in response to customer demands.

In a report on Government ICT Offshoring, published earlier this month, Britain's Cabinet Office warned of the risk of potential data breaches and outlined ways to minimise this risk. At the start of August, IT workers at the Department of World and Pension (DWP) voted for industrial action to oppose the shift of some 200 jobs from three British cities to Bangalore. The union's general secretary warned of the potential risks of outsourcing, a message reiterated by the union's commercial sector president, Mr Ian Fitzpatrick. “We don't want to pit one set of workers against the other but when you pay poverty wages and there is a race to the bottom you leave yourself exposed to greater risks,” he told Business Line .

The DWP has the bank account details of 26 million people and if you already have loyal staff with the necessary experience and knowledge then to put that at risk for some short term gains is simply ludicrous, he said.

The Sun newspaper's contact offered the journalist, as a sample, the details of 21 clients of British banks Barclays and Lloyds TSB which had been gathered from their broadband accounts when they set up their direct debit payments. Another person interviewed over the phone boasted of a boom in credit card numbers, and that his clients, the buyers of the information, were no longer content with merely credit and debit card details.

“There is ¦a rife black market out there for credit card details. If you are underpaid, have unlimited access to active credit cards details, it won't take you long to find a buyer,” said Ms Carole Theriault, senior security consultant at Sophos in London. Banks and Internet providers were quick to assure that they had taken the necessary steps to safeguard the data of their clients.

“We have undertaken internal investigations to ensure the data was not obtained from Barclays,” said a spokesperson for Barclays. Barclays is supporting the Serious and Organised Crime Agency in its investigation.

Britain's Serious Organised Crime Agency has refused to confirm or deny that an investigation has been launched following the Sun article. However, a spokesman for the organisation said they had ‘good relations' with Indian authorities.

COMMENT NOW