Skip navigation

Bankrupt lenders throwing away your privacy

Some mortgage companies tossing customers’ personal data in the trash

Video
  Data in the Dumpster
In Cleveland, a defunct mortgage lender tossed personal data on hundreds of people in the trash. Tom Meyer of NBC affiliate WKYC tracked some of them down.

NBC News Channel

By Alex Johnson
Reporter
MSNBC
updated 5:32 p.m. ET March 7, 2008

As recently as August, First Magnus Financial Corp. was the subject of a magazine feature hailing it as a “technological powerhouse” ready for the future thanks to its “tech-savvy management team.”

Just two weeks later, First Magnus, one of the nation’s largest mortgage lenders, whose headquarters was one of the biggest employers in Tucson, Ariz., was out of business, another victim of the disintegration of the U.S. mortgage industry.

Among the revelations about Magnus was that it wasn’t quite as technologically advanced as had been billed. Most of its borrowers’ records were still on paper, as Floridians learned when thousands of loan documents were discovered in boxes in an unlocked trash Dumpster in Fort Lauderdale.

Story continues below ↓
advertisement

The documents included borrowers’ Social Security and credit card numbers and all the rest of the sensitive personal and financial information that Americans turn over when they seek a home loan.

‘Private information in a Dumpster’
The First Magnus data dump was not an isolated incident. Across the country, the mortgage crisis is causing a double hardship for borrowers who are exposed to identity theft as companies toss out sensitive financial records when they go belly up.

A Dumpster, after all, isn’t just a garbage can — it’s a potential treasure trove of information.

  Avoid Dumpster divers

The Federal Trade Commission offers these suggestions for consumers hoping to protect themselves from improper record disposal:

Ask about information security procedures in your workplace or at businesses, doctor’s offices or other institutions that collect personally identifying information from you. Find out who has access to your personal information and verify that it is handled securely. Ask about the disposal procedures for those records, as well. Find out if your information will be shared with anyone else. If so, ask if you can keep your information confidential.

Give your SSN only when absolutely necessary. Ask to use other types of identifiers when possible. If your state uses your SSN as your driver’s license number, ask to substitute another number. Do the same if your health insurance company uses your SSN as your account number.

That’s what Faye Wenzlick, who directs senior programs for the Better Business Bureau in northwestern Ohio, learned when the records of hundreds of former customers of the defunct Alpha Mortgage Services — including Social Security numbers, wage statements and checking account numbers dating back to 2000 — were left in a recycling bin behind a grocery store in Toledo.

Wenzlick reported the improper disposal after an older man called her over to the bin. “He said two cars ... were filled up with this stuff and dumped everything and left,” she said.

After Union Mortgage Services of Ohio shut down last month, confidential files on hundreds of people were thrown out in a Dumpster behind a pizza shop in Cleveland.

“That’s appalling,” said Ken Knabe, a lawyer in the Cleveland suburb of Lakewood whose bank accounts, credit reports, tax returns and other personal information — including his Social Security number — were recovered by NBC affiliate WKYC-TV. “This is private information in a Dumpster.”

Hazy law leaves abundant leeway
Such breaches would seem to be a violation of the 2003 Fair and Accurate Credit Transactions Act, or FACTA, which requires businesses to dispose of sensitive financial documents in a way that protects against “unauthorized access to or use of the information.”

The FTC advises businesses to burn, pulverize or shred paper documents so they can’t be reconstructed. But one of the weaknesses of FACTA is that it doesn’t actually require physical destruction of data; instead, the regulations, known collectively as the Disposal Rule, offer only what the agency calls a “flexible ‘reasonable measures’ standard.”

“The FTC realizes that there are few foolproof methods of records destruction and that entities covered by the Rule must consider their own unique circumstances when determining how to best comply with the Rule,” the agency said when it published the new standard.