Large-Scale Security Breach At Banks In USVI and BVI

FirstBank VI is in the middle of a massive security breach crisis, with many of its Visa Debit card customers blocked from using their cards and some customers claiming to have had “thousands of dollars” stolen from their personal accounts. Banco Popular and Scotia Bank on St. Croix are also reporting security breaches at their institutions.

VI Consortium was made aware of the matter earlier this week, and FirstBank today confirmed that the problem, which occurred through a security breach deriving from outside merchants, happened on Wednesday, Nov. 12.

Alana Alexander, marketing communications manager for FirstBank VI, based in Charlotte Amalie, told VI Consortium in a telephone interview Thursday that the breach affects FirstBank locations in the USVI and BVI. Alexander issued a press release to media outlets stating that, “as a result of recent security incidents in retail locations, FirstBank’s internal security processes detected an external security breach regarding some Visa Debit card numbers.”

When asked how many debit card customers were affected, Alexander said, “The total number of impacted cards has been identified by the business unit and we are ensuring our clients’ needs are being attended to. However, this is confidential information and we are not at liberty to disclose this information.”

Alexander pointed out that when the bank became aware of the problem last Wednesday, bank representatives began calling “clients on a one-on-one basis” to alert them of the security breach. But, when that method proved ineffective due to outdated telephone numbers on file, Alexander said letters were mailed to customers on Monday informing them of the problem and the measures FirstBank had taken to protect their accounts.

The measures, the bank said, included restricting the use of affected customers’ Visa Debit cards to only ATM transactions (through the ATH network) using the client’s personal identification number (PIN) and at retail locations where PIN-based sales are accepted.

“This action was taken to ensure that the clients’ accounts were not compromised further,” Alexander explained.

One FirstBank customer at the Sunny Isle branch in St. Croix Thursday told the VI Consortium that “hackers” had stolen “thousands of dollars” from his personal account, and that he was at the bank to alert management. The man said an employee had reviewed his account and managed to stop the theft from continuing.

When the VI Consortium informed Alexander of the customer’s plight, she said, “A personal account cannot be hacked,” adding, “the email of this individual may have been compromised and the fraudster now has access to their information or the fraudster is originating ACH transactions via another access point.”

For this reason, Alexander continued, FirstBank advises its customers to “ensure they have strong passwords on their email account.”

At the same bank, another customer said he witnessed people shopping in local grocery stores whose cards had declined. One FirstBank customer also contacted VI Consortium and said his card had declined while purchasing lunch at a local restaurant earlier in the week.

When asked if local police were alerted to the matter, Alexander said the FirstBank security breach is not one of local police jurisdiction.

“I can disclose that the breach occurred in two U.S. retailers, therefore FirstBank does not need to involve local police authorities,” she said.

VI Consortium also spoke with an employee at Banco Popular in Sunny Isle, who confirmed that the bank’s security had also been compromised. She said those who were affected should have received a letter in the mail explaining the problem and detailing procedures they should take. If customers did not receive a letter, the employee said, they were most likely not affected. Still, the employee said customers who believe they have been affected and did not receive a letter should visit the local branch and speak with someone there.

St. Croix’s Scotia Bank was also affected. Upon visiting the bank’s Sunny Isle branch, VI Consortium witnessed a large crowd trying to attain information from bank representatives. The VI Consortium was unable to speak with a Scotia Bank representative in person because of the influx of customers seeking information. However, after leaving a voice message for a bank representative, the VI Consortium received a return call from Christine Lee, Scotia Bank marketing director.

Lee said the bank is aware that certain of its customers’ Visa Debit card accounts had been compromised and its fraud-detection system immediately moved to temporarily lock those accounts. She said affected customers were contacted right away, adding that customer security is the bank’s top priority. Lee also said she is not aware of any personal accounts being compromised and that only certain Visa Debit card customers were affected. She also confirmed that the security breach happened as the result of outside retailers, and hand nothing to do with an internal banking breach.

Lee encourages affected customers to visit the local Scotia Bank branch for further information.

The Bank of St. Croix was not affected.

FirstBank advises its customers to visit any of its branch locations to obtain a temporary replacement card. Customers may also contact the FirstLine Solutions Center toll free at 1.866.695.2511 (USVI) and 1.284.495.8899 (BVI). In addition, the bank said it will continue to monitor all account transactions and encourages its customers to do the same through Online Banking and notify the bank immediately if any fraudulent activity is detected.

The VI Consortium reached out to the Virgin Islands Police Department for comment on the large-scale security breach at the three banks, but had not received a response at press time.

Local banking customers who wish to obtain a free credit report to monitor activity, may contact any of the three credit reporting agencies below:

Equifax                                                

1.800.525.6285

P.O. Box 740241

Atlanta, GA  30374-0241

www.equifax.com

Experian

1.888.397.3742

P.O. Box 9532

Allen, TX 75013

www.experian.com

TransUnion

1.800.680.7289

P.O. Box 6790

Fullerton, CA  92834-6790

www.transunion.com