Banks that let customers update their mailing addresses online or by phone should keep tabs on such changes, which may signal identity theft, security experts say.
Address changes "need looking at very closely," said Richard A. Parry, the senior vice president for consumer risk management at JPMorgan Chase & Co. An address change can be a significant component of fraud, he said.
He spoke last week during a panel discussion at the Finance Forum conference in New York, hosted by Forrester Research Inc. of Cambridge, Mass.
Amir Orad, the executive vice president of marketing for Cyota Inc., a New York security service provider, was also on the panel. An address change should raise a red flag if accompanied by certain other activities, especially a request for a new checkbook or to add a payee for online bill payment, he said in an interview afterward.
But spotting a bogus change of address is a "needle-in-a-haystack problem," Mr. Orad said. "The majority of changes are legit."
Identity thieves commonly change the addresses of accounts they hijack. Because many customers discover thefts when reviewing their statements, having them mailed elsewhere can delay the discovery of fraud.
Mr. Orad said some banks lack a consistent policy for notifying customers of address changes. Only if a change were blatantly suspicious - for example, if the new address were an abandoned warehouse or far from the account holder's longtime home - would the bank "actually try to reach you again to confirm it's really you."
Criminals know this, so many now have victims' statements sent to addresses that are close to the real ones. "The fraudsters are not stupid or anything like it," Mr. Orad said. "They know what they're doing."
Avivah Litan, a vice president and research director at the Stamford, Conn., market research company Gartner Inc., said address changes are "one of the top three tricks that fraudsters use."
Con artists who change an address "can do whatever they want with the card or the account," he said. "The statements are going somewhere else, so it doesn't get caught."
Online banking customers typically check their accounts frequently and are likely to spot unauthorized transactions, she said, but few bother to check their addresses online.
And even if customers notice that their mailing addresses have been changed, Ms. Litan said, they have no way of knowing if thieves have used fake addresses to set up additional accounts under their names. Criminals "definitely can use the change of address to go to the next loan provider and the next financial services provider and say, 'See, this is proof of my address.' "
James Van Dyke, the principal and founder of Javelin Strategy and Research of Pleasanton, Calif., said that 8% of successful identity fraud begins with mail theft or the redirection of mail through a change of address.
A new address can help in tracking down the perpetrator, who may have access to it, he said. Banks, reluctant to reveal how they spot fraud, may therefore hesitate to query an account holder about a change of address, Mr. Van Dyke said.
That is a mistake, he said; banks should automatically notify customers when their account addresses are changed. Over half have systems that do so, he said, but more should.
Mr. Orad agreed that such systems are needed. "If one's address is changed, the banks should send a letter by mail to that individual at that previous address," he said.
Jonathan Penn, a principal analyst with Forrester who moderated the panel discussion, said later that address-change confirmation - by mail or other channels - is "widely underutilized" as a tool to detect fraud.
Mr. Penn acknowledged that many customers are wary of e-mail from banks, especially messages about updates to their personal information. However, he said, banks can send e-mail notifications that do not include links or phone numbers.
For example, an e-mail can instruct customers to call the number on the back of their automated teller machine cards for more information.
Every bank should notify customers about address changes, Mr. Penn said. Those that lack systems to do so are "just kind of laggards."
