On November 10, 2010, American Banker published an article describing major mortgage lenders’ and servicers’ questionable and often illegal practices related to force-placed
insurance. The article revealed for the first time the exceptionally profitable exclusive relationships, collusive activities, and circular arrangements among the mortgage lenders and
servicers, their affiliates, and their cooperating insurers, most of which are Defendants here.
Lenders and servicers force place insurance when a borrower fails to obtain or maintain proper hazard or flood insurance coverage on property that secures a loan. Under the
typical mortgage agreement, if the insurance policy lapses or provides insufficient coverage, the lender has the right to “force place” a new policy on the property and then charge the premiums
to the borrower.
The arrangements revealed by American Banker comprise an extremely lucrative profit-making scheme in the hundreds of millions of dollars. There are just two insurance companies that control the entire market for forced-placed policies in the country — Assurant and QBE.
Assurant works through its subsidiaries Voyager Indemnity Insurance Company and American Security Insurance Company. These companies and their affiliates enter into exclusive relationships with the major mortgage lenders and servicers to provide the policies. The top four servicers that work with Assurant are Wells Fargo Bank, Citi, HSBC, and Chase. The top servicer that works with QBE/Balboa is Bank of America.
To maintain their exclusive relationships with these lenders, the insurers pay unearned “kickbacks” of a percentage of the force-placed premiums ultimately charged to the borrower, offer them subsidized administrative services, and/or enter into lucrative captive reinsurance deals with them.

Although force-placed insurance is designed to protect the lender’s interest in the property that secures the loan and thus should not exceed that interest, lenders often purchase
coverage from their exclusive insurers in excess of that required to cover their own risk. And, as a matter of practice, the major lenders and servicers collude with the two major force-placed
insurers to manipulate the force-placed insurance market and artificially inflate the premiums charged consumers, resulting in premiums up to ten times greater than those available to the
consumer in the open market. American Banker reported that “Though part of the extra expense can be explained by the higher risks associated with insuring the homes of delinquent borrowers,
force-placed policies generate profit margins unheard of elsewhere in the insurance industry even after accounting for the generous commissions and other payments that servicers demand.”

But finally Bank of America Corp. agreed to pay $228 million to settle claims the bank overcharged for insurance homeowners were forced to accept when their regular policies lapsed. The amount was disclosed in a document requesting approval for the accord filed yesterday in Miami federal court. Lawyers for homeowners told a federal judge in February that the Charlotte, North Carolina-based bank had agreed to a deal without providing further information.

The deal is an “extraordinary settlement” that provides “prospective relief that would effectively end the lender- placed insurance practices at issue in this case,” lawyers for plaintiffs said in the Bank of America case.

Wells Fargo & Co., HSBC Holdings Plc, JPMorgan Chase & Co. and Citigroup Inc. have also agreed to similar accords in cases alleging that banks got a financial windfall by cutting deals with insurance companies and over-charging borrowers for property coverage.

Attorneys will seek as much as $16 million in fees, according to the filing.

As part of their settlements, JPMorgan will pay $300 million and Citigroup will pay $110 million. HSBC agreed to pay $32 million, according to a separate proposed settlement. The amount of Wells Fargo’s settlement hasn’t yet been specified.

The case is Hall v. Bank of America N.A., 1:12-cv-22700, U.S. District Court, Southern District of Florida (Miami).

Questionable claims (hereby referred as QC) are those claims that NICB member insurance companies refer to NICB for closer review and investigation based on one or more indicators of possible fraud. A single claim may contain up to seven referral reasons.

This report analyzes QCs by loss city, core-based statistical area (CBSA), policy type, loss type, policy and loss type combined and referral reasons.

In 2010, there were 7,520 Texas QCs referred to NICB from its member insurance companies. In 2011, the number increased to 8,016 and rose again in 2012 to 10,368 — a 38 percent increase over 2010′s figure.

The top 5 loss types were:

• bodily injury
• theft
• collision
• burglary
• property damage.

The top five cities in Texas generating the most QCs last year were:

• Houston (2,010)
• Dallas (892)
• San Antonio (682)
• El Paso (455)
• Fort Worth (357)

The top 5 CBSAs reporting QCs were:

• Dallas-Ft. Worth-Arlington
• Houston-Sugar Land-Baytown
• San Antonio-New Braunfels
• El Paso
• Austin-Round Rock-San Marcos.

It is important to note that QCs represent a fraction of overall claims traffic. Nationally in 2012, QCs totaled 116,268 out of an overall claims population of more than 70.5 million — or 0.164 percent.
The volume of QC referrals can increase or decrease over a given period of time and may be caused by a number of factors, including better reporting by the industry and an increase or decrease in fraudulent activity, etc.

Source: NICB

Watch your wallet and purse
Many people store personal information in their purses and wallets, making it easier for thieves to commit identity fraud. Help secure your identity by keeping your purse and wallet in a safe place and carrying only essentials when you go out. Leave credit cards you will not be using in a secure place at home. Unless it is absolutely necessary, avoid carrying Social Security cards, birth certificates or passports as they contain key pieces of personal information thieves could use to steal your identity.

Monitor your mail
Whether you are sending or receiving mail, take steps to help keep your mail safe from prying eyes. Never put outgoing checks, bill payments or financial information in your unlocked home mailbox. When you need to send out sensitive documents, consider using a secure postal mailbox or send them from the post office. Know when credit card statements arrive. If they are late, call the credit card company to confirm if the statement was sent. Shred old bills and unnecessary financial records containing personal information.

Keep a careful eye on your credit
According to our data, nearly half of ID fraud cases are committed using the victim’s current accounts. Review your credit report and bank statements to monitor your accounts, and take these extra precautions:

• Make a list of all your credit card and bank account information, and store the list in a secure place, such as on a password protected flash drive or in a fire-proof safe. Include account numbers, expiration dates, credit limits and phone numbers or emails of the customer service and fraud departments. If your card is missing or stolen, you will then be able to quickly notify your credit card provider to prevent fraudulent charges.
• Review your credit report and notify the credit bureaus of any mistakes. The government gives consumers the right to receive one free copy of their credit report every 12 months from each of the three main credit bureaus (Experian, Equifax and TransUnion). Order one report from a different bureau every four months to see credit activity throughout the year.

Keep your Social Security number safe
Social Security numbers are often used to open fraudulent accounts or to access financial information or assets. Do not have your Social Security number printed on your checks or allow merchants to write it on them. If a business requests your Social Security number, ask them why. If it is not a valid reason, do not provide the information they request. Also, never give confidential information to an unsolicited phone caller who claims they represent a financial institution or creditor. Instead, get the caller’s name, location, phone number and reason for the call. Call the phone number on your billing statements to verify the caller’s identification.

Get additional tips for helping protect your identity while you are online.

Consider buying identity fraud insurance, a relatively inexpensive add-on to your renters or homeowners insurance policy. This coverage typically reimburses the cost of reclaiming your identity and rebuilding your credit, such as attorney’s and notary fees and replacement of IDs. It is a low-cost investment against a high-expense crime.

The information on this site is general in nature. Any description of coverage is necessarily simplified and is not intended to provide legal, technical or other professional advice. Whether a particular loss is covered depends on the specific facts and the provisions, exclusions and limits of the actual policy. Nothing on this site alters the terms or conditions of any of our policies. You should read the policy for a complete description of coverage. Coverage options, limits, discounts and deductibles are subject to availability and to individuals meeting our underwriting criteria. Not all features available in all areas.

Online shopping

• You should research retailers to make sure they are reputable and have a secure network and website. Avoid buying from a site that does not have a secure socket layer (SSL) encryption installed. Look for the ‘s’ at the beginning of a URL – HTTPS:// instead of HTTP:// – to help determine if a site is SSL secured.
• Read the site’s privacy policy to learn how the personal information you provide will be used.
• Use only one credit card for online purchases. Be sure to open statements when received to check for fraudulent charges or activity.
• If you receive an email regarding sales or discounts from a particular retailer, log on directly to the official website for the business. Avoid linking to it from an unsolicited email.

Emails and attachments

• Do not send personal information in an email or instant messages. Emails are out of your control once sent and can be easily intercepted.
• Only open attachments from senders you know and trust. If unsure, you can run a virus scan on attachments before opening.
• Do not download files or programs or click on links from senders you do not know and trust. Consider whether to open emails from retailers if you know you are not on their email list. If you are unsure if an email came from a trusted source, hover over the link to see where it leads.
• If you receive an unsolicited spam email, do not respond or click on any links in the email.
• Be cautious of emails you receive regarding your financial accounts. If you are not sure of the email’s validity, contact your financial institution directly.

General online safety

• Limit the personal information you put on the Internet. Social media sites can be good for networking, but identity thieves can use the information you share.
• Keep your Web browser up to date. This can help ensure the latest security features are installed.
• Avoid storing personal information, account numbers, and personal identification numbers on your computer.
• Install firewall and anti-virus software. This can help protect you from exposure to malicious cyber attacks.
• Choose strong passwords and keep them private.

The use of credit and debit cards and electronic payments has become a way of  life for public and private businesses and their customers. With this, vulnerabilities to credit card fraud and identity theft have increased. To help improve credit and debit card security, the credit card industry and federal and state governments have set standards and regulations.

Fair and Accurate Credit Transactions Act and Receipt Requirements

Congress passed the Fair and Accurate Credit Transactions Act of 2003 (FACTA), significantly amending the Fair Credit Reporting Act (FCRA). Effective Dec. 4, 2006, 15 U.S.C. §1681c amended the act to require any “person* that accepts credit cards or debit cards to transact business” to:

• Truncate card numbers so not more than five digits print on customer receipts;
• Eliminate the card’s expiration date from customer receipts.

* “Person” includes any public (including government entities) or private business that accepts credit or debit cards to transact business.

Key Events Following Dec. 4, 2006

While the majority of businesses truncated card numbers printed on transaction receipts, some did not eliminate expiration dates. A number of plaintiff attorneys filed class action lawsuits alleging that companies who continued to print expiration dates were in willful violation of FACTA. Merchants responded that the provision as written did not mandate both a truncation of card numbers and
deletion of expiration dates, pointing out that no injury or harm had come to the class as a consequence. Congress reviewed the language of the provision, and, modified it in May, 2008, passing H.R.4008, The Credit and Debit Receipt Clarification Act (CDRC) of 2007. On June 3, 2008, President George Bush signed H.R.4008 into public law – P.L.110-241.

Clarifying Business’ Responsibility under FACTA

The effect of CDRC clarifies the responsibilities and liabilities of merchants. Congress said that companies who truncated credit/debit card numbers on transaction receipts between Dec. 4, 2006 and June 3, 2008 but who had not eliminated the card’s expiration date were not in willful violation of 1681c (g) and cannot be sued for statutory damages.

• Effective June 4, 2008, businesses must comply with the FACTA clarification as follows:

> Credit and debit card numbers must be truncated on receipts to include not more than the last five digits of the card number; and
> Expiration dates must not be printed on receipts.

Businesses who fail to comply with both requirements may face statutory damages of between $100 and $1,000 per receipt. With regard to the clarifications, companies should:

• Conduct an immediate review of “point of sale” receipts issued to consumers to ensure compliance with both truncation and redaction of expiration date. Some courts have determined that “point of sale” and “print” in FACTA applies also to online sale receipts. Experts urge companies to ensure that receipts generated from online sales also comply with FACTA’s truncation and redaction rules. Contact equipment  providers if the credit card processing equipment is outdated and not in compliance with CDRC and have machines updated or replaced.

FACTA Disposal Rule

To further protect against identity theft, FACTA also includes a provision for proper disposal of sensitive and confidential information, including consumer information, reports and records and employment information and records. Under the “Disposal Rule,” effective June 1, 2005, businesses are required to take “reasonable measures” to protect against unauthorized access to or use of the information in connection with its disposal. This rule impacts the means of disposal, retention and documentation of shredded materials.

Going Beyond FACTA: Other Considerations

In addition to complying with federal and state laws, companies should follow best data security practices for data operations.

Payment Card Industry Data Security Standard (PCI DSS)
The credit card industry has set data security requirements for merchants, to help protect consumers against identity theft. The Payment Card Industry Data Security Standard (PCI DSS) identifies six standards with 12 requirements for merchants. In summary, these include:
• Build and maintain secure networks, including firewalls and system passwords;
• Protect stored cardholder data through encryption;
• Maintain a vulnerability management program, including routine updating of anti-virus software and maintenance of secure networks and applications;
• Implement strong access control measures;
• Regularly monitor access to network resources and cardholder data and test networks
• Maintain an information security policy that is understood by all employees.  Some companies roll this into a compliance practice.

While FACTA requires receipts contain no more than the last five digits of a credit/debit card account number, PCI DSS requires that no more than the last four digits appear on the receipt.

Managing Your Risk
Companies that engage in the use of credit and debit card transactions or possess consumer reports should have a risk management program for data security to help prevent identity fraud and theft, including:
• Be familiar with and comply with all provisions of FACTA, FCRA and related state laws.
• Be familiar with and implement the credit card industry’s PCI DSS requirements.
• Include protecting consumer credit and credit card information as a part of the company’s privacy and ethics compliance policies and program for all employees.
• Seek legal counsel for additional information on compliance requirements involving consumer information.

The information provided in this document is intended for use as a guideline and is not intended as, nor does it constitute, legal or professional advice.   This material does not amend, or otherwise affect, the provisions or coverages of any insurance policy, nor is it a representation that coverage does or does not exist for any particular claim or loss under any such policy or bond. Coverage depends on the facts and circumstances involved in the claim or loss, all applicable policy or bond provisions, and any applicable law.

Industry resources:

• Helping Businesses Fight Identity Theft (Federal Trade Commission): http://www.ftc.gov/bcp/edu/microsites/idtheft/business/index.html
• Federal Trade Commission Alert: Disposing of Consumer Information: http://business.ftc.gov/documents/alt152-disposing-consumer-report-information-new-rule-tells-how
• PCI DSS for Merchants Payment Card Industry Data Security Standard: https://www.pcisecuritystandards.org/security_standards/index.php

To operate legally, a moving company must display a valid TxDMV or United States Department of Transportation (USDOT) license number on the truck.

Movers should never be hired from free Internet advertising sites. In March, the Houston Police Department arrested two men suspected of using hostage tactics in Houston, San Antonio, Dallas and Austin. The pair ran an unlicensed moving operation that promised cheap moves, but held customers’ household goods hostage, demanding hundreds of dollars in additional money before they would unload the truck. If a customer refused to pay, the truck drove off.

In the past police departments felt hamstrung and unable to help victims of moving scams because of the lack of accountability in the law. Unlicensed movers would show a contract riddled with hidden fees but signed by the customer. Under a new state law, unlicensed movers can receive up to a $4,000 fine and a year in jail for operating illegally in the state.

Trevino encouraged police departments throughout the state to use the law, and to also consider using their cyber-crimes units to pro-actively find illegal movers.

TxDMV is working to educate police and sheriff’s departments on the new law, and is stepping up its efforts to inform Texans how to avoid hiring an illegal operator with its “Don’t Make a Move Without Us!” consumer awareness program.

Source: Texas Department of Motor Vehicles

The following bullet points describe some best practices that companies can use to minimize fraud exposures:

Read the article

Broadband and information technology are powerful factors in small businesses reaching new markets and increasing productivity and efficiency. However, businesses need cybersecurity tools and tactics to protect themselves, their customers, and their data from growing cyber threats. Here are ten key cybersecuritytips for businesses to protect themselves:

1. Train employees in security principles
Establish basic security practices to protect sensitive business information and communicate them to all employees on a regular basis. Establish rules of behavior describing how to handle and protect customer information and other vital data. Clearly detail the penalties for violating business cybersecurity

2. Protect information, computers and networks from viruses, spyware and other malicious code
Install, use and regularly update antivirus and antispyware software on every computer used in your business. Such software is readily available online from a variety of vendors. Most software packages now offer subscriptions to “security service” applications, which provide additional layers of protection. Set the antivirus software to automatically check for updates at a scheduled time of low computer usage, such as at night (midnight. for example), and then set the software to do a scan after the software update.

3. Provide firewall security for your Internet connection
A firewall is set of related programs that prevent outsiders from accessing data on a private network. Install and maintain firewalls between your internal network and the Internet. If employees work from home, ensure that their home systems are protected by firewalls. Install firewalls on all computers — including laptops — used in conducting your business.

4. Download and install software updates for your for your operating systems and applications as they become available
All operating system vendors regularly provide patches and updates to their products to correct security problems and improve functionality. Configure all software to install such updates automatically.

5. Make backup copies of important business data and information
Regularly backup the data on every computer used in your business. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files and accounts receivable/payable files. Backup data automatically if possible, or at least weekly.

6. Control physical access to your computers and network components
Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft, so make sure they are stored and lacked up when unattended. Impose password security and encryption on laptops, so when it is lost, the data won’t be easily compromised.

7. Secure your Wi-Fi networks
If you have a Wi-Fi network for your workplace make sure it is secure and hidden. To hide your Wi-Fi network, set-up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSD). In addition, make sure to turn on the encryption so that passwords are required for access. Lastly, it is critical to change the administrative password that was on the device when it was first purchased.

8. Require individual user accounts for each employee
Setup a separate account for each individual and require that strong passwords be used for each account. Administrative privileges should only be given to trusted IT staff and key personnel.

9. Limit employee access to data and information, and limit authority to install software
Do not provide any one employee with access to all data systems. Employees should only be given access to the specific data systems that they need for their jobs, and should not be able to install any software without permission.

10. Regularly change passwords
Passwords that stay the same, will, over time, be shared and become common knowledge to coworkers and can be easily hacked, Passwords should be changed at least every three months.

11. Obtain and maintain cyber liability / data breach insurance
The cost of dealing with data breach can be devastating for any size business. Imagine how much you will spend contacting each client whose data was compromised. Luckily, most insurance companies have recently introduced Data Breach coverage, to address the risks associated with these claims. It is generally inexpensive (from $2,500 and up) but provides a great piece of mind to every business owner. This coverage may be included with your General Business Liability. You can get multiple instant insurance quotes on our website www.paperless-insurance.com.

The FCC’s Cybersecurity Hub at www.fcc.gov orsmallbiz has more inforrnation, including links to free and low-cost security tools.

Florida officials, law enforcement officers and trade groups are working to stop check cashing companies from aiding workers’ compensation fraud in the construction industry.

Officials are to investigate the role of check cashing companies in order to develop a legislative recommendations for the next year sessions.

According to the officials, schemes involve individuals who set up fake companies that apply for a workers comp. policy. Subcontractors then pay the shell company to use the policy and obtain a certificate of insurance to show general contractors they have insurance. Once the job is completed, the general contractor then writes a check to the shell company, which in turned is cashed by the check cashing company for a fee. The subcontractor and their employees are then paid in cash with the shell company taking a percentage for the use of the certificate of insurance. Florida Division of Insurance Fraud head  estimated that the shell companies hid $1 billion in undeclared payroll over the last several years, which translates into $200 million in evaded workers’ compensation premiums.

Hackers know that it’s very common for people to use one password consistently. So, make sure your password varies. Also, avoid including words or information in your passwords that someone could easily derive. For example, don’t combine the name of the street you live on with your birthday.

Recognize “phishing” attempts, avoid them and report them.

“Phishing” is when you’re on the web and someone poses as something legitimate—friend, family member, government entity, bank or other trusted organization—in order to draw personal data from an unsuspecting person. Phishing can occur via text messages, emails, pop-up messages and even phone calls.

Handle all customer and company information securely.

Some of the most common data breaches are the result of customer paperwork being discarded in the trash. The best way to avoid this is to shred all materials containing information that could compromise a customer or the business. If you maintain all of your customer information on file in hardcopies, ensure that this information is secured.

Avoid malware by keeping your antivirus software up-to-date and active.

“Malware” is malicious software which aims to disrupt computer systems by gaining unauthorized access and compromising privacy. If your computer becomes infected, or you suspect that it’s infected, immediately disconnect from your network and stop all online activity. Inform your IT personnel if you have any and determine if a report needs to be filed with your local law enforcement agency.

Back up critical files.

Back up data by keeping printed records or by uploading the data to an external hard drive that isn’t always connected to the network to ensure that your information is safe in the event of a system crash or a privacy breach. Some attacks seek out private information with the intent to use that information, while other attacks are devised to simply “wipe out” data in other systems.

If you feel your privacy has been attacked, please contact your local law enforcement