Consumer complaint received 2023-10-18
Product: Money transfer, virtual currency, or money service — Mobile or digital wallet
Issue: Trouble accessing funds in your mobile or digital wallet — 
Company: Comerica (TX)

I am trying to transfer my XXXX funds from Direct Express to my financial institution. Direct Express requires that you send your confidential information by standard unencrypted email. I asked if they would take a fax ( they said No - photo ID must be in XXXX ). I tried to send this info using secure email ( XXXX and XXXX Mail ) but they said if the information requires a passphrase or is not standard email attachment, then they will not process it. 
I sent the information on Monday XX/XX/XXXX. Their reply email says it will be processed in XXXX business hours. I called today and they said they could not process the faxes or the secure emails that I sent on Monday ( XXXX faxes and XXXX emails ) because I did not send the information as standard email attachments. They denied my request to ACH transfer my benefit funds to my bank. 

A banker friend helped me write the following : XX/XX/XXXX Dear Sirs : It has come to my attention that the service provider for the XXXX Direct Express MasterCard program may be exposing the confidential non-public information ( NPI ) ) of cardholders and government benefit recipients unnecessarily in violation of federal and state information security guidelines, regulations, statutes, and possibly XXXX PCI DSS standards. 

It is unclear at this point who operates these cardholder services ; it may be Comerica Bank, N.A. or their money service business vendor, possibly i2c, Inc., or Conduent Corporation. The Direct Express program appears to be managed by the Fiscal Bureau of the Department of The Treasury. Comerica Bank is regulated by the Federal Reserve Bank of Dallas , Federal Deposit Insurance Corporation, and the Texas Department of Banking. Additionally, your organization, the Consumer Financial Protection Bureau, along with the Federal Trade Commission, MasterCard International, and Office of the Inspector General for the Department of the Treasury may have jurisdiction or oversight responsibilities depending on the specific operations of this program. 

My concern is Direct Expresss method of communicating and exchanging information with consumers for facilitating transactions and authenticating its customers. The website http : //web.usdirectexpress.com/ does not provide for any means of contact other than by telephone. 

For example, to initiate an ACH transfer from a cardholders account to a demand deposit account with another financial institution, the account holder is instructed to attach to a standard email, unredacted copies of the cardholders state photograph identification card ( such as a drivers license ) and a copy of their statement that includes their name, address, institution routing and account number information. The account information must include the full account number and routing number, unredacted. Direct Express prohibits this information from being faxed as their internal policies require a XXXX photo ID. They do not offer a secure portal for uploading information. My friend attempted to share information with them using an encryption service ( like XXXX, XXXX, etc. ) and they stated that if a password was required to access the file, then it would not be processed. Only standard email attachments are acceptable. They document some of their policies on their website at XXXX XXXX XXXX. 

Their website is cobranded with Comerica and their terms of use and privacy policy reference Comerica Banks policies ( XXXX XXXX XXXX XXXX XXXX XXXX ). 

Federal laws, regulations, and standards would appear to prohibit a financial institution from requiring consumers to send non-public information like their state issued photo ID card and financial institutional account information by standard unencrypted email. In fact, Comerica Banks consumer E-Mail Practices page ( XXXX XXXX XXXX ) states that " Comerica is committed to safeguarding the privacy of your personal information. Comerica will never request personal information ( e.g., Social Security number, account numbers, user IDs or passwords ) via e-mail. '' It would seem that financial institutions and their service providers are required to safeguard customer information, limit access & usage of customer information, and develop policies and procedures to safeguard such information ( Section 501 ( b ) of the Gramm Leach Bliley Act, also known as the Financial Services Modernization Act of 1999 ( P.L. 106-102, 113 Stat.1338 and codified as 15 USC 6801 ( b ) ) ).

Several regulatory agencies have promulgated information security regulations, and the Federal Financial Institutions Examination Council has published interagency guidelines for information security standards. Applicable federal guidelines that may apply include the FFIECs Interagency Guidelines Establishing Information Security Standards, 16 CFR 314 ( Federal Trade Commission ), 12 CFR 208.61 and Appendices D-1 & D-2 to Part 208, as supplemented ( FRS ). 12 CFR 1016 ( CFPB ), and Parts 364 & 332 of CFR Title 12 ( FDIC ). 

Additionally, XXXX requires its merchants and service providers to safeguard cardholder confidential information and comply with Payment Card Industry Data Security Standards. These standards may include requirements to protect cardholder data with strong cryptography during transmission over open public networks as well as develop organizational policies and programs supporting cardholder information security. They may also restrict access to cardholder confidential non-public information on a need-to-know basis. Open unencrypted email sent to a general email address would not appear to limit access to such information on such a basis. 

Texas banking and business laws require businesses to protect against data breaches via electronic information systems and financial institutions to adhere with federal information security standards. 

I believe that it would be in the best interest of federal benefit recipients and Direct Express consumers if this program either allowed consumers to upload confidential information through a secure site or developed an encrypted email system that would allow cardholders to securely share their XXXX information with Direct Express.