Consumer complaint received 2024-12-09 00:00:00
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Other service problem — 
Company: WESBANCO BANK, INC.
State: OH

Complaint narrative:
Bottom Line Up Front My bank, WesBanco, is not protecting my PII financial data in accordance with laws and regulations to my satisfaction. Some people may be OK with the way WesBanco handles PII financial data, but I am not. 

I am XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX XXXX, XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX ). Not reporting something that I consider as a deficiency of security practices would put me in violation of the XXXX XXXX of XXXX. 

Complaint WesBanco recently changed their online banking service. The new service requires that if I do a transfer online, the online system will generate an UNENCRYPTED email notification that contains several pieces PII financial data. The notification of a transfer email associates my email with the last XXXX digits of several account numbers, account balances, and loan balances ( if a loan is part of the transfer ). There is no way to opt out of this email message being sent when an online transfer is made. The online interface does allow for the user to opt out of some other email notifications, but not email notifications that involve transfers. There may be other notifications associated with the online system that also require email notifications. 

Attempt to Resolve I brought this to their attention around XXXX when my wife and I were moved from the Wesbanco online system that we have used for years to the new ( new to us ) online system and did a transfer. After months of escalation within WesBanco, I was informed that they will not address my concern and will not rewrite the software just for me. I have been involved in software development for years. I would consider this a security patch and not a rewrite. Their claim is since it did not contain the entire account number it does not need any protections. I do understand the desire to notify users about a transfer, but do not understand the need to include PII financial data including transfer amounts, account balances, and account references ( last 4 of account number ) via UNECRYPTED email. I informed them that I would be ok with an email that simply stated that a transfer had occurred. ( note that the last XXXX numbers of an account are not themselves PII financial data, however if it is combined with email address, names, account balances it probably is. I.e. coupled data ). I now do all transfers at a teller window at a physical bank location so that an email is not generated. This is becoming more difficult since the bank hours have been shortened, requiring me to take time off work to go to the bank. 

Questions XXXX. What options do I have to protect my PII financial data including account balances from being emailed in plain text? 

XXXX Who needs to get involved to address the issues? ( XXXX Attorney General, FDIC, etc ) XXXX. How do I protect myself from retaliation from WesBanco for reporting them? 

Information Personally Identifiable Financial Information ( Financial PII ) FFIEC : Personally-identifiable financial information is any information that a financial institution obtains about a consumer in conjunction with providing a financial product or service. This includes information provided during any financial transaction. 
Personally-identifiable financial information might include any of the items of information listed herefrom the fact that a consumer relationship exists between an individual and a financial institution to the specific account balance of that individual. 
FDIC : Personally identifiable financial information ( PII ) is any information that a financial institution obtains about a consumer that can be used to identify them : Credit card numbers, Bank account numbers, XXXX reports, The value of a consumer 's home, and whether an individual has a loan with a particular institution. 

GLB Gramm-Leach-Bliley ( GLB ) Act of 1999 which prohibits the disclosure of certain private information like Social Security numbers, income , and some outstanding debt. The Act, which is federally-mandated, consists of three sections : the Financial Privacy Rule which regulates the collection and disclosure of private information ; the Safeguards Rule requires financial institutions to enact security programs to protect personal information ; and the Pretexting provisions that prohibit the access of private information under false pretenses. 
The GLB Act also determines what information can be shared and with whom. Information that is publicly available like phone numbers or addresses can be shared. Information that can not be shared is called personally identifiable financial information which is not publicly available. It includes data provided on a loan application, credit card information, account balance, payment history, purchase information, Social Security data and birth dates, and even the institution where they bank.

NIST 8062 They [ the FIPPs ] are value statements rather than recipes, however. System planners often encounter difficulties when trying to operationalize them, particularly when assessing privacy risks and when establishing privacy requirements XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX defines PII XXXX information that can be used to distinguish or trace an individuals identity, either alone or when combined with other information that is linked or linkable to a specific individual.70 Circular A-130 notes that the definition is necessarily broad.71 Nonetheless, as previously noted in this report, more consideration needs to be given to the effect of cyber [ 1 ] physical systems on human behavior in the physical realm, and how it should be accounted for in a privacy risk model.72 Federal Financial Regulators Should Take Additional Actions to Enhance Their Protection of Personal Information This comment is due to HELOC balance being PII PII such as borrowers full name, account numbers, outstanding balance ( XXXX ), interest rates, and payment information. 

Code of Federal Regulations - PART 332PRIVACY OF CONSUMER FINANCIAL INFORMATION 332.3 section ( o ) ( 1 ) Personally identifiable financial information means any information : ( i ) A consumer provides to you to obtain a financial product or service from you ; ( ii ) About a consumer resulting from any transaction involving a financial product or service between you and a consumer ; or ( iii ) You otherwise obtain about a consumer in connection with providing a financial product or service to that consumer.

( 2 ) Examples ( i ) Information included. Personally identifiable financial information includes : ( A ) Information a consumer provides to you on an application to obtain a loan, credit card, or other financial product or service; ( B ) Account balance information, payment history, overdraft history, and credit or debit card purchase information ; ( C ) The fact that an individual is or has been one of your customers or has obtained a financial product or service from you ; ( D ) Any information about your consumer if it is disclosed in a manner that indicates that the individual is or has been your consumer ; ( E ) Any information that a consumer provides to you or that you or your agent otherwise obtain in connection with collecting on a loan or servicing a loan ; ( F ) Any information you collect through an Internet cookie ( an information collecting device from a web server ) ; and ( G ) Information from a consumer report.

NIST SP 800-122 How to protect PII.

Abstract The purpose of this document is to assist Federal agencies in protecting the confidentiality of personally identifiable information ( PII ) in information systems. The document explains the importance of protecting the confidentiality of PII in the context of information security and explains its relationship to privacy using the Fair Information Practices, which are the principles underlying most privacy laws and privacy best practices. PII should be protected from inappropriate access, use, and disclosure. This document provides practical, context-based guidance for identifying PII and determining what level of protection is appropriate for each instance of PII. The document also suggests safeguards that may offer appropriate levels of protection for PII and provides recommendations for developing response plans for incidents involving PII.

Given the nature of interconnected networks and the use of the internet to share information, the protection of sensitive data can become difficult if proper mechanisms are not employed. Any network service that handles sensitive or valuable datawhether it is personally identifiable information ( PII ), financial data, or login informationneeds to adequately protect that data. Transport Layer Security ( TLS ) protocols were created to provide authentication, confidentiality, and data integrity protection between a client and server. The initiative to secure connections will enhance privacy, increase trust that data and services are authentic, and prevent undetected modification of data from government servers while in transit. 

Email Various snippets from documents Unencrypted emails containing personally identifiable information ( PII ) are a security risk and can be a violation of privacy laws. 
Security risk : Unencrypted emails can be intercepted and read by unauthorized individuals. Emails travel through multiple computers before reaching the recipient and can be exposed to hackers. 
Unencrypted email is not secure for sending personally identifiable information ( PII ), such as financial data, because it can be intercepted by hackers. This can lead to identity theft, financial fraud, and reputational damage.

Company response to consumer: Closed with explanation