A federal investigation into the criminal breach of Frost Bank’s check processing software is continuing while the bank and its commercial customers work through notifying those who may be affected.
The unauthorized access to an unnamed third-party software program affected 470 commercial customers of the bank who use electronic lockbox services to make deposits. Hackers may have gained access to information, like account numbers and routing numbers, that could be used to forge checks.
Although the breach was detected and reported in March, some notification letters have only recently been mailed. A Frost Bank spokesman said that’s because the bank has been working to identify all of the archived images of checks that were illegally accessed and determine how to reach the account holders.
The Bexar County Tax Assessor-Collector Office was among the commercial customers affected. It estimates that 10 percent to 15 percent of all the tax office’s items may have been accessed before the fraudulent activity was detected, according to a spokeswoman.
So far, a total of 26 customers have reported to the tax office that their tax payment checks were accessed in the breach and potentially used in a forgery crime.
A statement from the tax office, however, said all payments on taxpayers’ accounts were received by the office and applied correctly and in full to the customer’s accounts.
Frost Bank has been issuing letters to customers letting them know of the incident. It states, in part, “Our current understanding is that the personal information that was accessed without authorization may include your name, address, bank account number, routing number, and any other information visible on the face of your check, as well as any information you may have included in the mailing with your check.”
In one case, after an affected individual was notified in late May, he was required to obtain new checking and savings account numbers through his credit union in order to proactively guard his accounts. He preferred not to be named.
Other Frost Bank commercial customers affected in the breach include the City of Corpus Christi, which notified residents of that city that their utility payments may have been accessed; the San Antonio Housing Authority; New Braunfels Utilities; Comal County; and Heritage Land Bank.
Some of Frost’s lockbox customers chose to let Frost Bank mail letters, while others notified their customers directly.
“We do believe, at its heart, this is a check-fraud scheme so even though it’s obviously a breach of data, the data was actually scanned images of checks,” Frost spokesman Bill Day said. “So it’s really about the same as somebody stealing a check from your checkbook … and forging a check based on that.
“The silver lining, if there is one, is that check fraud is one of the oldest frauds out there and banks have dealt with it for many years, and it’s a relatively simple thing to take care of.”
Frost Bank officials are working with federal law enforcement authorities to determine the origins of the breach and won’t release any specific information that might compromise the criminal investigation, including how many checks were duplicated. The Financial Crimes Unit of the San Antonio Police Department is not currently involved.
Frost Bank is urging those affected to monitor their bank accounts for fraud or suspicious activity, and has offered identity theft and monitoring services through AllClear at no charge.
The Bexar County Tax Assessor-Collector’s Office has established a phone number to call and report irregular activity as a result of a check mailed to that office: (210) 335-6758.
