Peter A Clarke

Over the last year the Federal Trade Commission (the “FTC”) has been taking stronger action to deal with privacy intrusive behaviour both in terms of undertakings and fines.  It has also lobbied Congress for greater powers and been quite pro active in advising consumers on their legal rights. The FTC finished 2014 with a flourish with further litigation against corporations involved in privacy intrusive behaviour as reported in FTC Cracking Down on Privacy Violations.

The article provides:

Last week, the FTC filed a complaint against a Nevada-based data broker, along with its former CEO, for selling consumers’ personal information, such as Social Security and bank account numbers, to third parties that allegedly used that information to make unauthorized charges to consumer bank accounts.

Security experts, including Tom Kellermann, chief cybersecurity officer of Trend Micro, say the FTC’s action is a positive step toward ensuring consumer privacy.

“The FTC has awoken to the reality that there can be no privacy without cybersecurity,” Kellermann says. “The robust criminal underground had been targeting the data aggregators and credit bureaus for some time now, but never via an overt conspiracy like this.”

According to a statement issued by the FTC on Dec. 23, data broker LeapLab, an Arizona-based company that is owned by Nevada-based Sitesearch Corp., allegedly bought and sold payday loan applications submitted by hundreds of thousands of financially struggling U.S. consumers to third-party marketing firms without the consumers’ knowledge or consent.

At least one of those marketers, a company known as Ideal Financial Solutions Inc., allegedly used that information from those payday loan applications to post unauthorized charges to consumers’ accounts for financial products and services that were never delivered.

According to the FTC’s complaint, filed Dec. 22 with a district court in Arizona, Ideal Financial between 2009 and 2013 allegedly purchased payday loan applications provided by at least 2.2 million consumers’ to various data brokers, including LeapLab.

The FTC claims that LeapLab sold at least 16 percent of those applications to Ideal Financial.

“The defendants collected hundreds of thousands of payday loan applications from payday loan websites known as publishers,” the FTC states. “Publishers typically offer to help consumers obtain payday loans. To do so, they ask for consumers’ sensitive financial information to evaluate their loan applications and transfer funds to their bank accounts if the loan is approved. These applications, including those bought and sold by LeapLab, contained the consumer’s name, address, phone number, employer, Social Security number, and bank account number, including the bank routing number.”

The complaint also alleges that LeapLab hired a key executive from Ideal Financial to be its chief marketing officer and knew at that time that Ideal Financial was using the information it purchased to make fraudulent charges. Still, LeapLab and its CEO at the time, John Ayers, did nothing to stop the illegal activity, according to the complaint.

“This case shows that the illegitimate use of sensitive financial information causes real harm to consumers,” says Jessica Rich, director of the FTC’s Bureau of Consumer Protection, in the Dec. 23 statement. “Defendants like those in this case harm consumers twice: first by facilitating the theft of their money and second by undermining consumers’ confidence about providing their personal information to legitimate lenders.”

The estimated amount illegally charged and withdrawn from these consumers’ accounts totaled more than $47 million, the FTC claims.

The FTC is asking the Arizona district court to file a permanent injunction against LeapLab to prevent future violations, and it also wants to award relief to consumers who paid unauthorized charges to Ideal Financial. The FTC also asks that its legal fees be paid by the defendants.

Other FTC Actions

Recent charges brought by the FTC against other firms prove the commission is getting more aggressive when it comes to the protection of consumer data.

In March, the FTC settled with online movie-ticket sales provider Fandango and Web-based financial management provider Credit Karma after both companies were charged by the FTC for failing to secure consumer data submitted through their mobile applications (see Fandango, Credit Karma Settle with FTC).

The FTC statement provides:

A data broker operation sold the sensitive personal information of hundreds of thousands of consumers – including Social Security and bank account numbers – to scammers who allegedly debited millions from their accounts, the Federal Trade Commission charged in a complaint filed today.

According to the FTC’s complaint, data broker LeapLab bought payday loan applications of financially strapped consumers, and then sold that information to marketers whom it knew had no legitimate need for it. At least one of those marketers, Ideal Financial Solutions – a defendant in another FTC case – allegedly used the information to withdraw millions of dollars from consumers’ accounts without their authorization.  

“This case shows that the illegitimate use of sensitive financial information causes real harm to consumers,” said Jessica Rich, Director of the Federal Trade Commission’s Bureau of Consumer Protection. “Defendants like those in this case harm consumers twice: first by facilitating the theft of their money and second by undermining consumers’ confidence about providing their personal information to legitimate lenders.”

The defendants collected hundreds of thousands of payday loan applications from payday loan websites known as publishers. Publishers typically offer to help consumers obtain payday loans. To do so, they ask for consumers’ sensitive financial information to evaluate their loan applications and transfer funds to their bank accounts if the loan is approved. These applications, including those bought and sold by LeapLab, contained the consumer’s name, address, phone number, employer, Social Security number, and bank account number, including the bank routing number.

The defendants sold approximately five percent of these loan applications to online lenders, who paid them between $10 and $150 per lead. According to the FTC’s complaint however, the defendants sold the remaining 95 percent for approximately $0.50 each to third parties who were not online lenders and had no legitimate need for this financial information.

The Commission’s complaint alleges that these non-lender third parties included: marketers that made unsolicited sales offers to consumers via email, text message, or telephone call; data brokers that aggregated and then resold consumer information; and phony internet merchants like Ideal Financial Solutions. According to the FTC’s complaint, the defendants had reason to believe these marketers had no legitimate need for the sensitive information they were selling.

In the FTC’s case against Ideal Financial Solutions, between 2009 and 2013, Ideal Financial allegedly purchased information on at least 2.2 million consumers from data brokers and used it to make millions of dollars in unauthorized debits and charges for purported financial products that the consumers never purchased. LeapLab provided account information for at least 16 percent these victims.

The complaint notes that LeapLab hired a key executive from Ideal Financial as its own Chief Marketing Officer and then knew that Ideal used the information purchased from it to make unauthorized debits. Yet, the complaint alleges, the defendants continued to sell such information to Ideal.

The defendants in the case, Sitesearch Corp., LeapLab LLC; Leads Company LLC; and John Ayers, are alleged to have violated the FTC Act’s prohibition on unfair practices.

The Commission vote authorizing the staff to file the complaint was 5-0. The complaint was filed in the U.S. District Court for the District of Arizona, Phoenix Division.