Are Banks Playing Fast and Loose with Consumers’ Location Data?
The furor over Apple’s storing of location data this week raises similar important questions about banks.
To refresh your memory, a file on Apple iPhone devices appeared to contain data of the locations visited by users of the device over the previous 12 months. Apple has subsequently changed the parameters of the location data its devices collect.
When you think about it, banks are replete with location data. Banks, of course, know which ATM you access and when. There are also those ATM locator apps that most banks offer online. They tell banks not where you are, but the location you are thinking about. And then there are banks’ apps that tap the geo-location features on mobile phones. Plenty of banks make use of those features already.
Bank Innovation asked 11 of the largest banks in the nation the degree to which they retain the location data of their consumers. Of the 11 banks, only Bank of America, Wells Fargo & Co., and JP Morgan Chase provided comprehensive feedback. HBSC provided a cursory response. None of the other banks – neither US Bancorp, PNC, Capital One Financial Corp., TD Bank, Regions Financial, nor BB&T – even bothered to reply.
BofA, Wells and JPM are clearly aware of the sensitivity of the data. In all three cases, the banks do not match the ATM locator queries to the user. In other words, if a consumer is logged into his online or mobile banking account and enters the ZIP 10004 to find out the closest ATM, none of the three banks will tie that query to the consumer.
Those mobile ATM locators are a different ballgame, it seems. All three banks offer such apps. I asked whether the ATM locator queries are tied to the consumers’ mobile numbers. Bank of America and Wells said that they do not. A spokesman for BofA said, the bank “cannot link back the data to a mobile number. We only know that someone searched for a particular ZIP code. Since we don’t store the mobile numbers or identifying data, we do not have the capability.”
But Chase? The banks would not say.
Only Wells would acknowledge that it stores the geographic data of consumers’ ATM usage. Wells said, “The data is retained up to the legal limits.” But the bank did not elaborate on that, and did not indicate how that location data is used.
But the lack of response from US Bancorp, PNC, Capital One Financial Corp., TD Bank, Regions Financial, and BB&T is the real concern here. Consider, for example, Wells Fargo. Let’s say a Wells consumer on an iPhone who is logged into the bank’s mobile banking platform uses the geo-locator app. That data will remain on the device – and presumably available to Wells – “in session only until the user logs out or the session expires,” according to Wells. That setting can easily be changed to just “until a user logs out.” I had an Associate Press app, subsequently removed, which never logged me out – and I had no way of altering that setting.
The other banks concern me because they are, on some level, emblematic of all banks – and I suspect that there are some playing fast and loose with location data. I mean, if Apple did, why would the Bank of Wherever? BofA, Chase and Wells are certainly more diligent about their location data. I just hope all banks are, too.
