Patrick Hosking: Business Commentary
Win tickets to the ultimate village fete with welly wanging and more
It’s hard to come up with a vivid enough metaphor for the self-interested bungling of the Norwich Union top brass over the defrauding of policyholders. But try imagining the Titanic run by Keystone Cops elbowing aside women and children to get to the lifeboats first.
Failing upon failing is revealed in the Financial Services Authority’s final report into the fraud. Incompetence and complacency were manifest, it hardly needs saying, but Norwich Union seems guilty of something else – downright bone-headed stupidity.
It’s impossible not to boggle at the obtuseness of the Norwich Union decision-making. In essence the company set up security procedures so useless that fraudsters were able to empty the accounts of policyholders using information entirely from the public domain.
A ten-year old could spot the glaring flaw in the system, but not apparently Norwich Union.
When fraudsters impersonating policyholders were unable to come up with a potential victim’s policy number, they were given a second chance, and were asked for the policyholder’s postcode instead. Yes, you didn’t read that wrong. Not password. Postcode.
It gets worse. Even after the frauds were discovered the company rejected procedural reforms that could have stopped them dead, thus allowing the plundering of customer policies to continue. Better security arrangements were rejected on the grounds they would worsen customer service or would require manual processes to supplement NU’s computers. In other words they might mean hiring extra people.
The fraudsters ran circles round NU’s sleepy internal fraud investigators and feeble security systems. Call centre employees’ suspicions were not registered on electronic records. The investigators took 24 hours just to respond to a suspicious event, while the fraudsters were carrying out their efficiently executed stings in as little as 12 minutes. Crucial caller identification procedures were checked by NU, not to ensure that they actually confounded potential criminals, but to ensure that they complied with the Data Protection Act.
When Aviva and NU belatedly woke up to the fact that their arrangements were the equivalent of leaving the Tower of London unlocked and giving the Beefeaters the day off, their response was to rush to protect the personal nest-eggs of their own senior managers. There was no attempt to alert the other six million policyholders who were also vulnerable to the same fraud.
NU says that it has learnt from the experience and has reviewed security internally and externally and takes it “extremely seriously”. And of course, the victims have been compensated.
Yet, questioned by The Times yesterday, senior NU management did not know how long the fatal procedural flaw had been in place, nor how it had originated, nor who was responsible for approving it.
With their heads buried that deep in the sand, they seem destined to repeat their mistakes. Not that it will matter much for their own career prospects. No one has been disciplined in any way over this disaster.
And the fine – equivalent to less than four hours’ profits for NU’s parent Aviva – is unlikely to act as much of a deterrent in future, either at NU or elsewhere in the financial services industry.
Until customer confidentiality and identity theft rises higher up the priority list in our financial institutions, these lapses are bound to recur. Boards will continue to regard the fines as regrettable, but not much different in kind to any other business expense.
Follow our three athletes' progress in their preparations for the London Triathlon, and pick up training tips and more
Enjoy screenings of all the classic films you love, plus take advantage of two-for-one tickets
We explore leisure activities that are safe and suitable for all of the family
Times Online's new TV show helps you make the right decisions for your pet
Read our exclusive 100 Years of Fleming and Bond interactive timeline, packed with original Times articles and reviews
The latest travel news plus the best hotels and gadgets for business travellers

Overseas contacts and local business information
2002/02
£59,995
The Midlands
F/1989
£36,000
Hollingworth At Ombersley
2007/57
£35,000
South East England
Great car insurance deals online
90K plus bonus plus options
Confidential
London
To £28k
Barclaycard
Various (outside London)
£
£40,000 - £50,000 + benefits
Lloyds Pharmacy
Coventry
£38k
Barclaycard
Various Locations
Live in One of London's Most Vibrant Areas
From £249,950
Beautiful Gardens w/ stunning Thames Views
Studios £33K, 1 Beds £60K, 2 beds £79K
Mortgages, bank acc & money transfers to help you buy abroad
Explore mystical Jordan
From £1030 for 7nts 4*
to USA's Most Cosmopolitan City; San Francisco!
£POA
Book Now for Winter 08/09 and Get 10% off!
Great travel insurance deals online
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times. Search globrix.com to buy or rent UK property. Visit our classified services and find jobs, used cars, property or holidays. Use our dating service, read our births, marriages and deaths announcements, or place your advertisement.
Copyright 2008 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
Three years ago I contacted the information commissioner was contacted about Norwich Union sending personal details abroad and, particularly outside europe. The information commissioner rebuked me for daring to suggest that overseas call centres were less secure. This article proves my concerns were justified.
R.Allely, Wales, UK
As long as the financial services industry continues to pay its top employees bigger bonuses than those of other industries, they will continue to think that they are better than the rest of us. If personal bonuses were counterbalanced by the possibility of receiving equally sized personal fines perhaps that would focus their minds a little.
Natalie, Northants, UK
James McColl: "The directors of NU appear to be eminently well qualified to become Labour Cabinet ministers.........." I reckon it's more the case that both business and government have mired themselves in so much bureaucracy- Snafus such as this are the unavoidable consequence of gigantism, and in an age where companies have larger turnovers than nations, that can be more of a problem for businesses than for governments.
Chris, Harrow,
This failure to counter fraud from Norwich Union seems to explain why they are one of the most hated companies in the financial sector. I like many others have had a insurance claim rejected by NU on spurious and changing reasons ranging from 'its an accident not an act of god' through to 'the wind speed didn't reach our secret internal guidelines'. Their initial response is to deny any claim, then pull out all the double talk small print and when that doesn't stop you they find secret clauses known only to them to reject the claim. Only when the financial ombudsman was called in did they finally cough up. This latest behavior is systematic of many arrogant financial companies out to scam people whilst looking after themselves. My recommendation to any one getting the run around by NU on a claim or any other financial matter is to go to the ombudsman the second they have shut you down. Over 90% of complaints are upheld demonstrating the high level of scams by big name companies.
Mike, Alicante, Spain
The fine is obviously peanuts for them however a jolly good roasting in the press should do wonders for their reputation and repeat business. Perhaps in future fines should be set at the level of the total annual remuneration of all directors plus their perks plus their pension contributions for the year? That should add up to a whacking great incentive not to treat their customers with contempt (as pretty much every company does once it gets big enough not to have to worry about losing the odd few hundred customers just becuase they are utterly incompetent).
phil, uk, london
I wish I could feel shocked and surprised by this but this sort of crass incompetence is just so commonplace amongst senior managers and politicians these days. Will we ever get managers/politicians who know how to MANAGE things instead of half-wits whose only skills are self-aggrandizement and a good line in patter ?
Mel, London,
It's not the first time that priorities have been skewed in this way. When the Equitable Life problems surfaced, policyholders thought they would all be taken care of since MPs own pensions were with them. Instead, Equitable and the Government did a deal to protect the MPs, leaving ordinary policyholders behind. I guess NU senior management took a lead from their masters.
Austin, London,
Customer service staff working in firms like NU are poorly trained, often with few qualifications. Customer service teams are generally run by school leavers with little experience outside their little world. The customer is always wrong. But you have to blame the companies because they employ them and allow them to trundle along oblivious to what it's really like to work in a commercial environment. There is no excuse for poor training and poor staffing. And I agree - a fine like that will barely hit NU - they will just reduce the staff salary pot in 2008.
Boris, Edinburgh,
Another well known charge-card company in the UK still relies for its security (sic) procedures solely upon the caller providing name, address, date of birth and mother's maiden name; each of which is easily available in the public domian.
Writing to point this out to them elicited a pompous response explaining thay the company "won't enter into correspondence concerning security matters".
Richard, Charlas, France,
For people involved in finance this cannot come as much of a surprise - all the big finance companies concentrate on one thing, and one thing only - making money! Endowment mis-selling, banking complaints, ever increasing profits, and big payouts for the fat cats at the top all point to one thing - honesty, fairness, and, most of all, people, are of no concern.
Kate , Glasgow ,
The directors of NU appear to be eminently well qualified to become Labour Cabinet ministers..........
James McColl, Guildford, UK
"When Aviva and NU belatedly woke up... their response was to rush to protect the personal nest-eggs of their own senior managers. There was no attempt to alert the other six million policyholders who were also vulnerable to the same fraud. "
Breathtaking. It's a manual of how to destroy a brand.
david, ely,