Norwich Union was fined a record £1.26 million yesterday after security failures at its call centres allowed fraudsters access to policyholders’ details and put almost seven million customers at risk of financial fraud.

The Financial Services Authority rounded on Norwich Union’s lax controls as it imposed the fine, the largest for a breach of data and controls procedures.

The regulator also criticised the firm for prioritising nine of its directors who had been victims of the fraud ahead of its wider base of 6.8 million policyholders.

It said that the insurer, part of the Aviva group, which also owns the RAC, had failed properly to assess the risks posed to its business by financial crime, after it emerged that a gang of fraudsters managed to overcome basic security questioning to gain access to policyholder details. The gang, which targeted Norwich Union’s call centres, were able to obtain details of customers’ policies by supplying basic information such as an account holder’s surname, first and middle name, first line of address and date of birth.

Gang members were able to bypass a second security layer in place at the centres, many of which are operated from Bombay, by supplying postcode details or other information clearly in the public domain.

In some cases, the gang managed to get access to details of policyholders’ bank accounts.

In all, the gang successfully cashed in, or “surrendered”, 74 life policies totalling £3.3 million in a concerted call-centre blitz last year.

Norwich Union first discovered irregularities at its call centres in April last year, but did not take effective action to protect policyholders until September, the FSA said in a detailed explanation of its fine published yesterday. “We think that this penalty brings home the message that we are very concerned about security issues and that this lapse was very serious,” Tracey McDermott, head of wholesale enforcement at the FSA, said.

She noted that Norwich Union had received a 30 per cent discount for co-operating with the regulator and for tightening up its security processes. Otherwise, the fine would have been £1.8 million, she said.

Stephen Mann, business change director at Norwich Union Life, apologised unreservedly to those customers who had had their policies cancelled or lost money at the hands of the fraudsters. He said that Norwich Union had fully reinstated all surrendered policies and reimbursed customers who had lost money.

He said that the insurer had initially believed that the gang was targeting Aviva directors. “We were not able to see a wider pattern until some time later. As soon as we became aware of this we contacted the authorities at the FSA and the police,” he said.

Times Recommends

• Minister in talks with Saudis to protect creditors
• Premier Inn hits back in £29-a-room row
• Bankers hit back at 'populist' bonus supertax