ANZ Bank: They Haven’t Lost My Documents, They Just Don’t Know Where They Are
Back on 2 June, I received a text from ANZ telling me that if I didn't complete their "Know Your Customer" requirements within five days, restrictions could be placed on my accounts.
The text said:
Back on 2 June, I received a text from ANZ telling me that if I didn't complete their "Know Your Customer" requirements within five days, restrictions could be placed on my accounts.
The text said:
From ANZ: Please complete our Know Your Customer requirements within 5 days. If not completed, restrictions may be placed on your accounts unless we've told you otherwise. We're here to help. Visit the ANZ website and search 'Know Your Customer' or call your Relationship Management Team or 1800 343 171 (Intl: +61 3 8699 6936), Mon-Fri 9am-5pm Melbourne time, quoting SR-XXXX.
From ANZ: Please complete our Know Your Customer requirements within 5 days. If not completed, restrictions may be placed on your accounts unless we've told you otherwise. We're here to help. Visit the ANZ website and search 'Know Your Customer' or call your Relationship Management Team or 1800 343 171 (Intl: +61 3 8699 6936), Mon-Fri 9am-5pm Melbourne time, quoting SR-XXXX.
I called the number and, after spending some time with the representative, complete with a barking dog in the background, established that I really was speaking with someone from ANZ.
They explained that I needed to provide information for each of my legal entities as part of ANZ's Know Your Customer (KYC) process.
I was a little perplexed by this because I'd already provided this information several years ago. Apparently, my profile had been "reset", which meant I needed to provide a host of legal documents and answer a number of personally identifiable questions all over again.
Fair enough. Banks have regulatory obligations and I understand why they need to know who their customers are.
What surprised me was how ANZ wanted me to provide the information.
By email.
I pointed out that email isn't a particularly secure way of sending passports, legal documents and other highly sensitive information.
I was reassured that the email address they had given me was "completely secure".
The problem is that having a secure email address at one end doesn't magically make the entire email system secure.
When I pointed this out, the representative suggested I could encrypt the documents and then email the password separately.
Excellent.
Now anyone intercepting my communications only needs to read two emails rather than one to get everything they need to impersonate me.
I called the number and, after spending some time with the representative, complete with a barking dog in the background, established that I really was speaking with someone from ANZ.
They explained that I needed to provide information for each of my legal entities as part of ANZ's Know Your Customer (KYC) process.
I was a little perplexed by this because I'd already provided this information several years ago. Apparently, my profile had been "reset", which meant I needed to provide a host of legal documents and answer a number of personally identifiable questions all over again.
Fair enough. Banks have regulatory obligations and I understand why they need to know who their customers are.
What surprised me was how ANZ wanted me to provide the information.
By email.
I pointed out that email isn't a particularly secure way of sending passports, legal documents and other highly sensitive information.
I was reassured that the email address they had given me was "completely secure".
The problem is that having a secure email address at one end doesn't magically make the entire email system secure.
When I pointed this out, the representative suggested I could encrypt the documents and then email the password separately.
Excellent.
Now anyone intercepting my communications only needs to read two emails rather than one to get everything they need to impersonate me.
Let's go to a branch instead
Since my wife and I are quite fond of retaining access to our money, we decided the sensible thing was to go into a local ANZ branch and provide everything in person.
We did exactly that.
We sat down with an ANZ employee and handed over all the requested information and documentation.
Problem solved.
Or so we thought.
A couple of weeks after returning from overseas, I happened to glance at my phone and discovered that ANZ had frozen our accounts.
Apparently, we hadn't provided the information they'd requested.
We received this:
Since my wife and I are quite fond of retaining access to our money, we decided the sensible thing was to go into a local ANZ branch and provide everything in person.
We did exactly that.
We sat down with an ANZ employee and handed over all the requested information and documentation.
Problem solved.
Or so we thought.
A couple of weeks after returning from overseas, I happened to glance at my phone and discovered that ANZ had frozen our accounts.
Apparently, we hadn't provided the information they'd requested.
We received this:
From ANZ: As you haven't completed our Know Your Customer requirements, restrictions have now been placed on your accounts blocking all withdrawals, including direct debits. We're here to help...
From ANZ: As you haven't completed our Know Your Customer requirements, restrictions have now been placed on your accounts blocking all withdrawals, including direct debits. We're here to help...
Needless to say, that weekend we were very poor.
First thing Monday morning, my wife and I called ANZ.
We were told they had all the information we'd provided except my personal documents.
That was a little strange because we'd provided everything together, at the same time, to the same person, at the same branch.
Despite my better judgement, I electronically provided my passport again.
ANZ then nicely unlocked our accounts.
Yeah!
Surely that was the end of it.
Nope.
Needless to say, that weekend we were very poor.
First thing Monday morning, my wife and I called ANZ.
We were told they had all the information we'd provided except my personal documents.
That was a little strange because we'd provided everything together, at the same time, to the same person, at the same branch.
Despite my better judgement, I electronically provided my passport again.
ANZ then nicely unlocked our accounts.
Yeah!
Surely that was the end of it.
Nope.
Two weeks later...
At around 3:30pm on a Friday, another text arrived.
It was essentially the same message:
At around 3:30pm on a Friday, another text arrived.
It was essentially the same message:
From ANZ: As you haven't completed our Know Your Customer requirements, restrictions have now been placed on your accounts blocking all withdrawals, including direct debits...
From ANZ: As you haven't completed our Know Your Customer requirements, restrictions have now been placed on your accounts blocking all withdrawals, including direct debits...
I immediately called ANZ.
This time they needed to ask me a host of questions.
All of which I'd already answered.
Some on the previous phone call.
Some at the branch.
Some more than once.
So I answered them all again.
I was reassured that our accounts hadn't actually been frozen yet.
Fingers crossed.
On Monday, I called ANZ again just to make absolutely certain everything was finally sorted out.
Apparently not.
I was told that because I hadn't sent the requested legal documentation, the documentation I'd already physically handed to ANZ at the branch, it was likely our accounts would be frozen.
I went through the entire story again.
The ANZ representative then said that since I had "allegedly gone to the branch", she would contact the branch employee to try to locate my private information.
Allegedly?
I hadn't realised I was giving evidence in a court of law.
But that word got me thinking about something far more important.
Where exactly were all my documents?
I immediately called ANZ.
This time they needed to ask me a host of questions.
All of which I'd already answered.
Some on the previous phone call.
Some at the branch.
Some more than once.
So I answered them all again.
I was reassured that our accounts hadn't actually been frozen yet.
Fingers crossed.
On Monday, I called ANZ again just to make absolutely certain everything was finally sorted out.
Apparently not.
I was told that because I hadn't sent the requested legal documentation, the documentation I'd already physically handed to ANZ at the branch, it was likely our accounts would be frozen.
I went through the entire story again.
The ANZ representative then said that since I had "allegedly gone to the branch", she would contact the branch employee to try to locate my private information.
Allegedly?
I hadn't realised I was giving evidence in a court of law.
But that word got me thinking about something far more important.
Where exactly were all my documents?
They haven't lost them. They just don't know where they are.
I asked the obvious question.
"Have you lost my documents?"
I was told that ANZ hadn't lost them.
They just didn't know where they were.
I'm struggling to understand the difference.
These aren't brochures or copies of an electricity bill. We're talking about the documents ANZ itself required to establish my identity, my legal entities and my relationship with the bank.
In other words, precisely the sort of information that could be extremely useful to someone wanting to impersonate me.
I asked ANZ for the chain of custody of the documents I'd provided at the branch.
They couldn't provide one.
That concerned me far more than the inconvenience of having our accounts frozen.
I asked the obvious question.
"Have you lost my documents?"
I was told that ANZ hadn't lost them.
They just didn't know where they were.
I'm struggling to understand the difference.
These aren't brochures or copies of an electricity bill. We're talking about the documents ANZ itself required to establish my identity, my legal entities and my relationship with the bank.
In other words, precisely the sort of information that could be extremely useful to someone wanting to impersonate me.
I asked ANZ for the chain of custody of the documents I'd provided at the branch.
They couldn't provide one.
That concerned me far more than the inconvenience of having our accounts frozen.
ANZ already has secure systems
This is the part I really don't understand.
ANZ already has secure ways of communicating with customers.
In fact, ANZ has previously communicated with me through its own secure banking communication system.
ANZ also has facilities for securely exchanging documents.
Yet throughout this entire KYC process, nobody suggested using them.
Instead, I was asked to email highly sensitive documents.
When I questioned the security of email, I was told to encrypt the documents and send the password in another email.
When I chose not to do that and instead physically handed the documents to an ANZ employee, ANZ subsequently couldn't tell me where those documents were.
And then they repeatedly threatened to freeze, and actually did freeze, our accounts because they didn't have information we'd already provided.
There has to be a better way.
Why doesn't ANZ send the KYC request through its authenticated banking platform?
Why isn't there a secure upload facility attached to the request?
Why isn't there a record showing exactly when documents were received, who received them and where they're stored?
And why am I being asked to repeatedly provide the same sensitive information because different parts of the bank apparently can't find it?
For an organisation whose entire business is built around security and trust, these don't seem like unreasonable questions.
This is the part I really don't understand.
ANZ already has secure ways of communicating with customers.
In fact, ANZ has previously communicated with me through its own secure banking communication system.
ANZ also has facilities for securely exchanging documents.
Yet throughout this entire KYC process, nobody suggested using them.
Instead, I was asked to email highly sensitive documents.
When I questioned the security of email, I was told to encrypt the documents and send the password in another email.
When I chose not to do that and instead physically handed the documents to an ANZ employee, ANZ subsequently couldn't tell me where those documents were.
And then they repeatedly threatened to freeze, and actually did freeze, our accounts because they didn't have information we'd already provided.
There has to be a better way.
Why doesn't ANZ send the KYC request through its authenticated banking platform?
Why isn't there a secure upload facility attached to the request?
Why isn't there a record showing exactly when documents were received, who received them and where they're stored?
And why am I being asked to repeatedly provide the same sensitive information because different parts of the bank apparently can't find it?
For an organisation whose entire business is built around security and trust, these don't seem like unreasonable questions.
Then came the complaints
During the process, I made a number of suggestions to the various ANZ representatives about how they could improve things.
This generated a flurry of "Complaint IDs".
I didn't need to worry about them for very long.
Before long, I started receiving notifications telling me that the complaints had been resolved and closed.
That's impressive.
ANZ's complaints teams appear to have developed the remarkable ability to resolve my problems without actually talking to me.
Unfortunately, the underlying problem remained.
In my most recent conversation, the representative initially refused to tell me whether, and when, information relating to me had been recorded.
I pointed out that it was my information.
She eventually said she would contact the branch where I had "allegedly" met with an ANZ employee back in June.
She asked me for the employee's name and the branch.
I provided both.
Apparently, ANZ now needed me to tell them which ANZ employee had received the documents that ANZ was required to collect from me so that ANZ could find out what ANZ had done with them.
You really couldn't make this stuff up.
During the process, I made a number of suggestions to the various ANZ representatives about how they could improve things.
This generated a flurry of "Complaint IDs".
I didn't need to worry about them for very long.
Before long, I started receiving notifications telling me that the complaints had been resolved and closed.
That's impressive.
ANZ's complaints teams appear to have developed the remarkable ability to resolve my problems without actually talking to me.
Unfortunately, the underlying problem remained.
In my most recent conversation, the representative initially refused to tell me whether, and when, information relating to me had been recorded.
I pointed out that it was my information.
She eventually said she would contact the branch where I had "allegedly" met with an ANZ employee back in June.
She asked me for the employee's name and the branch.
I provided both.
Apparently, ANZ now needed me to tell them which ANZ employee had received the documents that ANZ was required to collect from me so that ANZ could find out what ANZ had done with them.
You really couldn't make this stuff up.
Thirty years
I've banked with ANZ for around thirty years.
That's a long relationship.
Banks spend enormous amounts of money talking about security, trust and protecting their customers.
But trust isn't something you establish with an advertising campaign.
If you ask me for highly sensitive personal and corporate information, I expect you to provide a secure way for me to give it to you.
If I physically hand that information to one of your employees, I expect you to know what happened to it.
If you don't know where it is, I expect you to take that extremely seriously.
And if you freeze my bank accounts because you don't have information I've already provided to you, multiple times, I expect someone to take ownership of the problem and fix it.
Instead, I've had repeated requests for the same information, frozen accounts, threats of further restrictions, disappearing documentation and complaints being "resolved" without anyone speaking to me.
So where to from here?
Pretty simple really.
I'm looking for a new bank.
After thirty years, it's not the fees, interest rates or products that have caused me to leave.
It's that I no longer trust ANZ to look after my information.
And for a bank, I can't think of a much bigger problem than that.
So this is how a thirty-year relationship ends...
Michael Gilmour
Tel: +61 416 240 302
I've banked with ANZ for around thirty years.
That's a long relationship.
Banks spend enormous amounts of money talking about security, trust and protecting their customers.
But trust isn't something you establish with an advertising campaign.
If you ask me for highly sensitive personal and corporate information, I expect you to provide a secure way for me to give it to you.
If I physically hand that information to one of your employees, I expect you to know what happened to it.
If you don't know where it is, I expect you to take that extremely seriously.
And if you freeze my bank accounts because you don't have information I've already provided to you, multiple times, I expect someone to take ownership of the problem and fix it.
Instead, I've had repeated requests for the same information, frozen accounts, threats of further restrictions, disappearing documentation and complaints being "resolved" without anyone speaking to me.
So where to from here?
Pretty simple really.
I'm looking for a new bank.
After thirty years, it's not the fees, interest rates or products that have caused me to leave.
It's that I no longer trust ANZ to look after my information.
And for a bank, I can't think of a much bigger problem than that.
So this is how a thirty-year relationship ends...