Westpac partner Concentrix accused of mishandling customers’ data

Key Westpac outsourcing partner accused of allowing serious security breaches and unauthorised access to the bank’s data.

Regulators are taking a keen interest in outsouring arragements by banks. Picture AAP

Global outsourcing group Concentrix, which counts Westpac as a key local client, has been accused of serious breaches of data security and handling, which may have put thousands of bank customers’ information at risk.

A statutory declaration sighted by The Australian, and written by a former insider, raises a number of alarming issues at Concentrix. The declaration outlines concern about breaches of Concentrix’s client security requirements, lax handling of confidential data and documents, a lack of robust physical office security and unauthorised use of staff logins.

“The above-mentioned conduct led to serious banking data security breaches and unauthorised login access to Westpac confidential documentation,” the declaration said. It noted “wilful misconduct” by Concentrix staff who were managing a number of functions for Westpac, including mortgage processing.

After fielding questions by The Australian, Concentrix country manager Peter Monk said the company didn’t comment on client programs.

A Westpac spokeswoman said the bank engaged “specialist partners” when it required additional capability alongside existing services and with certain business functions.

“This includes using an overseas partner to assist with administrative tasks, like mortgage processing,” she added.

“Our customers can be assured that we take safety and security extremely seriously and that we have robust processes and mechanisms in place to help protect their information. This includes no overseas data storage facility with this provider.

“In the majority of cases, our customers will interact with a Westpac Group employee here in Australia when visiting a branch, contacting our call centre or engaging with a lender.” The bank spokeswoman did not directly address the specific allegations.

A proportion of Concentrix’s functions for Westpac are conducted in The Philippines and India and the US-based company also has offices in Australia. The contractual arrangements — worth hundreds of millions of dollars — between the bank and Concentrix have in the past also spanned areas including call centres and collections.

Concerns about Westpac’s outsourcing arrangements come as the bank navigates legal action by the financial crime regulator over 23 million alleged breaches of the law. Included in the Austrac case, which accused the bank of “indifference” over its anti-money laundering obligations, are claims Westpac facilitated payments linked to child exploitation.

The latest allegations may have wide-ranging ramifications for other Concentrix customers including Air New Zealand and Centrelink, which awarded the outsourcing and business services group an Australian government contract in 2018 to manage call centres. Concentrix also won a government tender process in 2019 to deliver the National Relay Service for three years. The service allows people who are deaf, have a speech impediment or are hard of hearing to make and receive phone calls.

It’s not the first time Concentrix has been embroiled in controversy. In the United Kingdom in 2016 it suffered a large data protection breach and was also in hot water for incorrectly administering a tax credit program for the British government.

Concentrix had been hired to assess potential fraud and errors in welfare benefits through the UK tax credits system, but incorrectly withdrew credits from hundreds of people. The work was then stripped from Concentrix and taken in-house by HM Revenue and Customs.

A year ago, tech heavyweight Apple stopped work by Concentrix at a customer service centre in Auckland, New Zealand which looked after English speakers in the Asia-Pacific region. That came after Apple cancelled the contract with Concentrix.

Still, the outsourcing company has been Air New Zealand’s contact centre partner for more than six years and in 2019 won the airline’s customer commitment award. It acknowledged a supplier who made an “outstanding contribution” to Air New Zealand’s customer experience.

Concentrix is part of New York-listed SYNNEX Corporation which last month announced a plan to split into two companies, comprising Concentrix and SYNNEX Technology Solutions. Outsourcing has become more common at domestic banks in the past decade as they have looked to cut costs. Westpac, like several of its big bank rivals, outsources a range of functions to external providers.

Last year, Westpac sealed a contract with outsourcing group Genpact covering “know your customer” services, which are aimed at properly verifying customers.

Regulators have also taken a keen interest in how financial services firms are monitoring outsourcing arrangements.

The Australian Prudential Regulation Authority oversees the prudential standard which states all outsourcing arrangements involving material business activities are subject to “appropriate due diligence, approval and ongoing monitoring”.

“All risks arising from outsourcing material business activities must be appropriately managed to ensure that the APRA-regulated institution, or the group it heads, is able to meet its financial and service obligations to its depositors and/or policyholders.”

On the Austrac legal action, Westpac and the regulator are working toward a statement of agreed facts and the bank is undertaking various reviews of accountability. That includes establishing an independent panel to make recommendations to Westpac on board risk governance and accountability.

The Austrac legal case led to the exit of Westpac CEO Brian Hartzer.

Do you know more? [e-mail]