sd b4 suntrust fdr- letter from suntrust re request- security alert re al-shehhi 099

8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request- Security Alert Re Al-Shehhi 099

1/9

J - A . V 4 U 4 J D O U name

SunTrust Banks, Inc.P.O. Box 441 8. MaH Code 643AUanta, Georgia 30302Phone 404/588-7165Fax 404/724-3550Internet ravmond.fortinOsunfrU8t.eom

Raymond D. FortinGeneralCounsel

Fax Cover Sheet

To: Daniel Marcus 202.296.5545John Roth 202.296.5545Date: March 31,2004Pages (including cover): 9Message:See the attached response to your request for information dated March 16, 2004. We lookforward to meeting with your staff on this matter tomorrow at 2:00. We will hand-deliver thesigned original of this letter in that meeting.

The information contained in this facsimile transmission isintended only for the individual or entity namedabove and may contain information that is privileged orconfidential. If the reader ofthis message is not theintended recipient or the employee or agent responsible to deliver it to the intended recipient, you arehereby notified that any dissemination, distribution or copying of this communication isstrictly prohibited.Receipt byanyone other than the intended recipient isnot a waiver of any attorney-client orwork-productprivilege. If you have received this communication in error, please notify usimmediately. We wouldappreciate your returning the original transmission to usatthe address shown above.


2/9

14:27 hAA 4U4 724 355U SUnlTUSt BanK 1^)002SunTrust Banks, Inc.GA-Aanta-0643 Raymond D. FortinPost Office Box 4418 General CounselAtlanta, Georgia 30302Tel 404.588.7165Fax [email protected]

SUNTRUST

March 31,2004

Daniel Marcus, Esq.General CounselNational Commission on Terrorist Attacks301 7th Street, S.W.Room 5125Washington, D.C. 20407

Re: Request or InformationDear Mr. Marcus:

This letter is submitted on behalf SunTrust Banks, Inc. ("SunTrust" or "theBank") in response to your letter of March 16, 2004, requesting certain documents andinformation concerning accounts that were opened at several Florida branches ofSunTrust by 12 of the 19 September 11th hijackers. We are pleased to cooperate with theCommission in this regard.

For your convenience, we are responding to each question in the order presentedin your letter:

1. All docum ents (other than account statements) related to the June 11, 2001internal "Security Alert" concerning Marwan Al-Shehhi.Answer. As described below, the Security Alert dated June 11, 2001 was in facta routine internal notice intended to protect theBank from a financial loss related to apotential unauthorized transaction in a customer account. It did not relate in any way to asuspicion of more nefarious activity on the part of our customer.On June 11, 2001, Linda Gurney,who was employed at SunTrust's South Florida

Security Services department, issued an email "Security Alert" to all SunTrust branchmanagers in South Florida, a copy of which is attached as Tab A, The alert described anunsuccessful attempt that day by "Marwan Alshehhi",1 SunTrust Account No.0573000259772, to cash a check for $2,818.00, at the Linton Avenue branch in Del Ray,Florida. The alert indicated that there were numerous inconsistencies between addresses1 This spelling of Mr. AlsbfihM is d^ved n^m his agnature and baxid-fHiDted namefromtheaconiirtopening records of the accounthe opened on My 7,2000 at a SunTrust branch in Venice, Florida.


3/9

^31 / 2004 1 4 : 2 7 F A X 404 724 3 5 5 0 SunTrust Bank 1^1003

attributed to Alshehhi from records on file at the bank and identification documents thatwere produced at the time the check was presented. The alert also indicated that the bankhad placed a hold on his account. It warned managers in the South Florida area to"beware" of this activity in case Mr. Alshehhi attempted to cash the same check inanother branch.

A companion computerized hold was placed that day on SunTrust's electronicteller information system for one month, from June 11, 2001 to July 11, 2001 2 UnderSunTrust's computerized system, any time a teller accessed Mr. Alshehhi's accountnumber, the teller would be instructed to contact "Lisa" at SunTrust's Venice, Floridabranch, where the account was opened. Thecomputer instructions also indicated thatthere was a question aboutMr. Alshehhi's identification. The alert was deleted from thecomputerized system on June 12,2001. Over the past several days, we have been able toreconstruct both the computerized alert, attached as Tab B, and a record of its deletion, atTab C. However, we are unableto determinewho deleted the alert or why it was deleted.Factual Background

This security alert was prompted by a fairly common concern by Bank personnelthat a third party might have been attempting to conduct an unauthorized transaction on aSunTrust account. The account in question was opened as a joint account on July 7,2000, with Mr. Alshehhi and Mohamed Atta as the listed accountholders. On June 11,2001, Mr. Alshehhi came into the Linton Avenue branch of SunTrust Bank in Del Ray,Florida, and attempted to cash a check for $2,818.00 and to use the proceeds to purchasea cashier's check. According to the teller who served Mr. Alshehhi that day, BarbaraBohinek, Mr. Alshehhi indicated that he wanted to purchase the cashier's check to rent anapartment at near-by Laveres Circle, inVenice. Alshehhi was accompanied by anotherindividual, thought to be Hamza Alghamdi. Alghamdi also had an account with SunTrustat a branch in the Del Ray Beach area.

Because the check exceeded $2,000, the branch policy required the teller toverify Mr. Alshehhi's identityby reviewing two forms of identification and comparinghis signature with the signature on his signature card. The signature card could not beviewed using the bank's electronic system so either Ms. Bohinek or Shirley Clark, thebranch manager at the time, obtained a facsimile copy of the signature from the Venicebranch. Alshehhi produced a Florida driver's license and at least one other form ofidentification. The signature on the license and the signature card did not match,according to Ms. Bohinek. In addition, the addresses listed in the account and the otheridentification documents also varied, showing residential addresses inVenice, FortLauderdale and Coral Springs. When questioned about the differing addresses, Mr.Alshehhi reportedly answered that he was a frequent traveler.

2This electronic database iscalled the "stop hold caution, alert journal" It isdesigned to alert bankemployees as to irregularactivity or problems with accounts, such as accounts with insufficient funds,stolen checks, counterfeit or stolen checks, inaccurate customer addresses and the like.


4/9

T / Z U U 4 li:tl J -AA 4U4 Y 2 4 J D O U SUniTUSi: B811K 1^)004

During this time, Mr. Alshehhi was waiting in the lobby for the bank to processthe transactions. Ms. Bohinek indicated that asmuch as 20 to 25 minutes transpired,while he waited calmly and quietly. She thought this odd, given the long delay. Inaddition, she was concerned about the conflicting addresses that he had supplied and hisinsufficient explanation for them. Because of this, she consulted Ms. Clark, who alsodiscussed this matter with Alshehhi. Bohinek and Clark ultimately decided againstcashing the check and both Alshehhi and Alghamdi left the bank

Shortly thereafter, Ms. Clark called Raymond Myers, SunTrust's head of securityfor South Florida. Mr. Myers asked a co-worker, Ms. Linda Guraey, to send an alert tothe branch managers of the South Florida region in case Alshehhi attempted to cash thecheck at another SunTrust branch. This was done at approximately 12:57 p.m. Clark isno longer an employee of SunTrust. Around the same time, a computer alert was placedon the teller information system. It is not clear who placed the alert, but the practice wasfor the bank branch personnel, as opposed to the security office, to enter the informationinto the system. In addition, the bank placed a "hold" on the account.3 As indicatedabove, for some reason the 30-day alert was deleted the next day. While we do not knowthe reason for the deletion, it is possible that after further investigation and comparison ofthe signatures, it was determined that theperson who attempted to cash the check was infact authorized to conduct the transaction.

We have recently reviewed Alshehhi's account activity during this period andhave determined that he did not cash a check at anybranch at this time. Hamza's accountalso reflects no check activity for June 11th.

2. All documents created prior to September 11, 2001 (other than accountstatements) related to any suspicions concerning th e activities of theSeptember 11 hijackers.

Answer. SunTrust did not create any documents prior to September 11,2001 related toany suspicions concerning the activities of the September 11 hijackers.Factual Background

Prior to September 11, SunTrust did not have any suspicions that any of thehijackers might be involved in illegal activity, nor, based on our subsequent internalreview, was there any reason to harbor such suspicions.

After September 11,2001, SunTrust conducted a comprehensiveinternal review of the account opening documentation and financial activity of thehijackers. Despite unfortunate media reports to the contrary, this review revealed that allof the accounts were opened consistent with SunTrust's identification policies in effect at3 The "stop hold caution alert j o u r n a l code for an account hold is "H," which a p p e a r s on the journal entryfor Jane 11,2001 immediately after ihe account number for Alshehhi's account


5/9

1/2004 14:27 F A X 4 0 4 7 2 4 3550 SunTrust Bank i l O O S

the time. In each instance, the hijackers' accounts were opened only after Bankpersonnel had reviewed documents such as passports, visas, Florida drivers' licenses,and other identification documents. In manycases, copies of these source documentswere copied and placed in the account files. In addition, because these were interest-bearing accounts and the hijackers' lacked a U.S. taxpayer identification number, bankpersonnel had required each accountholder to fill out and submit to the bank an IRS W-8form.4

Personnel from the Bank and from law enforcement reviewed every deposit,withdrawal and payment conducted through the ten accounts opened by the hijackers.Interviews conducted with the hijackers by SunTrust's new account representativesindicated that each of the hijackers were students who had entered the U.S. to attendschool. Their appearance and account activity matched their stated purpose. We did notdetect a pattern oftransactions that would have indicated the true purpose of thehijackers' presence in the U.S. Neither are we aware that any representative of lawenforcement who has reviewed the facts has reached a different conclusion.

3. All documents createdprior to September 11, 200J related to any actualorcontemplated contact with any law enforcement or regulatory agencyconcerning the September 11 hijackers.Answer. SunTrust did not create any such documents prior to September 11, 2001.Factual Background

The Bank did not come incontact with any law enforcement or financialregulatory agency concerning the hijackers until after the terrorist attacks. The Bank'ssecurity office was first contacted on the afternoon of September 11, 2001. From thatmoment on, the Bank dedicated substantial resources to ensure foil cooperation with thefederal government's investigation of the attacks. The Bank turned over hundreds ofdocuments, conducted an extensive internal review and made available to the FederalBureau of Investigation numerous witnesses who had come in contact with the hijackers.

TheBank was in contact with investigators at several regional offices as well as atthe national level. Personnel from the Bank worked closely with investigators, in manycases explaining the Bank's internal operations and offering suggestions on informationthat might be of farther assistance. For example, it alerted investigators to informationcontained on the hijacker's IRS W-8 forms, it pulled copies of passports, driver'slicenses, visas and other information that were contained within the bank's account-opening files. Several SunTrust employees received a lettersof commendation from theFBI as a result of their extensive cooperation in this matter.

4 A foreign person is required to complete IRS Form W-8 BEN if he or she receives interest or otherincome from U.S. sources.


6/9

14:28 FAA 404 724 3550 SunTrust Bank 1 006

Request for Interviews with SunTrust WitnessesYour letter also asks SunTrust to designate and provide -witnesses familiar withthese issues that would agree to be interviewed by the Commission's staff. To comply,we have coordinated with John Roth of your professional staff and made arrangements tohave four of our legal and compliance staff to travel to your office in Washington, D.C.this Thursday, April 1,2004 at 2:00 p.m. The four individuals are: Raymond Fortin,General Counsel; Cathy Homa Arther, First Vice-President, Legal and RegulatoryAffairs; Laurie Pennington, Vice-President for Deposit Operations; and JohnEhrensperger, Corporate Compliance Manager.Mr. Fortin supervises all legal and compliance functions within SunTrust andoversaw the internal review. Ms. Homa Arther conducted SunTrust's internal review of

the hijackers' financial activities at the Bank following the September 11*attacks. She isfamiliar with the law enforcement investigation that ensued and she or Ms. Penningtonwere present at all of the FBI interviews ofbank personnel that took place during thegovernment's investigation. Ms. Homa Arther also oversaw the production of most ofthe account records and other evidence that were turned over to law enforcement. Ms.Pennington is familiar with the Bank's teller and deposit operations, including thecustomer identification procedures that were in place at the time, as well as afterSeptember 11,2001. Mr. Ehrensperger can provide information about complianceprogram changes that were instituted by SunTrust after September 11, 2001.

Should you have any questions about these matters, please contact me at404-588-7165.Respectfully submitted,

Raymond D. FortinGeneral Counsel

Ta b A. June 11,2001 Security Alert EmailTabB. June 11, 2001 Account AlertTab C. June 12, 2001 Deletion of Account Alertcc: John Roth, Esq.


7/9

Jl/2004 14:28 F A X 404 724 3550 SunTrust BankMar 26 04 03:28p Djinis L a w Offices 703-873-0838

1^007p.2

suHrausr B . 1 1 - 0 1

T O - . Broaches.etbfCesSaab; Wccday, nJne 3001 12:57pm5bjstt, SBCORtTY A^ERT

fittamtflIiling il mn Shirley Ci*rX, Branch Unron

, anit?

At,v p*:saft C S I B ea eti vincan O f C l M ta eun fcia isersonai cnoi < i r w r >vAte* ay'iee. ' a >ik:cM By she eUc that he had avau:e atfdruc*. vni; Adiirtsf aa Cheeks - 9Ltmanc address InJ.fXi- C or l speingj adarsss O B Iieftas4 - vne4 to chtr^f t r-ia arM- > ? k t ' > 4 Branch or ..ceoorc- Art etey conrirned wich iw ^>^ c" dijnT uc*. Acecu:.? N w z r i i e r f O S T ? O D B 2 S 9 i * 2 aait* H P U - rig. 9;\ A20-5 iO-7a- l9 -e Check In c^ anftunc f *2r9l.oa. Aiu* into this arcoor-t. ee aetd thai h


8/9

su m rust 1^1008

C D tfi R K I6ACCOUNT

SUHTHUST B A N K , BUL F COAST STOP WID CAUTIOH LERT J O UR NAL D S K D I U 6 fft/Il/Ol PME ZllSEBNW

AflOUMT, C HE W HO BE6-DATE E X P - DA TEt H I G H J -06/11/01flb/tO/01Bfi/14/48DG/16/II*06/10/DO86/11/D115/10/0117/26/01B7/Z6/10Oft/lB/Bl06/11/H06/6Z/IO

162 1Z/19/IDKirlS/ll

3351 SZ/26/tl

06/12/0106/11/BJ99/99/9999/99/99

99/99/99W/99/99

B6/IS/I11Z/11/H604/13/01OS/13/01

2Z06 1J/J8/OCB6/BB/01Ob/BB/OlD6/11/D1gs/03/gi7/26/JO16/11/016/11/01D6/11/D1OV09/U107/17/10C2/07/I1D6VOS/I116/29/1f06/IB/0106/18/fllB6/11/Q104/I1/B10/OS/01I0/2A/DU

6/2A/tlSfc/11/fllD6/11/V1J6/12/H11/13/W99/99/9999/99/9906/12/1)186/12/011Z/31/0799/99/9999/99/9*D6/11/D199/99/9906/11/81D 6/11/01D6/1Z/I106/12/0106/11/1199/99/99

K M M K W I I M I * C O M M E N T S M E S S AGE

HEME XPI RE D

MEU

H E M

CK-DATE

ATHATH TRANSACTIONCLIENT HADTUB CHECKS STOLEN - Z6lID NO T CASH US E EXTREME C A U T I O N .

DT VAT H TO *ANDREI! CRUSH PD A REVOKED 5/7/2H1ATH CARD C L OSE D DUE TO NSF/DD KTIVITTTO REOPEN CALL L I S A A T (JA* DIED OH-!?-!, VRATM T RA N SA C T I ONRE T 1UIL;PRDC ADtHt CM C 1

12/2Z/OV ACH/UFDDtl/03/-01/DX CDC/ CDA B3/01/3CB1 OTHER

LOSTLE S S ID DA TS

1Z/VZ/IO FIRST US A BAWL 12/I2/2BID LOST ZZ36AT H TRANSACTIOH . EXPIREDATH TRANSACTION EXPIREDATH TRANSACTIOH N E W

SD/lD/flt SUKTRUST BANK OTHERCHECK CARD CLO S E D DU E TO HSF/00 A CTIV ITYTO REDPEH CALL LISA AT fjftBR AUTO 96/11/11 15:07 OOB 4 Q U FB D1 S HENBR AUTO 06/11/D1 1*:*6 6STS UFJB156 N E WCONTACT LISA 9UftB4ia2 IflEMTlTT ?'S NURE T HAIL.PMC ADDR CH6SIB CA R D N E E DE D FOR VECTOR ItSK CARD NEEDED FO R VECTOR 12-ATH T RA N SA C T I Of lsie C A R D N E E D E D F D R V E C T O R 12AT H TRANSACTION -- EXPIREDAT H T RA N SA C T I ON E XPI RE DATM TRANSACTION HEMATH TRANSACTION *ER AUTO 06/B/gi 15:39 B73 U TK S IB S E X P IR E DSIG CARD NEEDED FO R VECTOR 12

TabB.June 11, 2001 Account Alert

92H E O / Z O ' d ' S O V - 1


9/9

J J . / 2 U U 4 14:28t ' A J L 4 U 4 7 2 4 355U summst

CD 44 BK 5 U N T R U S T B A N K , G U L F COAST STOP HOLD CAUTIMt UEBT JOURNAL 06/12/11 P f t G E 192ACCOUNT A M O U N T

C H 1 8 H 3 -CHECK HO BEC-BATE. EKP-PATECHIBH)

Ot-DATE "iiM CCHMEHTS "BEEKAGE

Q6/U/B104/19/B1It/12/01D6/11/11Bl/13/il01/03/H

liB9 12/27/00ISIS 12/Z7/DI

OS/11/0106/11/11171 12/?6/0176 0?/02/D1179*US 02/02/01

06/12/9106/11/1116/12/1116/12/1114/24/IQ16/11/11

731 11/12/11166 Ot/2l/l

06/12/0106/11/tl06/12/tlOK/11/fll6/l*/BO6/l*/Hl6/l*/SO06/11/01OB/1 ft/4107/26/1107/26/190/lB/tl16/11/tlB6/OZ/IV

162 1J/1S/IO03/1J/81OZ/26/01

22*646/11/11B5/D3/B1D7/26/B07/Z6/IU06/1Z/0106/11/1106/11/0116/11/113/19/ai07/17/JD16/12/112/07/11

16/1Z/*110/19/0166/13/0116/12/01il/3tt/ltI1/3D/1I16/27/01B6/Z7/0116/12/1106/12/8106/26/11BA/BZ/0104/OZ'Bl06/13/0106/12/11B6/13/I116/13/1199/99/9906/12/017/12/01lfl/21/0106/15/0106SK/B1I6/1S/11B6/12/l99/99/999V99/9999/49/99D6/1Z/H99/99/9*99/99/9999/99/99I4/U/I2lfi/12/l)12/31/0616A1S/0109/15/0108/26/016/20/>}06/1Z/0111/93/Bl99/99/9999/99/9906/1S/BJ06/12/1136/12/1107/11/1112/S1/I799/99/99

14/18/01

01/11/00

ATH TRANSACTIONDAAPT FIDELITY/INCORRECT AHT/ZJLB

TN TRANSACTIONAT M TRANSACTIONCHECK Foil 10 PURSE STOLEN IN LAC1C NEEDED C O N T A C T CUSTC K LOST IN H A IL TO ST HORTGAGE

OD/ll/00 LOST IN HA I L T D S T M D RT G A 6 EA T H TBANSA.CTIONA T H T R A N S A C T IO NI I / D O / O I LOST CHECK 171 - DO NOT CASH

ll/OO/tO LOST RAMBE OF CHECKSge/00/BB LOST CHECK - V O I D

A T H T R A N S A C T IO NA T H T R A N S A C T IO NA T M TRANSACTIONATH T R A N S A C T IO NRE T H A IL . PR D C A O W CH EATH T R A N S A C T IO N

12/21/00 B E IC O INSURA NC E!i/Zl/ZlM LOST03/29/01 LOST CHECK P A Y A B L E T D V E R I Z O N18 AUTO B6/12/B1 15:13 15?

sd b4 suntrust fdr- letter from suntrust re request- security alert re al-shehhi 099

Documents