Superior Mortgage Corp

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF SUPERIOR MORTGAGE CORP.

CONSENT ORDER, ETC., IN REGARD TO ALLEGED VIOLATIONS OF SEC. 5 OF THE FEDERAL TRADE COMMISSION ACT Docket C-4153; File No. 0523136 Complaint, December 14, 2005--Decision, December 14, 2005 This consent order, among other things, prohibits Respondent Superior Mortgage Corp., a New Jersey mortgage lender, from misrepresenting the extent to which it maintains and protects the privacy, confidentiality, or security of any personal information collected from or about consumers, and from violating the Safeguards Rule. The consent order also requires the respondent, for ten years, to secure biennial assessments and reports to ensure that its security program complies with the Safeguards Rule and is sufficiently effective to provide reasonable assurance that the security, confidentiality, and integrity of personal information is protected.

Participants For the Commission: Laura Mazzarella, Molly K. Crawford, Jessica L. Rich, Joel Winston and Louis Silversin. For the Respondent: Phillip Schulman, Kirkpatrick, Lockhart, Nicholson & Graham LLP COMPLAINT The Federal Trade Commission (“Commission”), having reason to believe that Superior Mortgage Corp. has violated the provisions of the Commission’s Standards for Safeguarding Customer Information Rule (“Safeguards Rule”), 16 C.F.R. Part 314, issued pursuant to Title V of the Gramm-Leach-Bliley Act (“GLB Act”), 15 U.S.C. ' 6801 et seq., and the provisions of the Federal Trade Commission Act, and it appearing to the Commission that this proceeding is in the public interest, alleges: 1. Respondent Superior Mortgage Corp. (“Superior Mortgage”) is a New Jersey corporation with its principal office or place of business at 1395 Route 539, Tuckerton, New Jersey 08087. In VOLUME 140 Complaint addition to conducting business from its headquarters location in Tuckerton, Superior Mortgage conducts business through forty (40) branch offices located in ten different states, as well as through six separate websites.

2. Respondent is a direct lender that specializes in residential mortgage loans. As such, it is a “financial institution,” as that term is defined in Section 509(3)(A) of the GLB Act, and is therefore subject to the requirements of the Safeguards Rule. 3. The acts and practices of respondent alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act, 15 U.S.C. ' 44. SAFEGUARDS RULE 4. The Safeguards Rule, which implements Section 501(b) of the GLB Act, was promulgated by the Commission on May 23, 2002, and became effective on May 23, 2003. The Rule requires financial institutions to protect the security, confidentiality, and integrity of customer information by developing a comprehensive written information security program that contains reasonable administrative, technical, and physical safeguards, including:

A. Designating one or more employees to coordinate the information security program;

B. Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and assessing the sufficiency of any safeguards in place to control those risks; C. Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the safeguards’ key controls, systems, and procedures; VOLUME 140 Complaint D. Overseeing service providers, and requiring them by contract to protect the security and confidentiality of customer information; and E. Evaluating and adjusting the information security program in light of the results of testing and monitoring, changes to the business operation, and other relevant circumstances. VIOLATIONS OF THE SAFEGUARDS RULE 5. Through its offices and websites, respondent has collected sensitive customer information in connection with the mortgage application process, including customer names, Social Security numbers, credit histories, and bank and credit card account numbers. Since the Rule’s effective date until at least May 2005, respondent failed to implement reasonable policies and procedures to protect the security and confidentiality of the information it collects. 6. For example, respondent failed to (a) assess risks to its customer information until more than a year after the Rule’s effective date; (b) institute appropriate password policies to control access to company systems and documents containing sensitive customer information; and (c) encrypt or otherwise protect sensitive customer information before sending it by email. Respondent also failed to take reasonable steps to ensure that its service providers were providing appropriate security for customer information and addressing known security risks in a timely fashion.

7. By failing to implement reasonable security policies and procedures, respondent engaged in violations of the Safeguards Rule, including but not limited to:

A. Failing to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information;

VOLUME 140 Complaint B. Failing to design and implement information safeguards to control the risks to customer information and failing to regularly test and monitor them; and C. Failing to oversee service providers to ensure that they implement safeguards to protect respondent’s customer information.

8. A violation of the Safeguards Rule constitutes an unfair or deceptive act or practice in violation of Section 5(a)(1) of the FTC Act.

VIOLATIONS OF THE FTC ACT 9. Since at least 2002, respondent has collected personal information from consumers through its Online Application Form at www.supmort.com. Since at least 2003, respondent has operated five additional websites that collect personal information from consumers by linking them to the Online Application Form. This online form serves as an initial step for many consumers seeking a loan through respondent. 10. The Online Application Form collects from consumers personal information, including, but not limited to, name, address, date of birth, Social Security number, credit history, and bank and credit card account numbers. 11. Since at least 2002, respondent has disseminated or caused to be disseminated on www.supmort.com the following statement regarding the privacy and confidentiality of personal information collected through respondent’s website:

All information submitted is handled by SSL encryption see the yellow padlock at the bottom of your browser. Exhibit A (Superior Mortgage webpage dated October 25, 2004).

VOLUME 140 Complaint 12. Through the means described in paragraph 11, respondent has represented, expressly or by implication, that the personal information it obtained from consumers through www.supmort.com was encrypted using SSL from the time of submission until receipt by respondent. 13. In truth and in fact, the personal information obtained from consumers through www.supmort.com was not encrypted using SSL from the time of submission until it was received by respondent. Instead, respondent encrypted sensitive personal information only while it was being transmitted between a visitor’s web browser and the website’s server (using SSL); once the information reached the server, it was decrypted and emailed to respondent’s headquarters and branch offices in clear, readable text. Therefore, the representation set forth in paragraph 12 was false or misleading.

14. The acts and practices of respondent as alleged in this complaint constitute unfair or deceptive acts or practices, in or affecting commerce, in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this 14th day of December, 2005, has issued this complaint against respondent.

Superior Mortgage Page 1 of:

{ Superior Mortgage Our St ess 1s Built On Service © first.

For your convenience we've provided this Online Application Form. If you prefer, we can mail (or e-mail) you a form that may be completed offline. If you have any questions, please call the office number provided at the bottom of this page to speak to one of our helpful loan consultants. After completing this form, you will be presented with a disclosure statement in which you must acknowledge reading, else your application WILL NOT be submitted to Superior Mortgage. (AN in ion submitted is handied by SSL encryption - see the yellow padiock at the bottom of your browser) Borrower information Borrower Name: First: | MI: | Last: | Daytime Phone (with area code): 1- Evening Phone (with area code): 1- 2 1 22 0 0 0 412 1378 526 40 -1 3 1 22 1 0 0 412 1378 526 40 -1 4 1 22 1 1 0 412 1378 526 40 -1 5 1 22 1 1 1 412 1381 68 31 95.675201 Cells 1 22 1 1 2 497 1381 120 30 96.393150 Phones 1 22 1 1 3 632 1378 83 40 96.288940 (with5 1 22 1 1 4 731 1387 80 23 96.616913 areas 1 22 1 1 5 826 1378 112 40 96.282875 code):2 1 23 0 0 0 135 1451 164 39 -1 3 1 23 1 0 0 135 1451 164 39 -1 4 1 23 1 1 0 135 1451 164 39 -1 5 1 23 1 1 1 135 1451 69 38 96.727287 Sites 1 23 1 1 2 219 1452 80 38 96.938492 Map2 1 24 0 0 0 401 1475 1980 18 -1 3 1 24 1 0 0 401 1475 1980 18 -1 4 1 24 1 1 0 401 1475 1980 18 -1 5 1 24 1 1 1 401 1475 1980 18 95.000000 2 1 25 0 0 0 536 1495 405 9 -1 3 1 25 1 0 0 536 1495 405 9 -1 4 1 25 1 1 0 536 1495 405 9 -1 5 1 25 1 1 1 536 1495 405 9 95.000000 2 1 26 0 0 0 536 1554 402 5 -1 3 1 26 1 0 0 536 1554 402 5 -1 4 1 26 1 1 0 536 1554 402 5 -1 5 1 26 1 1 1 536 1554 402 5 95.000000 2 1 27 0 0 0 63 1503 1868 201 -1 3 1 27 1 0 0 63 1503 1868 203 -1 4 1 27 1 1 0 63 1503 1862 62 -1 5 1 27 1 1 1 63 1554 16 11 0.000000 -5 1 27 1 1 2 412 1503 131 54 59.046112 Streets 1 27 1 1 3 1607 1516 82 32 95.812416 Owns 1 27 1 1 4 1720 1512 30 28 75.644119 ©5 1 27 1 1 5 1782 1516 85 31 96.395645 Rents 1 27 1 1 6 1895 1512 30 30 46.024712 ©4 1 27 1 2 0 76 1563 1855 73 -1 5 1 27 1 2 1 76 1623 37 9 0.000000 “5 1 27 1 2 2 412 1587 80 40 80.591461 City:5 1 27 1 2 3 536 1576 7 53 80.591461 |5 1 27 1 2 4 882 1589 2 24 24.230553 _5 1 27 1 2 5 944 1585 104 32 94.786964 State:5 1 27 1 2 6 1231 1627 36 4 91.474915 CO5 1 27 1 2 7 1306 1581 52 45 0.000000 ¥)5 1 27 1 2 8 1606 1590 20 32 93.073837 #5 1 27 1 2 9 1641 1590 36 32 96.758789 of5 1 27 1 2 10 1688 1563 108 73 94.820244 Years:5 1 27 1 2 11 1817 1567 11 65 94.820244 |5 1 27 1 2 12 1918 1578 13 52 73.029976 |4 1 27 1 3 0 78 1623 1356 31 -1 5 1 27 1 3 1 78 1623 173 30 85.858566 REVERSE4 1 27 1 4 0 76 1640 1359 64 -1 5 1 27 1 4 1 76 1659 242 30 77.232506 MORTGAGES5 1 27 1 4 2 411 1659 66 39 96.915268 Zip:5 1 27 1 4 3 945 1657 84 31 96.353661 Dates 1 27 1 4 4 1043 1656 35 32 96.353661 of5 1 27 1 4 5 1091 1657 93 31 96.814842 Birth:5 1 27 1 4 6 1215 1640 191 64 70.349213 |mm/dd/yy2 1 28 0 0 0 414 1714 158 66 -1 3 1 28 1 0 0 414 1714 158 66 -1 4 1 28 1 1 0 414 1714 158 66 -1 5 1 28 1 1 1 414 1727 110 45 95.325104 Email:5 1 28 1 1 2 532 1714 40 66 24.418266 ia2 1 29 0 0 0 536 1567 349 9 -1 3 1 29 1 0 0 536 1567 349 9 -1 4 1 29 1 1 0 536 1567 349 9 -1 5 1 29 1 1 1 536 1567 349 9 95.000000 2 1 30 0 0 0 536 1628 346 2 -1 3 1 30 1 0 0 536 1628 346 2 -1 4 1 30 1 1 0 536 1628 346 2 -1 5 1 30 1 1 1 536 1628 346 2 95.000000 2 1 31 0 0 0 54 1544 1310 166 -1 3 1 31 1 0 0 54 1544 1310 166 -1 4 1 31 1 1 0 54 1544 1310 166 -1 5 1 31 1 1 1 54 1544 324 166 95.000000 5 1 31 1 1 2 1211 1564 153 74 95.000000 2 1 32 0 0 0 536 1712 533 7 -1 3 1 32 1 0 0 536 1712 533 7 -1 4 1 32 1 1 0 536 1712 533 7 -1 5 1 32 1 1 1 536 1712 533 7 95.000000 2 1 33 0 0 0 401 1781 1981 16 -1 3 1 33 1 0 0 401 1781 1981 16 -1 4 1 33 1 1 0 401 1781 1981 16 -1 5 1 33 1 1 1 401 1781 1981 16 95.000000 2 1 34 0 0 0 1253 1800 408 7 -1 3 1 34 1 0 0 1253 1800 408 7 -1 4 1 34 1 1 0 1253 1800 408 7 -1 5 1 34 1 1 1 1253 1800 408 7 95.000000 2 1 35 0 0 0 794 1801 93 62 -1 3 1 35 1 0 0 794 1801 93 62 -1 4 1 35 1 1 0 794 1801 93 62 -1 5 1 35 1 1 1 794 1801 93 62 95.000000 2 1 36 0 0 0 413 1814 825 52 -1 3 1 36 1 0 0 413 1806 847 60 -1 4 1 36 1 1 0 413 1814 825 52 -1 5 1 36 1 1 1 413 1818 72 32 96.816559 Self5 1 36 1 1 2 497 1816 207 42 34.468880 Employed?)5 1 36 1 1 3 724 1815 70 47 83.964592 Yes5 1 36 1 1 4 809 1828 3 26 0.000000 -5 1 36 1 1 5 1019 1814 219 52 96.950752 Occupation:2 1 37 0 0 0 711 1872 441 7 -1 3 1 37 1 0 0 711 1872 441 7 -1 4 1 37 1 1 0 711 1872 441 7 -1 5 1 37 1 1 1 711 1872 441 7 95.000000 2 1 38 0 0 0 414 1875 303 62 -1 3 1 38 1 0 0 414 1875 303 62 -1 4 1 38 1 1 0 414 1875 303 62 -1 5 1 38 1 1 1 414 1875 184 59 95.881798 Employer:2 1 39 0 0 0 411 1963 1219 179 -1 3 1 39 1 0 0 411 1944 1219 198 -1 4 1 39 1 1 0 411 1963 1219 44 -1 5 1 39 1 1 1 411 1963 23 31 93.269875 #5 1 39 1 1 2 447 1963 35 31 96.246986 of5 1 39 1 1 3 493 1963 118 31 95.329071 Years:5 1 39 1 1 4 1019 1967 109 32 96.654144 Social5 1 39 1 1 5 1144 1967 149 40 93.200020 Security5 1 39 1 1 6 1306 1967 32 31 93.200020 #:4 1 39 1 2 0 412 2079 472 63 -1 5 1 39 1 2 1 412 2103 109 31 96.401390 Gross5 1 39 1 2 2 537 2102 143 39 95.866524 Monthly5 1 39 1 2 3 697 2102 132 31 96.811539 Incomes 1 39 1 2 4 844 2099 14 37 47.441101 $5 1 39 1 2 5 877 2079 7 63 73.455856 |2 1 40 0 0 0 411 2171 1318 109 -1 3 1 40 1 0 0 411 2151 1318 129 -1 4 1 40 1 1 0 411 2171 1318 43 -1 5 1 40 1 1 1 411 2175 90 31 96.517326 Totals 1 40 1 1 2 518 2174 107 40 96.300819 Liquids 1 40 1 1 3 640 2174 123 31 92.753113 Assets5 1 40 1 1 4 779 2173 10 40 92.579041 (5 1 40 1 1 5 805 2174 129 31 96.673920 includes 1 40 1 1 6 948 2174 95 36 96.448029 cash,5 1 40 1 1 7 1060 2174 90 31 96.592636 banks 1 40 1 1 8 1162 2175 176 35 95.943199 accounts,5 1 40 1 1 9 1354 2173 69 39 93.062019 etc)5 1 40 1 1 10 1437 2171 21 37 92.928764 $4 1 40 1 2 0 1093 2243 595 37 -1 5 1 40 1 2 1 1093 2244 306 36 96.191223 Co-Borrowers 1 40 1 2 2 1416 2243 272 37 73.509888 information2 1 41 0 0 0 412 2306 1282 68 -1 3 1 41 1 0 0 412 2306 1282 68 -1 4 1 41 1 1 0 412 2306 1282 68 -1 5 1 41 1 1 1 412 2332 255 31 96.025406 Co-Borrowers 1 41 1 1 2 680 2330 122 32 96.428207 Name:5 1 41 1 1 3 844 2329 87 31 95.693802 First:5 1 41 1 1 4 946 2306 7 64 96.615173 |5 1 41 1 1 5 1339 2324 53 50 94.364708 MI:5 1 41 1 1 6 1586 2307 86 67 96.323708 Last:5 1 41 1 1 7 1687 2311 7 57 96.323708 |2 1 42 0 0 0 412 2423 680 48 -1 3 1 42 1 0 0 412 2423 680 48 -1 4 1 42 1 1 0 412 2423 680 48 -1 5 1 42 1 1 1 412 2425 151 40 96.481697 Daytime5 1 42 1 1 2 578 2425 117 30 96.481697 Phones 1 42 1 1 3 710 2424 84 39 95.836357 (with5 1 42 1 1 4 810 2432 80 23 96.478088 areas 1 42 1 1 5 905 2423 112 40 93.183586 code):5 1 42 1 1 6 1040 2431 32 30 46.118164 1-5 1 42 1 1 7 1085 2442 7 29 95.323776 |2 1 43 0 0 0 96 2000 198 30 -1 3 1 43 1 0 0 96 2000 198 30 -1 4 1 43 1 1 0 96 2000 198 30 -1 5 1 43 1 1 1 96 2001 48 24 91.440659 sites 1 43 1 1 2 153 2001 99 29 93.252296 design:5 1 43 1 1 3 266 2000 28 28 92.967484 E-2 1 44 0 0 0 401 2058 1983 18 -1 3 1 44 1 0 0 401 2058 1983 18 -1 4 1 44 1 1 0 401 2058 1983 18 -1 5 1 44 1 1 1 401 2058 1983 18 95.000000 2 1 45 0 0 0 401 2219 1983 16 -1 3 1 45 1 0 0 401 2219 1983 16 -1 4 1 45 1 1 0 401 2219 1983 16 -1 5 1 45 1 1 1 401 2219 1983 16 95.000000 2 1 46 0 0 0 401 2288 1984 16 -1 3 1 46 1 0 0 401 2288 1984 16 -1 4 1 46 1 1 0 401 2288 1984 16 -1 5 1 46 1 1 1 401 2288 1984 16 95.000000 2 1 47 0 0 0 1687 2304 353 7 -1 3 1 47 1 0 0 1687 2304 353 7 -1 4 1 47 1 1 0 1687 2304 353 7 -1 5 1 47 1 1 1 1687 2304 353 7 95.000000 2 1 48 0 0 0 401 2372 1984 18 -1 3 1 48 1 0 0 401 2372 1984 18 -1 4 1 48 1 1 0 401 2372 1984 18 -1 5 1 48 1 1 1 401 2372 1984 18 95.000000 2 1 49 0 0 0 1086 2405 630 9 -1 3 1 49 1 0 0 1086 2405 630 9 -1 4 1 49 1 1 0 1086 2405 630 9 -1 5 1 49 1 1 1 1086 2405 630 9 95.000000 2 1 50 0 0 0 1143 2467 462 3 -1 3 1 50 1 0 0 1143 2467 462 3 -1 4 1 50 1 1 0 1143 2467 462 3 -1 5 1 50 1 1 1 1143 2467 462 3 95.000000 2 1 51 0 0 0 1085 2478 632 9 -1 3 1 51 1 0 0 1085 2478 632 9 -1 4 1 51 1 1 0 1085 2478 632 9 -1 5 1 51 1 1 1 1085 2478 632 9 95.000000 2 1 52 0 0 0 413 2486 679 56 -1 3 1 52 1 0 0 413 2486 679 56 -1 4 1 52 1 1 0 413 2486 679 56 -1 5 1 52 1 1 1 413 2498 145 39 96.586937 Evenings 1 52 1 1 2 576 2497 117 31 96.808632 Phones 1 52 1 1 3 707 2496 84 39 97.004723 (with5 1 52 1 1 4 806 2504 82 24 96.074532 areas 1 52 1 1 5 903 2496 111 39 93.198944 code):5 1 52 1 1 6 1039 2482 26 64 42.022114 4-5 1 52 1 1 7 1075 2486 17 56 82.092499 |2 1 53 0 0 0 401 2563 1985 16 -1 3 1 53 1 0 0 401 2563 1985 16 -1 4 1 53 1 1 0 401 2563 1985 16 -1 5 1 53 1 1 1 401 2563 1985 16 95.000000 2 1 54 0 0 0 534 2582 404 7 -1 3 1 54 1 0 0 534 2582 404 7 -1 4 1 54 1 1 0 534 2582 404 7 -1 5 1 54 1 1 1 534 2582 404 7 95.000000 2 1 55 0 0 0 534 2654 348 6 -1 3 1 55 1 0 0 534 2654 348 6 -1 4 1 55 1 1 0 534 2654 348 6 -1 5 1 55 1 1 1 534 2654 348 6 95.000000 2 1 56 0 0 0 1197 2650 172 70 -1 3 1 56 1 0 0 1197 2650 172 70 -1 4 1 56 1 1 0 1197 2650 172 70 -1 5 1 56 1 1 1 1197 2650 172 70 95.000000 2 1 57 0 0 0 399 2813 1988 17 -1 3 1 57 1 0 0 399 2813 1988 17 -1 4 1 57 1 1 0 399 2813 1988 17 -1 5 1 57 1 1 1 399 2813 1988 17 95.000000 2 1 58 0 0 0 1350 2842 410 9 -1 3 1 58 1 0 0 1350 2842 410 9 -1 4 1 58 1 1 0 1350 2842 410 9 -1 5 1 58 1 1 1 1350 2842 410 9 95.000000 2 1 59 0 0 0 697 2840 161 70 -1 3 1 59 1 0 0 697 2840 161 70 -1 4 1 59 1 1 0 697 2840 161 70 -1 5 1 59 1 1 1 697 2840 161 70 95.000000 2 1 60 0 0 0 1363 2903 392 3 -1 3 1 60 1 0 0 1363 2903 392 3 -1 4 1 60 1 1 0 1363 2903 392 3 -1 5 1 60 1 1 1 1363 2903 392 3 95.000000 2 1 61 0 0 0 701 2925 442 8 -1 3 1 61 1 0 0 701 2925 442 8 -1 4 1 61 1 1 0 701 2925 442 8 -1 5 1 61 1 1 1 701 2925 442 8 95.000000 2 1 62 0 0 0 407 2588 1567 401 -1 3 1 62 1 0 0 409 2588 1565 213 -1 4 1 62 1 1 0 411 2588 1531 58 -1 5 1 62 1 1 1 411 2588 149 58 20.230499 Street:|5 1 62 1 1 2 1623 2602 83 31 95.771667 Owns 1 62 1 1 3 1736 2598 30 29 89.673416 ©5 1 62 1 1 4 1798 2602 85 31 94.614510 Rents 1 62 1 1 5 1912 2598 30 28 37.905540 ©4 1 62 1 2 0 407 2625 1567 96 -1 5 1 62 1 2 1 407 2668 83 51 96.766205 City:5 1 62 1 2 2 941 2671 104 31 96.423943 State:5 1 62 1 2 3 1292 2667 43 40 21.997322 +5 1 62 1 2 4 1645 2676 23 31 57.704727 #5 1 62 1 2 5 1681 2675 36 32 96.440567 of5 1 62 1 2 6 1728 2676 118 30 95.888321 Years:5 1 62 1 2 7 1857 2625 117 96 10.394424 Cc4 1 62 1 3 0 409 2729 984 64 -1 5 1 62 1 3 1 409 2754 65 39 96.854950 Zip:5 1 62 1 3 2 754 2737 71 44 46.381931 |5 1 62 1 3 3 942 2730 84 30 96.118027 Dates 1 62 1 3 4 1041 2729 35 31 96.118027 of5 1 62 1 3 5 1089 2730 93 30 96.724251 Birth:5 1 62 1 3 6 1212 2737 181 56 35.850082 mm/ddiyy3 1 62 2 0 0 410 2834 807 52 -1 4 1 62 2 1 0 410 2834 807 52 -1 5 1 62 2 1 1 410 2834 72 52 96.694084 Self5 1 62 2 1 2 1155 2861 62 12 0.000000 _3 1 62 3 0 0 411 2850 946 74 -1 4 1 62 3 1 0 411 2850 806 74 -1 5 1 62 3 1 1 411 2883 204 41 96.115341 Employed?5 1 62 3 1 2 997 2850 220 57 96.754875 Occupation:3 1 62 4 0 0 411 2932 296 57 -1 4 1 62 4 1 0 411 2932 296 57 -1 5 1 62 4 1 1 411 2933 182 55 96.764984 Employer:2 1 63 0 0 0 408 3014 1219 44 -1 3 1 63 1 0 0 408 2998 1219 63 -1 4 1 63 1 1 0 408 3014 1219 44 -1 5 1 63 1 1 1 408 3015 23 31 93.295372 #5 1 63 1 1 2 444 3015 35 31 94.974541 of5 1 63 1 1 3 490 3015 116 31 94.974541 Years:5 1 63 1 1 4 996 3014 109 31 96.559601 Social5 1 63 1 1 5 1122 3014 150 39 92.042679 Security5 1 63 1 1 6 1285 3014 31 31 90.239609 #:2 1 64 0 0 0 398 3065 1989 16 -1 3 1 64 1 0 0 398 3065 1989 16 -1 4 1 64 1 1 0 398 3065 1989 16 -1 5 1 64 1 1 1 398 3065 1989 16 95.000000 2 1 65 0 0 0 2368 1049 25 2069 -1 3 1 65 1 0 0 2368 1049 25 2069 -1 4 1 65 1 1 0 2368 1049 25 2069 -1 5 1 65 1 1 1 2368 1049 25 2069 95.000000 2 1 66 0 0 0 398 1053 13 2067 -1 3 1 66 1 0 0 398 1053 13 2067 -1 4 1 66 1 1 0 398 1053 13 2067 -1 5 1 66 1 1 1 398 1053 13 2067 95.000000 2 1 67 0 0 0 51 3174 2423 49 -1 3 1 67 1 0 0 51 3174 2423 49 -1 4 1 67 1 1 0 51 3174 2423 49 -1 5 1 67 1 1 1 51 3175 979 48 90.442078 https://www.supmort.com/branches/loanapp.cfm5 1 67 1 1 2 2263 3174 211 37 76.423447 10/25/200¢2 1 68 0 0 0 328 3291 1482 6 -1 3 1 68 1 0 0 328 3291 1482 6 -1 4 1 68 1 1 0 328 3291 1482 6 -1 5 1 68 1 1 1 328 3291 1482 6 95.000000 Gross Monthly Income $ [ Total Liquid Assets ( include cash, bank accounts, etc) $ Property Information Purchase Price: $| Type of Loan: {Purchase Property Type: |Single Family Home Tyo |Primary Additional Property Information:

Loan Amount: $ | Property Street Address: | City:

Have you been working with a Realtor®? If yes, please supply: Realtor Name: | Agency Name:

Have you spoken to or been referred to a Superior Mortgage Loan Consultant? If yes, please supply his or her name: | Please help us serve our clients better! How did you hear about Superior Mortgage? |!nternet Search Engine _ if you chose Other above, please specify: | Misc. Information How would you like to be contacted? Please Choose One: Email to contact:

Before completing this form, please read the Superior Mortgage Page 3 of :

Fax 1-609-294-0717 https://www.supmort.com/branches/loanapp.cfm 10/25/200« VOLUME 140 Decision and Order DECISION AND ORDER The Federal Trade Commission having initiated an investigation of certain acts and practices of the respondent named in the caption hereof, and respondent having been furnished thereafter with a copy of a draft Complaint that the Bureau of Consumer Protection proposed to present to the Commission for its consideration and which, if issued by the Commission, would charge Respondent with violations of the Federal Trade Commission Act, 15 U.S.C. § 45 et seq. and the Federal Trade Commission’s Standards for Safeguarding Customer Information Rule (“Safeguards Rule”), 16 C.F.R. Part 314, issued pursuant to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq.; and Respondent, its attorney, and counsel for the Commission having thereafter executed an Agreement Containing Consent Order (“Consent Agreement”), an admission by respondent of all the jurisdictional facts set forth in the aforesaid draft Complaint, a statement that the signing of said Consent Agreement is for settlement purposes only and does not constitute an admission by respondent that the law has been violated as alleged in such Complaint, or that the facts as alleged in such Complaint, other than jurisdictional facts, are true, and waivers and other provisions as required by the Commission’s Rules; and The Commission having thereafter considered the matter and having determined that it has reason to believe respondent has violated the said Act and Rule, and that a Complaint should issue stating its charges in that respect, and having thereupon accepted the executed Consent Agreement and placed such Consent Agreement on the public record for a period of thirty (30) days, and having duly considered the comments filed thereafter by interested persons pursuant to Section 2.34 of its Rules, now in further conformity with the procedure described in Section 2.34 of its Rules, the Commission hereby issues its Complaint, makes the following jurisdictional findings and enters the following Order: VOLUME 140 Decision and Order 1. Respondent Superior Mortgage Corp. is a New Jersey corporation with its principal office or place of business at 1395 Route 539, Tuckerton, New Jersey 08087. 2. The Federal Trade Commission has jurisdiction of the subject matter of this proceeding and of Respondent, and the proceeding is in the public interest.

ORDER DEFINITIONS For purposes of this order, the following definitions shall apply:

1. “Personal information” shall mean individually identifiable information from or about an individual consumer including, but not limited to: (a) a first and last name; (b) a home or other physical address, including street name and name of city or town; (c) an email address or other online contact information, such as an instant messaging user identifier or a screen name that reveals an individual’s email address; (d) a telephone number; (e) a Social Security number; (f) a credit history; (g) a bank or credit card account number; or (h) any other information from or about an individual consumer that is combined with (a) through (g) above. 2. “Commerce” shall mean as defined in Section 4 of the Federal Trade Commission Act, 15 U.S.C. § 44. 3. Unless otherwise specified, “respondent” shall mean Superior Mortgage Corp., its successors and assigns and its officers, agents, representatives, and employees. 4. All other terms are synonymous in meaning and equal in scope to the usage of such terms in the Gramm-Leach-Bliley Act, 15 U.S.C. § 6801 et seq.

VOLUME 140 Decision and Order I.

IT IS ORDERED that respondent, directly or through any corporation, subsidiary, division, or other device, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service, in or affecting commerce, shall not misrepresent in any manner, expressly or by implication, (a) the extent to which personal information submitted by consumers through respondent’s websites is protected by SSL encryption, or (b) the extent to which respondent maintains and protects the privacy, confidentiality, or security of any personal information collected from or about consumers.

II.

IT IS FURTHER ORDERED that respondent shall not, directly or through any corporation, subsidiary, division, website, or other device, violate any provision of the Gramm-Leach-Bliley Act’s (“GLB Act”) Standards for Safeguarding Customer Information Rule (“Safeguards Rule”), 16 C.F.R. Part 314. In the event the Safeguards Rule is hereafter amended or modified, respondent’s compliance with this Rule as so amended or modified shall not be a violation of this order. III.

IT IS FURTHER ORDERED that, in connection with its compliance with the Safeguards Rule, respondent shall obtain an assessment and report (an “Assessment”) from a qualified, objective, independent third-party professional, using procedures and standards generally accepted in the profession, within one hundred and eighty (180) days after service of the order, and biennially thereafter for ten (10) years after service of the order, that:

VOLUME 140 Decision and Order A. sets forth the specific administrative, technical, and physical safeguards that respondent has implemented and maintained during the reporting period; B. explains how such safeguards are appropriate to respondent’s size and complexity, the nature and scope of respondent’s activities, and the sensitivity of the nonpublic personal information collected from or about consumers; C. explains how such safeguards meet or exceed the protections required by the Safeguards Rule; and D. certifies that respondent’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of nonpublic personal information is protected and, for biennial reports, has so operated throughout the reporting period. Each Assessment shall be prepared by a person qualified as a Certified Information System Security Professional (CISSP); a person qualified as a Certified Information Systems Auditor (CISA); a person holding Global Information Assurance Certification (GIAC) from the SysAdmin, Audit, Network, Security Institute (SANS); or by a similarly qualified person or organization approved by the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission. Respondent shall provide the first Assessment, as well as all plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, whether prepared by or on behalf of respondent, relied upon to prepare such Assessment to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580, within ten (10) days after the Assessment has been prepared. Respondent shall retain all subsequent biennial Assessments until the order is terminated and shall retain all materials relied upon in preparing each such Assessment, as listed above, for a period of three (3) years after the date of preparation of such Assessment. VOLUME 140 Decision and Order Respondent shall provide such subsequent Assessments and related materials to the Associate Director of Enforcement within ten (10) days of request.

IV.

IT IS FURTHER ORDERED that respondent shall deliver a copy of this order to all current and future principals, officers, directors, and managers, and to all current and future employees, agents, and representatives having supervisory responsibilities with respect to the subject matter of this order. Respondent shall deliver this order to such current personnel within thirty (30) days after the date of service of this order, and to such future personnel within thirty (30) days after the person assumes such position or responsibilities.

V.

IT IS FURTHER ORDERED that respondent shall notify the Commission at least thirty (30) days prior to any change in the corporation that may affect compliance obligations arising under this order, including, but not limited to, a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this order; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporation about which respondent learns less than thirty (30) days prior to the date such action is to take place, respondent shall notify the Commission as soon as is practicable after obtaining such knowledge. All notices required by this Part shall be sent by certified mail to the Associate Director, Division of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, Washington, D.C. 20580.

VOLUME 140 Decision and Order VI.

IT IS FURTHER ORDERED that respondent shall within one hundred eighty (180) days after service of this order, and at such other times as the Federal Trade Commission may require, file with the Commission a report, in writing, setting forth in detail the manner and form in which it has complied with this order. This report shall include a copy of the initial biennial Assessment required by Part III of this order.

VII.

This order will terminate twenty (20) years from the date of its issuance, or twenty (20) years from the most recent date that the United States or the Federal Trade Commission files a complaint (with or without an accompanying consent decree) in federal court alleging any violation of the order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of:

A. Any Part in this order that terminates in less than twenty (20) years;

B. This order’s application to any respondent that is not named as a defendant in such complaint; and C. This order if such complaint is filed after the order has terminated pursuant to this Part.

Provided, further, that if such complaint is dismissed or a federal court rules that the respondent did not violate any provision of the order, and the dismissal or ruling is either not appealed or upheld on appeal, then the order will terminate according to this Part as though the complaint had never been filed, except that the order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

VOLUME 140 Analysis Analysis of Proposed Consent Order to Aid Public Comment The Federal Trade Commission has accepted a consent agreement, subject to final approval, from Superior Mortgage Corp. (“Superior Mortgage”). Superior Mortgage is a mortgage lender specializing in residential mortgage loans with headquarters in Tuckerton, New Jersey. Superior Mortgage collects sensitive customer information, including customer names, Social Security numbers, credit histories, and bank and credit card account numbers, and is a “financial institution” subject to the Gramm- Leach-Bliley Act’s Standards for Safeguarding Customer Information Rule, 16 C.F.R. Part 314 (“Safeguards Rule”). The proposed consent order has been placed on the public record for thirty (30) days for receipt of comments by interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received and will decide whether it should withdraw from the agreement and take other appropriate action or make final the agreement’s proposed order. This matter concerns Superior Mortgage’s alleged violations of the Safeguards Rule, as well as alleged security misrepresentations to consumers on Superior Mortgage’s website. The Safeguards Rule, which became effective on May 23, 2003, requires financial institutions to implement reasonable policies and procedures to ensure the security and confidentiality of customer information, including:

• Designating one or more employees to coordinate the information security program;

• Identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and assessing the sufficiency of any safeguards in place to control those risks;

• Designing and implementing information safeguards to control the risks identified through risk assessment, and regularly testing or otherwise monitoring the effectiveness of the VOLUME 140 Analysis safeguards’ key controls, systems, and procedures; • Overseeing service providers, and requiring them by contract to protect the security and confidentiality of customer information; and • Evaluating and adjusting the information security program in light of the results of testing and monitoring, changes to the business operation, and other relevant circumstances. The Commission’s complaint alleges that Superior Mortgage failed to implement the protections required by the Safeguards Rule and, specifically, that it failed to: (1) assess risks to its customer information until more than a year after the Safeguard Rule’s effective date; (2) institute appropriate password policies to control access to company systems and documents containing sensitive customer information; (3) encrypt or otherwise protect sensitive customer information before sending it by email; and (4) take reasonable steps to ensure that its service providers were providing appropriate security for customer information and addressing known security risks in a timely fashion. The complaint also alleges that Superior Mortgage violated Section 5 of the Federal Trade Commission Act (“FTC Act”) by representing that the personal information it obtained from consumers through www.supmort.com was encrypted using SSL from the time of submission until receipt by Superior Mortgage, when in fact that information was encrypted only while it was being transmitted between a visitor’s web browser and the website’s server (using SSL); once the information reached the server, it was decrypted and emailed to Superior Mortgage’s headquarters and branch offices in clear, readable text. The proposed order contains provisions designed to prevent Superior Mortgage from future practices similar to those alleged in the complaint. Specifically, Part I of the proposed order prohibits Superior Mortgage from misrepresenting the extent to which it maintains and protects the privacy, confidentiality, or security of any personal information collected from or about consumers. Part II of the proposed order prohibits Superior VOLUME 140 Analysis Mortgage from violating the Safeguards Rule. Part III of the proposed order requires that Superior Mortgage obtain, within 180 days after being served with the final order approved by the Commission, and on a biennial basis thereafter for ten (10) years, an assessment and report from a qualified, objective, independent third-party professional, certifying that: (1) Superior Mortgage has in place a security program that provides protections that meet or exceed the protections required by the Safeguards Rule, and (2) Superior Mortgage’s security program is operating with sufficient effectiveness to provide reasonable assurance that the security, confidentiality, and integrity of nonpublic personal information has been protected. This provision is substantially similar to comparable provisions obtained in prior Commission orders under the Safeguards Rule and Section 5 of the FTC Act. See, e.g., Sunbelt Lending Servs., Inc., FTC Docket No. C-4129 (Jan. 7, 2005); Tower Records, FTC Docket No. C-4110 (June 2, 2004). Part III of the proposed order also requires Superior Mortgage to retain documents relating to compliance. For the assessments and supporting documents, Superior Mortgage must retain the documents for three (3) years after the date that each assessment is prepared.

Parts IV through VII of the proposed order are reporting and compliance provisions. Part IV requires dissemination of the order now and in the future to persons with supervisory responsibilities. Part V ensures notification to the FTC of changes in corporate status. Part VI mandates that Superior Mortgage submit compliance reports to the FTC. Part VII is a provision “sunsetting” the order after twenty (20) years, with certain exceptions.

The purpose of this analysis is to facilitate public comment on the proposed order. It is not intended to constitute an official interpretation of the proposed order or to modify its terms in any way.

VOLUME 140 Complaint