8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
1/9
J - A . V 4 U 4 J D O U name
SunTrust Banks, Inc.P.O. Box 441 8. MaH Code 643AUanta, Georgia30302Phone 404/588-7165Fax 404/724-3550Internetravmond.fortinOsunfrU8t.eom
Raymond D. FortinGeneralCounsel
Fax Cover Sheet
To: Daniel Marcus 202.296.5545John Roth 202.296.5545Date: March31,2004Pages (including cover): 9Message:See the attached responseto your request for information dated March 16, 2004. Welookforward to meeting with your staff on this matter tomorrow at2:00. We will hand-deliver thesigned original of this letter inthat meeting.
The information contained in this facsimile transmissionisintended only for the individual or entity namedabove and maycontain information that is privileged orconfidential. If thereader ofthis message is not theintended recipient or the employeeor agent responsible to deliver it to the intended recipient, youarehereby notified that any dissemination, distribution or copyingof this communication isstrictly prohibited.Receipt byanyone otherthan the intended recipient isnot a waiver of any attorney-clientorwork-productprivilege. If you have received this communication inerror, please notify usimmediately. We wouldappreciate yourreturning the original transmission to usatthe address shownabove.
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
2/9
14:27 hAA 4U4 724 355U SUnlTUSt BanK 1^)002SunTrust Banks,Inc.GA-Aanta-0643 Raymond D. FortinPost Office Box 4418 GeneralCounselAtlanta, Georgia 30302Tel 404.588.7165Fax[emailprotected]
SUNTRUST
March 31,2004
Daniel Marcus, Esq.General CounselNational Commission onTerrorist Attacks301 7th Street, S.W.Room 5125Washington, D.C.20407
Re: Request or InformationDear Mr. Marcus:
This letter is submitted on behalf SunTrust Banks, Inc.("SunTrust" or "theBank") in response to your letter of March 16,2004, requesting certain documents andinformation concerningaccounts that were opened at several Florida branches ofSunTrust by12 of the 19 September 11th hijackers. We are pleased to cooperatewith theCommission in this regard.
For your convenience, we are responding to each question in theorder presentedin your letter:
1. All docum ents (other than account statements) related to theJune 11, 2001internal "Security Alert" concerning MarwanAl-Shehhi.Answer. As described below, the Security Alert dated June11, 2001 was in facta routine internal notice intended to protecttheBank from a financial loss related to apotential unauthorizedtransaction in a customer account. It did not relate in any way toasuspicion of more nefarious activity on the part of ourcustomer.On June 11, 2001, Linda Gurney,who was employed atSunTrust's South Florida
Security Services department, issued an email "Security Alert"to all SunTrust branchmanagers in South Florida, a copy of which isattached as Tab A, The alert described anunsuccessful attempt thatday by "Marwan Alshehhi",1 SunTrust Account No.0573000259772, tocash a check for $2,818.00, at the Linton Avenue branch in DelRay,Florida. The alert indicated that there were numerousinconsistencies between addresses1 This spelling of Mr. AlsbfihM isd^ved n^m his agnature and baxid-fHiDted namefromtheaconiirtopeningrecords of the accounthe opened on My 7,2000 at a SunTrust branchin Venice, Florida.
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
3/9
^31 / 2004 1 4 : 2 7 F A X 404 724 3 5 5 0 SunTrust Bank1^1003
attributed to Alshehhi from records on file at the bank andidentification documents thatwere produced at the time the checkwas presented. The alert also indicated that the bankhad placed ahold on his account. It warned managers in the South Florida areato"beware" of this activity in case Mr. Alshehhi attempted to cashthe same check inanother branch.
A companion computerized hold was placed that day on SunTrust'selectronicteller information system for one month, from June 11,2001 to July 11, 2001 2 UnderSunTrust's computerized system, anytime a teller accessed Mr. Alshehhi's accountnumber, the tellerwould be instructed to contact "Lisa" at SunTrust's Venice,Floridabranch, where the account was opened. Thecomputerinstructions also indicated thatthere was a question aboutMr.Alshehhi's identification. The alert was deleted fromthecomputerized system on June 12,2001. Over the past several days,we have been able toreconstruct both the computerized alert,attached as Tab B, and a record of its deletion, atTab C. However,we are unableto determinewho deleted the alert or why it wasdeleted.Factual Background
This security alert was prompted by a fairly common concern byBank personnelthat a third party might have been attempting toconduct an unauthorized transaction on aSunTrust account. Theaccount in question was opened as a joint account on July 7,2000,with Mr. Alshehhi and Mohamed Atta as the listed accountholders. OnJune 11,2001, Mr. Alshehhi came into the Linton Avenue branch ofSunTrust Bank in Del Ray,Florida, and attempted to cash a check for$2,818.00 and to use the proceeds to purchasea cashier's check.According to the teller who served Mr. Alshehhi that day,BarbaraBohinek, Mr. Alshehhi indicated that he wanted to purchasethe cashier's check to rent anapartment at near-by Laveres Circle,inVenice. Alshehhi was accompanied by anotherindividual, thought tobe Hamza Alghamdi. Alghamdi also had an account with SunTrustat abranch in the Del Ray Beach area.
Because the check exceeded $2,000, the branch policy requiredthe teller toverify Mr. Alshehhi's identityby reviewing two formsof identification and comparinghis signature with the signature onhis signature card. The signature card could not beviewed using thebank's electronic system so either Ms. Bohinek or Shirley Clark,thebranch manager at the time, obtained a facsimile copy of thesignature from the Venicebranch. Alshehhi produced a Floridadriver's license and at least one other form ofidentification. Thesignature on the license and the signature card did notmatch,according to Ms. Bohinek. In addition, the addresses listedin the account and the otheridentification documents also varied,showing residential addresses inVenice, FortLauderdale and CoralSprings. When questioned about the differing addresses, Mr.Alshehhireportedly answered that he was a frequent traveler.
2This electronic database iscalled the "stop hold caution, alertjournal" It isdesigned to alert bankemployees as toirregularactivity or problems with accounts, such as accounts withinsufficient funds,stolen checks, counterfeit or stolen checks,inaccurate customer addresses and the like.
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
4/9
T / Z U U 4 li:tl J -AA 4U4 Y 2 4 J D O U SUniTUSi: B811K1^)004
During this time, Mr. Alshehhi was waiting in the lobby for thebank to processthe transactions. Ms. Bohinek indicated that asmuchas 20 to 25 minutes transpired,while he waited calmly and quietly.She thought this odd, given the long delay. Inaddition, she wasconcerned about the conflicting addresses that he had supplied andhisinsufficient explanation for them. Because of this, sheconsulted Ms. Clark, who alsodiscussed this matter with Alshehhi.Bohinek and Clark ultimately decided againstcashing the check andboth Alshehhi and Alghamdi left the bank
Shortly thereafter, Ms. Clark called Raymond Myers, SunTrust'shead of securityfor South Florida. Mr. Myers asked a co-worker, Ms.Linda Guraey, to send an alert tothe branch managers of the SouthFlorida region in case Alshehhi attempted to cash thecheck atanother SunTrust branch. This was done at approximately 12:57 p.m.Clark isno longer an employee of SunTrust. Around the same time, acomputer alert was placedon the teller information system. It isnot clear who placed the alert, but the practice wasfor the bankbranch personnel, as opposed to the security office, to enter theinformationinto the system. In addition, the bank placed a "hold"on the account.3 As indicatedabove, for some reason the 30-dayalert was deleted the next day. While we do not knowthe reason forthe deletion, it is possible that after further investigation andcomparison ofthe signatures, it was determined that theperson whoattempted to cash the check was infact authorized to conduct thetransaction.
We have recently reviewed Alshehhi's account activity duringthis period andhave determined that he did not cash a check atanybranch at this time. Hamza's accountalso reflects no checkactivity for June 11th.
2. All documents created prior to September 11, 2001 (other thanaccountstatements) related to any suspicions concerning th eactivities of theSeptember 11 hijackers.
Answer. SunTrust did not create any documents prior to September11,2001 related toany suspicions concerning the activities of theSeptember 11 hijackers.Factual Background
Prior to September 11, SunTrust did not have any suspicions thatany of thehijackers might be involved in illegal activity, nor,based on our subsequent internalreview, was there any reason toharbor such suspicions.
After September 11,2001, SunTrust conducted acomprehensiveinternal review of the account opening documentationand financial activity of thehijackers. Despite unfortunate mediareports to the contrary, this review revealed that allof theaccounts were opened consistent with SunTrust's identificationpolicies in effect at3 The "stop hold caution alert j o u r n a lcode for an account hold is "H," which a p p e a r s on the journalentryfor Jane 11,2001 immediately after ihe account number forAlshehhi's account
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
5/9
1/2004 14:27 F A X 4 0 4 7 2 4 3550 SunTrust Bank i l O O S
the time. In each instance, the hijackers' accounts were openedonly after Bankpersonnel had reviewed documents such as passports,visas, Florida drivers' licenses,and other identificationdocuments. In manycases, copies of these source documentswerecopied and placed in the account files. In addition, because thesewere interest-bearing accounts and the hijackers' lacked a U.S.taxpayer identification number, bankpersonnel had required eachaccountholder to fill out and submit to the bank an IRSW-8form.4
Personnel from the Bank and from law enforcement reviewed everydeposit,withdrawal and payment conducted through the ten accountsopened by the hijackers.Interviews conducted with the hijackers bySunTrust's new account representativesindicated that each of thehijackers were students who had entered the U.S. to attendschool.Their appearance and account activity matched their stated purpose.We did notdetect a pattern oftransactions that would have indicatedthe true purpose of thehijackers' presence in the U.S. Neither arewe aware that any representative of lawenforcement who has reviewedthe facts has reached a different conclusion.
3. All documents createdprior to September 11, 200J related toany actualorcontemplated contact with any law enforcement orregulatory agencyconcerning the September 11 hijackers.Answer.SunTrust did not create any such documents prior to September 11,2001.Factual Background
The Bank did not come incontact with any law enforcement orfinancialregulatory agency concerning the hijackers until after theterrorist attacks. The Bank'ssecurity office was first contacted onthe afternoon of September 11, 2001. From thatmoment on, the Bankdedicated substantial resources to ensure foil cooperation withthefederal government's investigation of the attacks. The Bankturned over hundreds ofdocuments, conducted an extensive internalreview and made available to the FederalBureau of Investigationnumerous witnesses who had come in contact with the hijackers.
TheBank was in contact with investigators at several regionaloffices as well as atthe national level. Personnel from the Bankworked closely with investigators, in manycases explaining theBank's internal operations and offering suggestions oninformationthat might be of farther assistance. For example, italerted investigators to informationcontained on the hijacker's IRSW-8 forms, it pulled copies of passports, driver'slicenses, visasand other information that were contained within the bank'saccount-opening files. Several SunTrust employees received alettersof commendation from theFBI as a result of their extensivecooperation in this matter.
4 A foreign person is required to complete IRS Form W-8 BEN ifhe or she receives interest or otherincome from U.S. sources.
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
6/9
14:28 FAA 404 724 3550 SunTrust Bank 1 006
Request for Interviews with SunTrust WitnessesYour letter alsoasks SunTrust to designate and provide -witnesses familiarwiththese issues that would agree to be interviewed by theCommission's staff. To comply,we have coordinated with John Roth ofyour professional staff and made arrangements tohave four of ourlegal and compliance staff to travel to your office in Washington,D.C.this Thursday, April 1,2004 at 2:00 p.m. The four individualsare: Raymond Fortin,General Counsel; Cathy Homa Arther, FirstVice-President, Legal and RegulatoryAffairs; Laurie Pennington,Vice-President for Deposit Operations; and JohnEhrensperger,Corporate Compliance Manager.Mr. Fortin supervises all legal andcompliance functions within SunTrust andoversaw the internalreview. Ms. Homa Arther conducted SunTrust's internal review of
the hijackers' financial activities at the Bank following theSeptember 11*attacks. She isfamiliar with the law enforcementinvestigation that ensued and she or Ms. Penningtonwere present atall of the FBI interviews ofbank personnel that took place duringthegovernment's investigation. Ms. Homa Arther also oversaw theproduction of most ofthe account records and other evidence thatwere turned over to law enforcement. Ms.Pennington is familiar withthe Bank's teller and deposit operations, including thecustomeridentification procedures that were in place at the time, as wellas afterSeptember 11,2001. Mr. Ehrensperger can provide informationabout complianceprogram changes that were instituted by SunTrustafter September 11, 2001.
Should you have any questions about these matters, pleasecontact me at404-588-7165.Respectfully submitted,
Raymond D. FortinGeneral Counsel
Ta b A. June 11,2001 Security Alert EmailTabB. June 11, 2001Account AlertTab C. June 12, 2001 Deletion of Account Alertcc: JohnRoth, Esq.
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
7/9
Jl/2004 14:28 F A X 404 724 3550 SunTrust BankMar 26 04 03:28pDjinis L a w Offices 703-873-0838
1^007p.2
suHrausr B . 1 1 - 0 1
T O - . Broaches.etbfCesSaab; Wccday, nJne 3001 12:57pm5bjstt,SBCORtTY A^ERT
fittamtflIiling il mn Shirley Ci*rX, Branch Unron
, anit?
At,v p*:saft C S I B ea eti vincan O f C l M ta eun fciaisersonai cnoi < i r w r >vAte* ay'iee. ' a >ik:cM By sheeUc that he had avau:e atfdruc*. vni; Adiirtsf aa Cheeks - 9Ltmancaddress InJ.fXi- C or l speingj adarsss O B Iieftas4 - vne4 tochtr^f t r-ia arM- > ? k t ' > 4 Branch or ..ceoorc- Art eteyconrirned wich iw ^>^ c" dijnT uc*. Acecu:.? N w z r i i e r f OS T ? O D B 2 S 9 i * 2 aait* H P U - rig. 9;\ A20-5 iO-7a- l9 -eCheck In c^ anftunc f *2r9l.oa. Aiu* into this arcoor-t. ee aetdthai h
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
8/9
su m rust 1^1008
C D tfi R K I6ACCOUNT
SUHTHUST B A N K , BUL F COAST STOP WID CAUTIOH LERT J O UR NALD S K D I U 6 fft/Il/Ol PME ZllSEBNW
AflOUMT, C HE W HO BE6-DATE E X P - DA TEt H I G H J-06/11/01flb/tO/01Bfi/14/48DG/16/II*06/10/DO86/11/D115/10/0117/26/01B7/Z6/10Oft/lB/Bl06/11/H06/6Z/IO
162 1Z/19/IDKirlS/ll
3351 SZ/26/tl
06/12/0106/11/BJ99/99/9999/99/99
99/99/99W/99/99
B6/IS/I11Z/11/H604/13/01OS/13/01
2Z061J/J8/OCB6/BB/01Ob/BB/OlD6/11/D1gs/03/gi7/26/JO16/11/016/11/01D6/11/D1OV09/U107/17/10C2/07/I1D6VOS/I116/29/1f06/IB/0106/18/fllB6/11/Q104/I1/B10/OS/01I0/2A/DU
6/2A/tlSfc/11/fllD6/11/V1J6/12/H11/13/W99/99/9999/99/9906/12/1)186/12/011Z/31/0799/99/9999/99/9*D6/11/D199/99/9906/11/81D6/11/01D6/1Z/I106/12/0106/11/1199/99/99
K M M K W I I M I * C O M M E N T S M E S S AGE
HEME XPI RE D
MEU
H E M
CK-DATE
ATHATH TRANSACTIONCLIENT HADTUB CHECKS STOLEN - Z6lID NO T CASHUS E EXTREME C A U T I O N .
DT VAT H TO *ANDREI! CRUSH PD A REVOKED 5/7/2H1ATH CARD C L OSED DUE TO NSF/DD KTIVITTTO REOPEN CALL L I S A A T (JA* DIEDOH-!?-!, VRATM T RA N SA C T I ONRE T 1UIL;PRDC ADtHt CM C 1
12/2Z/OV ACH/UFDDtl/03/-01/DX CDC/ CDA B3/01/3CB1 OTHER
LOSTLE S S ID DA TS
1Z/VZ/IO FIRST US A BAWL 12/I2/2BID LOST ZZ36AT H TRANSACTIOH .EXPIREDATH TRANSACTION EXPIREDATH TRANSACTIOH N E W
SD/lD/flt SUKTRUST BANK OTHERCHECK CARD CLO S E D DU E TO HSF/00A CTIV ITYTO REDPEH CALL LISA AT fjftBR AUTO 96/11/11 15:07 OOB 4 QU FB D1 S HENBR AUTO 06/11/D1 1*:*6 6STS UFJB156 N E WCONTACT LISA9UftB4ia2 IflEMTlTT ?'S NURE T HAIL.PMC ADDR CH6SIB CA R D N E E DED FOR VECTOR ItSK CARD NEEDED FO R VECTOR 12-ATH T RA N SA C T I Oflsie C A R D N E E D E D F D R V E C T O R 12AT H TRANSACTION --EXPIREDAT H T RA N SA C T I ON E XPI RE DATM TRANSACTION HEMATHTRANSACTION *ER AUTO 06/B/gi 15:39 B73 U TK S IB S E X P IR E DSIGCARD NEEDED FO R VECTOR 12
TabB.June 11, 2001 Account Alert
92H E O / Z O ' d ' S O V - 1
8/14/2019 SD B4 Suntrust Fdr- Letter From Suntrust Re Request-Security Alert Re Al-Shehhi 099
9/9
J J . / 2 U U 4 14:28t ' A J L 4 U 4 7 2 4 355U summst
CD 44 BK 5 U N T R U S T B A N K , G U L F COAST STOP HOLDCAUTIMt UEBT JOURNAL 06/12/11 P f t G E 192ACCOUNT A M O U N T
C H 1 8 H 3 -CHECK HO BEC-BATE. EKP-PATECHIBH)
Ot-DATE "iiM CCHMEHTS "BEEKAGE
Q6/U/B104/19/B1It/12/01D6/11/11Bl/13/il01/03/H
liB9 12/27/00ISIS 12/Z7/DI
OS/11/0106/11/11171 12/?6/0176 0?/02/D1179*US 02/02/01
06/12/9106/11/1116/12/1116/12/1114/24/IQ16/11/11
731 11/12/11166 Ot/2l/l
06/12/0106/11/tl06/12/tlOK/11/fll6/l*/BO6/l*/Hl6/l*/SO06/11/01OB/1ft/4107/26/1107/26/190/lB/tl16/11/tlB6/OZ/IV
162 1J/1S/IO03/1J/81OZ/26/01
22*646/11/11B5/D3/B1D7/26/B07/Z6/IU06/1Z/0106/11/1106/11/0116/11/113/19/ai07/17/JD16/12/112/07/11
16/1Z/*110/19/0166/13/0116/12/01il/3tt/ltI1/3D/1I16/27/01B6/Z7/0116/12/1106/12/8106/26/11BA/BZ/0104/OZ'Bl06/13/0106/12/11B6/13/I116/13/1199/99/9906/12/017/12/01lfl/21/0106/15/0106SK/B1I6/1S/11B6/12/l99/99/999V99/9999/49/99D6/1Z/H99/99/9*99/99/9999/99/99I4/U/I2lfi/12/l)12/31/0616A1S/0109/15/0108/26/016/20/>}06/1Z/0111/93/Bl99/99/9999/99/9906/1S/BJ06/12/1136/12/1107/11/1112/S1/I799/99/99
14/18/01
01/11/00
ATH TRANSACTIONDAAPT FIDELITY/INCORRECT AHT/ZJLB
TN TRANSACTIONAT M TRANSACTIONCHECK Foil 10 PURSE STOLEN INLAC1C NEEDED C O N T A C T CUSTC K LOST IN H A IL TO STHORTGAGE
OD/ll/00 LOST IN HA I L T D S T M D RT G A 6 EA T HTBANSA.CTIONA T H T R A N S A C T IO NI I / D O / O I LOST CHECK171 - DO NOT CASH
ll/OO/tO LOST RAMBE OF CHECKSge/00/BB LOST CHECK - V O I D
A T H T R A N S A C T IO NA T H T R A N S A C T IO NA T MTRANSACTIONATH T R A N S A C T IO NRE T H A IL . PR D C A O W CHEATH T R A N S A C T IO N
12/21/00 B E IC O INSURA NC E!i/Zl/ZlM LOST03/29/01 LOST CHECK PA Y A B L E T D V E R I Z O N18 AUTO B6/12/B1 15:13 15?
![SD B4 Suntrust Fdr- Letter From Suntrust Re Request- Security Alert Re Al-Shehhi 099 - [PDF Document] (2024)](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/h8AAvMB+NzmkbcAAAAASUVORK5CYII=)