Preparedness for Data Breach Events Inside and Outside Your Credit Union

Transcription

1 Preparedness for Data Breach Events Inside and Outside Your Credit Union Jim McCabe, Sr. V.P. Identity Theft Services, Vero Mark Pribish, VP & ID Theft Practice Leader, Merchants Information Solutions

2 Senior Vice President, Identity Theft Services Several years of marketing ID theft solutions to auto dealers and financial co s He has established a strong expertise in ID theft and data breach solutions and now regularly blogs & composes ID Theft articles for CUwebsites and on-line publications.

3 Vice President & ID Theft Practice Leader Nationally recognized ID theft risk management expert Interviewed by major national media groups as a subject matter specialist Insights based on 24 years of experience with financial institutions

4

5 SMB s are a Prime Target Cyber-Attacks on the Rise : NSBA 2013 Study Forty-four percent say they have been the victim of a cyber-attack that s high, and really concerning, says Molly Brogan, the director of communications for the NSBA. The average cost of a single cyber-attack came to $8,669.48, which can be a big sum for a small business. Some 36 million Americans received a data breach notification in 2011 (67% increase over 2010) these people were nine times as likely to report fraud. In 2012 there was another 48% Increase over we are facing compound data breach activity (Data Per 2013 Identity Fraud Survey Report from Javelin Strategy & Research) 5

6 Businesses Handle Sensitive Information Social Security Numbers Bank/Credit Card Loan Account Information Drivers License Numbers, Birth Dates, Etc. Businesses Use , Computerized Accounting Systems Procurement Computer And Paper Files To Store Customer and Vendor Identification 2013 Verizon Data Breach Investigations Report All sizes of organizations are getting hacked and different industries affected Financial cybercrime actors typically hit smaller organizations Small businesses of 250 employees or less accounted for 31 percent of attacks 6

7 Types of Data Breaches Unintended Disclosure - sensitive information posted publicly Hacking/Malware - electronic entry via outside party, malware and spyware Payment Card Fraud - fraud with debit and credit cards such as skimming devices at point-of-service terminals Insider - someone with legitimate access intentionally breaches information Physical Loss lost, discarded or stolen non-electronic records Portable Device - lost, discarded or stolen laptop, smartphone or flash drive Stationary Device - lost, discarded or stolen stationary electronic device or server not designed for mobility. Unknown or other 7

8

9 Data Breaches 664,000,000 RECORDS BREACHED from 4,186 Data Breaches made public since 2005 Totaling 13.1 million in 2013!

10 Posted May 5, :38am Updated May 5, :45pm Affinity Gaming reports second data breach Affinity Gaming owns the off-strip Silver Sevens. (Review-Journal File Photo) By HOWARD STUTZ LAS VEGAS REVIEW-JOURNAL Casino operator Affinity Gaming reported a second breach into its system that processes customer credit and debit cards, but the Las Vegas-based company said it currently has no evidence to indicate that information was stolen. Affinity, which operates 11 casinos in four states including the off-strip Silver Sevens and the three Primm resorts, reported the breach on its website April 28. In December, Affinity said the same system had been hacked between March 14 through Oct. 16, resulting in a breach that compromised the credit information for an estimated 280,000 to 300,000 customers. We are confident that the hackers could not remove credit card data beginning in the evening of April 28, We do not have that confidence before April 28. The active investigation will probably continue for another two weeks, said Jim Prendergast, an outside attorney for Affinity. Affinity did not say how many customers might be affected the newest breach. 10

11 Common Identity Theft Crimes Include Bank Debit/Credit/Check/Loan Fraud IRS/Tax and Government Benefits Fraud Phone/Utilities Fraud Employment Fraud Cyber and Terrorism ID Theft Driver License/Passport Fraud Immigration Fraud Criminal ID Theft Fraud Child ID Theft Rental/Lease Contract Fraud 2014 Javelin Strategy & Research Report 13.1 million ID Theft victims in 2013, second highest total ever and ½ million more than 2012 This increase was driven by new account fraud which jumped 50 percent This news comes amid a cascade of hacker and data breach events 11

12 Financial Fraud Loan Fraud 2% Credit Card Fraud 13% Bank Fraud 6% TOTAL FINANCIAL FRAUD = 21% 21 % Non-Financial Fraud Phone and Utilities Fraud 10% Gov t Docs and Benefits Fraud 46% 79 % Employment-Related Fraud 5% Other Fraud 18% (Medical, Internet, Insurance, etc.) TOTAL NON-FINANCIAL FRAUD = 79% 12

13 64% of Americans fear IDENTITY THEFT More than serious health problems; more than personal safety concerns; and more than the risk of natural disasters! (2013 Travelers Insurance Consumer Risk Study) 75% of American voters are worried about their personal information being stolen by hackers, according to the Computer & Communications Industry Association (CCIA) study. Data Breaches, like the one just announced by Target Stores affecting 110+ million people, shows no sign of slowing in the upcoming year with healthcare, energy, financial services, retail and telecom industries continuing to be top targets. (per Experian 2014 Data Breach Forecast, December 2013) Tax Refund Fraud is up dramatically considered at epidemic level (per Tax Inspector General for Tax Administration Report) 13

14 Sr. Vice President, Identity Theft Services

15 It is No Longer a Matter of IF But WHEN You ll Need This Recovery & Restoration Services

16 The Outside Breach Credit Union Members At Risk Target / Neiman Marcus/ Michaels More to Come IRS Tax Fraud Epidemic Hospital Breaches: The Double Threat Member Fears & Anxieties: Financial Loss Personal Time Loss Defamation Wrongful Harassment Job Effects Family Effects 16

17 Monitoring What Does It Really Do? Credit Monitoring: Most Banks & Creditors Charge You Fees to Save Their Own Funds Monitoring Services: credit monitoring is like a smoke detector. All it will do is let you know you have a problem the downside is that credit is just part of your identity Total Financial ID theft represents less than 26% of all ID Theft Regardless of the Amount of Monitoring... There Can Be No Guarantees For The Prevention of ID Theft Millions of Advertising Dollars are Spent to Make Everyone Believe that Monitoring Prevents ID Theft. Creating A False Sense of Security \

18 What Members Really Need Is A Fail Safe Solution! ID Theft FMR Online case status portal for victim and Financial Institution If fraud is suspected, credit monitoring for 12 months Personal Recovery Advocate follow-up for one full year Progress Reports throughout Identity Restoration Creation of law enforcement-grade case file Licensed and Certified Recovery Advocate contacts victim Fully Managed Recovery Process Message to Members: WE VE GOT YOUR BACK! FOR ANY FORM OF ID THEFT OR FRAUD EVENT! Document Replacement of destroyed or stolen documents Identity Theft Threat Assessment and Recovery Plan Secure delivery (overnight or online) of fraud recovery kit 3 bureau credit reports reviewed in initial case assessment Assistance with fraud alert placement, if applicable Database searches to uncover other identity theft issues 18

19 Only The Best ID Theft Recovery Services Offer Members Fully Managed Recovery: We ve Got Your Back and More Extended 3 Generation Family Coverage Member Spouse/Partner Children Parents of the Member Allow Unknown Identity Theft Events that Occurred Prior to the Effective Date of the Plan No Proof Needed to Seek Support; All Forms of ID Theft Family Fraud Unlimited Commitment to Resolution Online 24x7x365 Access to Victim Case Status Don t Settle for Anything Less! 19

20 The Inside Breach Credit Union Risks Grow with Data Mobility Hacker Attacks: Cyber Policy Isn t Enough Malicious or Accidental: Loss of Laptop Internal threats: Employees/Customers/Servicer Institution Fears & Anxieties: Financial Loss Reputational Risk Lost Member Confidence Compliance Efforts & Cost Potential Fines, Penalties, & Lawsuits: FTC, SEC, State 20

21 Target CEO Gregg Steinhafel resigns following last year's security breach By The Associated Press May 5, :25 am NEW YORK (AP) - Target's massive data breach has now cost the company's CEO his job. Target announced Monday that Chairman, President and CEO Gregg Steinhafel is out nearly five months after the retailer disclosed the breach, which has hurt its reputation among customers and hammered its business. Experts say his departure marks the first CEO of a major corporation to resign in the wake of a data breach and underscores how CEOS are now becoming more at risk in an era when such breaches have become common. Read more: NXG Strategies LLC 21

22 Policies, Procedures, Training & Full Compliance What Does It All Guarantee? Regardless of the Amount of Best Practices in Place... There Can Be No Guarantees For The Prevention of a Data Breach Event! In These Times it is more like of WHEN, Not IF it happens!

23 Prevention & Detection: Enhance your preventive policies & procedures Enterprise Monitoring Service Continuous business monitoring of black market sites known to traffic stolen identities Suspicious activity alerts to the credit union, via and SMS text message Employee & Staff ID Theft Protection Services Fully Managed Identity Fraud Research, Remediation, and Recovery For Employee & Family Allows employees to focus on the job while the Recovery service focuses on the resolution of the identity fraud event 23

24 Mitigation & Restoration: Develop a Customized, Strong Response Program for WHEN it happens 48 Hour Breach Response Plan Follow State and Federal Compliance Notification Guidance Develop Customized Member Notification Letters Develop Employee Talking Points and FAQs Develop Call Center Scripting Develop Website Banner Messaging and Other PR needs to minimize the negative impact when new of breach is released 24

25 Crafting a Non-Interest Income Strategy Ben Rogers Research Director, Filene Research Institute Statistics show that non-interest income is essential to the continued health & sustainable growth of credit unions for the future Credit Unions must be find responsibly creative ways to generate noninterest income Member Friendly alternatives that add to the value proposition of your institution fosters the best non-interest income success Keys to Success: Transparent fees, assessed to those members who create risk, at the least expense and some kind of choice is provided Top Two (from list of15) creative ways that CU s can attract non interest income 1. Find ways to package checking accounts with upgrades 2. Identity protection offerings The Filene Research Institute is an American credit union and consumer-finance think tank headquartered in Madison, Wisconsin. 25

26 Consumer Lifestyle Financial Services Study Dr. Dan Geller, Executive Vice President, Market Rates Insight Scope of Study: Measuring bank customers and credit union members desire for lifestyle financial services Consumer lifestyle changes are redefining the role of Financial Institutions Lifestyle Financial Services will be key to success focusing on technology and the personal lifestyle needs of a new generation Major Difference: Consumers are willing to pay fee s for these lifestyle financial services while they see traditional services as entitled and should be free for doing business Two Reasons Why FI s should adapt to this transformation in new services 1. Sharp decline in service fees on traditional services 2. Growing importance of these new services in the lives of consumers Results of Research : Top Two Desired Lifestyle Services (out of 7): #1 Choice 82% of Respondents want ID Theft Alerts and will pay $3+/mo. #2 Choice 73% of Respondents want Credit Scores and will pay $3.5+/mo. Market Rates Insight was founded in 1985 as the first research service offering competitive financial market rate data online 26

27 ID Theft Solutions IDProSelect Blanket Coverage for Credit Union Employee Coverage CU Member & Family Coverage Institution Data Breach Protection Website Options to Offer Upgrades including Monitoring Includes Non-Interest Income VBiz Small Business Solution Data Breach Protection & Recovery Blanket Employee Coverage Client Coverage Option Includes Non-Interest Income THE Ultimate Safety Net When Breaches Occur! Call to Schedule Your Webex for Details 27

28 Questions & Answers 28

29 For questions or more information, please contact: Jim McCabe Sr. V.P., Identity Theft Services Vero THANK YOU! Mark Pribish Vice President & ID Theft Practice Leader Merchants Information Solutions