A Thought Leadership Spotlight September 2014 Commissioned By LifeLock Privacy, Identity, And Security: A Spotlight On How Financial Services Firms Can Help Protect Customer Identity Results Focusing On Financial Services Companies From The Thought Leadership Paper Privacy, Identity, And Security: The Growing Risks Of Failing To Protect Personal Identity, July 2014 Introduction In February 2014, LifeLock commissioned Forrester Consulting to study the consumer attitudes, behaviors, and exposures related to identity theft. Forrester analyzed this data to develop a hypothesis about the correlation of digital life activities (e.g., the kinds of services consumers use, the types of information they share online, and the kinds of connected devices they own) and security behaviors both online and offline (e.g., locking their devices, using strong passwords, and shredding sensitive documents) in order to score consumers across a continuum of identity theft risk. To further explore these issues, this Spotlight focuses on identity security and its impact on financial services companies. When we narrow the focus to financial services companies, our key findings are that: Financial identity theft is the No. 1 form of identity theft. Consumers are commensurately worried about financial identity theft. Consumers take some steps to protect their financial data. 2014, Forrester Research, Inc. All rights reserved.
1 Empowered Consumers Demand Better Data Protection In today s increasingly digital world, individuals are perpetually connected and increasingly share their lives online. But this new reality also comes with new risks. Every interaction, communication, and touchpoint creates a digital breadcrumb: a piece of data that can put people at greater risk of identity theft. That s why firms must take greater steps to protect customer data and have a strong risk mitigation plan in case of a data breach. We have entered an era where an organization s most valuable asset is its ability to anticipate and serve its customers at their moment of need. We call this the age of the customer. Individuals are more empowered than ever, and they demand access and convenience on the go and without friction. But these demands also increase the risk of identity theft. The key issues affecting identity protection include: The proliferation of devices that generate and collect data, which puts us at greater risk. Consumers are hyperconnected over 64% of them use three or more connected devices today. And each of those devices is collecting and storing potentially identifiable information. Frequently, these devices store more information via apps, for example than users realize. This trend is only on the upswing as new technologies like wearables and connected home devices proliferate and gain mainstream adoption. The increasing use of online services that collect our data. These services, such as cloud storage, ephemeral messaging, and financial planning and online banking tools, are popular because they offer unique value. Unfortunately, however, these tools are only as secure as the weakest security element, and that is frequently the password their customers use to access them. An increase in risky behaviors in exchange for recognition and convenience. Our research found that only 38% of consumers avoid using conveniences like autologin on the websites they use, while 35% of respondents do not use different passwords for different online accounts. These behaviors make it easier for individuals to lead their digital lives, but they also increase the risk of identity theft: When one password is breached, for example, thieves have a much greater chance of accessing the individual s other accounts. Financial Services Firms Should Help Customers Protect Their Identity Financial firms face some of the strongest data security and protection requirements in the country: PCI, Gramm-Leach- Bliley, and other regulations help ensure that firms are keeping customer identities safe. However, many of the tools and services that customers use may not take data protection as seriously, and consumers don t often protect their financial data and identities as well as they should. We found that: Financial identity theft is the No. 1 form of identity theft. Of the individuals who ve been victims of identity fraud or theft, 54% experienced financial fraud (e.g., credit card used to make fraudulent purchases, funds withdrawn from a bank account), while 28% experienced credit-related fraud (e.g., identity used to fraudulently acquire a credit card, car loan, and/or other type of loan). Consumers are commensurately worried about financial identity theft. Fifty-two percent and 49% of respondents are concerned about financial and credit fraud as the result of identity theft, respectively. Forty percent worry about their security when they use a credit card online, 35% worry when they pay bills online, and 38% worry when they do banking activities online such as checking balances or trading stocks. These concerns outweigh concerns about nearly all other forms of identity theft. Consumers take some steps to protect their financial data. For example, 71% believe it is important to review their credit card and bank statements every month, while 62% continue to shred sensitive financial paperwork before disposing of it. Meanwhile, over a third (36%) have opted out of receiving prescreened credit offers, and most limit their use of online
2 personal financial management services. And, of the individuals who use some form of identity protection service, 23% are using one provided by their bank or credit card company as a benefit. Consumers use digital banking tools despite the inherent risks in doing so. Despite their awareness of the risks of digital conveniences, individuals still want to use them. For example, 71% pay their bills online at least monthly, while fully three-quarters use online banking services like stock trading and funds transfer at least monthly, which increases their risk by 11%. Nearly 10% use online personal financial management services, which means they are sharing the user names and logins to all their financial accounts with those services.
3 Key Recommendations It s clear that identity theft is a problem on the rise. First, criminals are getting smarter, and they re better able to operate at scale. Second, consumers haven t yet gotten used to the idea of protecting their data and identity in the new digital world. Financial services firms should help their customers be better protected and reduce their risk by: Educating their customers about the real risks of identity theft. Our data shows that individuals who have a cavalier attitude about identity theft are, not surprisingly, at a greater risk. In fact, those who don t believe that online security is worth worrying about are nearly six times Iess safe than the US average, while those who believe they ought to concern themselves with identity theft are nearly 30% less likely to experience identity theft than the US average. Taking a personal interest in and ownership of identity makes a difference, and financial institutions are ideally suited to engage their customers in an ongoing dialogue about how their clients can help reduce the risk of fraud losses due to identity theft. Leveraging new tools for securing all customer data. Your customers want to interact with you digitally. But that means more opportunities for your data to be breached, even when it s out of your control. Consider using tools like two-factor authentication (46% of consumers choose the option whenever it s offered) and deactivating autologin to apps and websites. Provide clear and simple options for consumers to opt out of certain types of communications, and use on-site or in-app messaging to explain why, for example, using public Wi-Fi to do online banking can be risky. Providing access to an identity protection partner before your customers suffer theft. Our study showed that individuals who use identity theft protection rather than credit monitoring are 92% less likely to experience identity theft. These services provide an added measure of security via alerts and notifications, and they also provide education, which can create better awareness of risky activities on the part of the consumer. By partnering with an identity protection provider, financial services firms help ensure their customers are best protected, and the firms will be ready with actionable information and tools in case their data is ever breached.
4 Appendix A: Methodology Forrester Consulting s study is based on an online survey fielded in February 2014 of 6,011 US individuals ages 18 to 88. The final data was subsequently weighted by age, gender, income, and region to demographically represent the overall adult US population. ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2014, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to www.forrester.com. [1-Q71N68]