A Thought Leadership Spotlight September 2014 Commissioned By LifeLock Privacy, Identity, And Security: A Spotlight On Why Insurance Companies Should Offer Identity Theft Solutions Results Focusing on Insurance Companies From The Thought Leadership Paper Privacy, Identity, And Security: The Growing Risks Of Failing To Protect Personal Identity, July 2014 Introduction In February 2014, LifeLock commissioned Forrester Consulting to study the consumer attitudes, behaviors, and exposures related to identity theft. Forrester analyzed this data to develop a hypothesis about the correlation of digital life activities (e.g., the kinds of services consumers use, the types of information they share online, and the kinds of connected devices they own) and security behaviors both online and offline (e.g., locking their devices, using strong passwords, and shredding sensitive documents) in order to score consumers across a continuum of identity theft risk. To further explore these issues, this Spotlight focuses on identity security and its impact on insurance companies. When we narrow the focus to insurance companies, our key findings are that: Medical identity fraud is a serious concern with US adults. But it doesn t trump the convenience of interacting with insurers and practitioners digitally. As the insurance world goes paperless, consumers are less able to protect themselves. 2014, Forrester Research, Inc. All rights reserved.
2 Empowered Consumers Demand Better Data Protection In today s increasingly digital world, individuals are perpetually connected and increasingly share their lives online. But this new reality also comes with new risks. Every interaction, communication, and touchpoint creates a digital breadcrumb: a piece of data that can put people at greater risk of identity theft. That s why insurance companies should provide proactive ID theft solutions. We have entered an era where an organization s most valuable asset is its ability to anticipate and serve its customers at their moment of need. We call this the age of the customer. Individuals are more empowered than ever, and they demand access and convenience on the go and without friction. But these demands also increase the risk of identity theft. The key issues affecting identity protection include: The proliferation of devices that generate and collect data, which puts us at greater risk. Consumers are hyperconnected over 64% of them use three or more connected devices today. And each of those devices is collecting and storing potentially identifiable information. Frequently, these devices store more information via apps, for example than users realize. This trend is only on the upswing as new technologies like wearables and connected home devices proliferate and gain mainstream adoption. The increasing use of online services that collect our data. These services, such as cloud storage, music streaming, and even ephemeral messaging platforms, are popular because they offer unique value. Unfortunately, most of these services often treat user data without the appropriate levels of governance and security. In fact, many of them even require us to share more of our identity and secrets simply to engage with the service. An increase in risky behaviors in exchange for recognition and convenience. Our research found that only 38% of consumers avoid using conveniences like autologin on the websites they use, while 35% of respondents do not use different passwords for different online accounts. These behaviors make it easier for individuals to lead their digital lives, but they also increase the risk of identity theft: When one password is breached, for example, thieves have a much greater chance of accessing the individual s other accounts. Insurance Firms Need Advanced Data Protection Policies Specifically, insurance companies have to worry about keeping more than just traditional personally identifiable information (PII) secure (e.g. claims records.) They must also protect consumer data that s collected and stored by users mobile devices as they interact with the company s mobile applications that could result in identity fraud. We found that: Medical identity fraud is a serious concern. Sixteen percent of US adults are extremely concerned about medicalrelated identity fraud, which was defined in our custom study as your identity is used by someone to fraudulently receive medical treatment or obtain medical insurance. Fully a third consider this kind of identity theft concerning. But it doesn t trump the convenience of interacting with insurers and practitioners digitally. Nineteen percent of US adults use online healthcare management tools, such as websites or mobile applications to manage their relationship with their doctor, deal with insurance claims, and manage prescriptions. The use of these websites increases the risk of identity theft by 30%, but consumers aren t likely to stop using them due to the convenience and information they deliver. As the insurance world goes paperless, consumers are less able to protect themselves. While 62% of individuals shred sensitive paperwork in an attempt to protect themselves, as insurance documents and forms go increasingly paperless, these individuals don t take the same digital precautions. Only 28% password protect sensitive files on their home computers, and 27% actually save these kinds of files on portable hard drives or thumb drives, which are easily lost or misplaced.
3 Major life events increase identity theft risk. It also turns out that new beginnings such as a marital status change, new parenthood, or new home ownership also increase exposure. We found that individuals who experienced one of these significant life changes within the last 12 months were much more likely than the average population to become victims of identity theft as well (see Figure 1). FIGURE 1 Major Life Events Increase Identity Theft Risk Base: 6,011 US online adults (18+) Source: A commissioned study conducted by Forrester Consulting on behalf of LifeLock, February 2014
1 Key Recommendations It s clear that identity theft is a problem on the rise. First, criminals are simply getting smarter and better able to operate at scale. Second, consumers haven t yet gotten used to the idea of protecting their data and identity in the new digital world. Insurers who want to help their customers be better protected and reduce their own risk should: Educate their customers about the real risks of identity theft. Our data shows that individuals who have a cavalier attitude about identity theft are actually at greater risk. In fact, those who don t believe that online security is worth worrying about are nearly six times less safe than the US average, while those who believe they ought to concern themselves with identity theft are nearly 30 percent less likely to experience identity theft than the US average. Taking a personal interest in and ownership of identity makes a difference. Secure all customer data with technology and governance processes. Your customers want to interact with you digitally. But that means more opportunities for your data to be breached. Consider using tools like two-factor authentication (46% of consumers choose the option whenever it s offered) and deactivating autologin to apps and websites. Finally, treat more data like PII, because identity thieves are increasingly able to re-identify data that you considered anonymous. Plan ahead with an identity protection partner before customers experience a data breach. Our study showed that individuals who use identity theft protection rather than credit monitoring are 92% less likely to experience identity theft. These services provide an added measure of security via alerts and notifications, and they also provide education, which can create better awareness of risky activities on the part of the consumer. By offering customers an identity protection solution, insurance companies help ensure their customers are best protected in the event their personal data is ever compromised.
2 Appendix A: Methodology Forrester Consulting s study is based on an online survey fielded in February 2014 of 6,011 US individuals ages 18 to 88. The final data was subsequently weighted by age, gender, income, and region to demographically represent the overall adult US population. ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2014, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to www.forrester.com. [1-Q71N68]