Learning Lessons From Large Scale Breaches
At this point, there’s no ignoring it: our financial security is compromised daily. And no doubt, many reading this wouldn’t hesitate to recount all the breaches they have been a part of as consumers; merchant breaches in which replacement cards forced you to update your linked accounts, or data compromises where personal information was stolen and identity theft protection was provided, forcing you to consider freezing new credit originations.
These are only the breaches we know about — considering the residual risk of all the data breaches we’ve been exposed to, the totality of it all becomes immense. Back at the start of 2014, I suggested that we’re experiencing data breach fatigue; today it’s closer to data breach exhaustion, and consumers may now feel powerless.
We must ask ourselves as consumers, what exactly is being compromised? What information has fallen into the pocket of an attacker and how could they use it to attack me? As we are compromised once, twice, or multiple times, are we falling under greater risk? How vulnerable are we when it is revealed that personal details landed in the hands of hackers and fraudsters?
Typically, most concerning for consumers is demographic data that can be uses in authentication, illegitimate identity-theft account opening, or the use of a payment card for unauthorized spending (or potentially for account takeover) if an attacker has the relevant non-public personal information. There is a risk here to be sure, even if we, as service providers, don’t realize the impact of it. So what lessons are out there?
Zombie authenticators and static data elements are a gift to hackers
Well, for starters; why are we still using knowledge-based authentication based on third-party-issued static data elements to authenticate? Government (in the U.S. Social Security) identity numbers, home addresses and the user’s date of birth are zombie authenticators – even worse than passwords! They have been compromised so many times, or are sometimes available through public or searchable sources… still in 2017.
Fraudsters have databases to store these elements as well, and anyone who has an account on a dark website can search an underground database to see if a birthday, SSN (social security number) or home address exists for the intended target. In fact, there is already a neologism for this: “Credential Stuffing” – the act of intercepting and using as many authentication elements (e.g. account login or recovery credentials) that have been compromised to attempt to take over an account.
Biometrics and other authentication measures should be embraced
When being asked to authenticate myself, I cringe when I see these types of questions. I’d much prefer to do business with an entity that has a more rigid authentication process and does something far more clever and sophisticated to validate that I am, in fact, me. We now have biometrics if the customer can use them remotely, on a mobile app. We have dynamic account-based questions (only known internally to the service provider and customer), and we have multifactor out-of-band authentication… these can be embraced to perform a far greater authentication experience and reduce the potential for account takeover. Would I feel more secure in a world of high-frequency data breaches when I know my financial institution authenticated me with two factors? Could this actually be faster than the present authentication practices of asking multiple questions, throughout a contact center session? Of course!
I know no one wants to get a letter from their financial institution, or look themselves up on a newly-created security webpage to determine they are exposed after a large breach is revealed, but this is a reality. To sit idly by and continue to authenticate with the most static data elements that are most consistently compromised is a lesson of any breach du jour.
Related Blog Posts
APIs and Cash Management (Harnessing the Hammer, Part 2)
In my last blog post, we talked about the hammer and the nail; the hammer in this case being open APIs, and the nail being the market need to adapt to changes in customer behavior and expectations from our commercial market. We laid out why the US is in a different position when it comes to open APIs—it has to do entirely with the regulatory environment, which is allowing us to start with the largest revenue opportunity first. Finally, we challenged you, the reader, on how you can begin on your journey. And that is where we are going to pick things up. What steps can you take today, and what use cases can you explore as we start getting our hands dirty?
Three Key Takeaways from the Latest Payments Insight Survey
Blinkist is a reading app that summarizes books into 15-20 minute reads; these reads are called “blinks.” It’s helpful for a few reasons – I can scan books before I purchase them, I can get new ideas without having to read the full book, and I can learn to summarize information. It’s safe to say that I (and probably many who are strapped for time) are a little obsessed with Blinkist! So here I present my own summary – in three key takeaways – of the new ‘2018 Global Payments Insight Survey: Retail Banking,’ which finds that 51% of banks are increasing spend on payment technology.
The Hidden Cost of Digital Payments for Retail Payment Players
It is not exactly breaking news that non-cash payments are on the rise globally, with column inches dedicated to the launch of digital financial-inclusion projects. But going cashless is not only a challenge for humanitarian endeavors, or developing countries. We all agree that removing cash from the system will save payments players big bucks in the future, but we must also consider the immediate impact of digital transformation on the legacy infrastructure of the powerhouses of the payments ecosystem.
Why User Engagement Matters, Even for Enterprise Applications
As a User Experience Designer at ACI, I spend a lot of time watching users interact with my designs. I need to make sure our solutions work properly, but lately I’m more interested in how they make my users feel. Engagement is a dominant concept in user interface design right now. It’s important because positive emotional experiences often lead to increased use and loyalty.
Five Payments Trends to Watch in 2018 [Part 1]
2018 is set to be a year of rapid change and new challenges for payments players. The floodgates are opening with PSD2 and UK Open Banking coming into force, bringing an onslaught of new competitors and potential partners. Whether evolution is mandated or market-driven, banks and processors are facing a critical year in their long-term success.
Five Payments Trends to Watch in 2018 [Part 2]
The New Payments Ecosystem Is Here. The floodgates are opening with PSD2 and UK Open Banking coming into force, bringing an onslaught of new competitors and potential partners. Whether evolution is mandated or market-driven, banks and processors are facing a critical year in their long-term success.
Open Banking Goes Live: The Walls Around Traditional ‘Old Style Banking’ Are Crumbling Down
January 13, 2018 may well be remembered as the ‘beginning of the end’ of the traditional retail banking industry.
Thanks to a profound set of new rules by European regulators and the UK government, we may see the start of an era where consumers no longer hesitate to change their bank accounts or make more personalized arrangements with regards to their finances.
The Bank of the Future: 2040 and the Reality of Ar and Vr
Mark, when I envision the bank of the future, I imagine Twiki and Buck Rogers at a casino. Or maybe I once dreamed that—I’m old and my mind is going. So what are we talking about and what can we envision when it comes to the bank of the future? And by future, I’m talking about 2040, before certain cities might be flooded (by water). But I digress, as this isn’t a post about climate change.
How 'Mega Trends' Are Shaping Payments in India
In a previous blog post, I wrote about the impact of demonetization in India and the staggering growth of new digital payment types. Building further on this, I want explore some of the “mega trends” in payments, and how India is embracing the opportunities presented by these trends.
One Year Later: How Demonetization Has Impacted India
This month marks the first anniversary of demonetization in India, and it has undoubtedly changed the country forever. When I visit India, I increasingly see micro-transactions conducted via mobile phones. Cash is still used, but I see less and less of it with each visit. We are in the middle of a true paradigm shift – and India is poised to become a global leader in new types of payment acceptance.