How The Major Breaches In 2018 Showed Us That It’s Time For Consumers To Take Greater Control Of Their Cards

How The Major Breaches In 2018 Showed Us That It’s Time For Consumers To Take Greater Control Of Their Cards

Rachna Ahlawat

co-founder at Ondot Systems

Views 1379

How The Major Breaches In 2018 Showed Us That It’s Time For Consumers To Take Greater Control Of Their Cards

14.11.2018 12:30 pm

A few months ago British Airways became one of the latest big-name brands to suffer a major data breach, as hackers managed to steal card details – something that has this week been reported could have raised up to $12.2m (£9.4m) for Russian hackers on the dark web. Alongside this, Cathay Pacific Airways also recently fell victim to a breach involving 9.4 million passengers, and is now facing a compliance investigation from Hong Kong’s privacy commission.

It’s just another reminder that no organisation is too large or too clever to get caught out by online attackers, as a number of other well-publicised victims of online fraud including Ticketmaster, Dixons Carphone and Equifax also know all too well. While best practice security is always recommended, and increasingly mandated by regulators, there’s no guarantee it will be 100% effective.

So where does that leave consumers? Unfortunately, they are often left to pick up the pieces, forced to cancel cards and endure significant personal distress and frustration. Banks can also find themselves on the receiving end of customer ire as a result — even if they are not to blame for the initial breach. That’s why as an industry we should be looking to put more power back into the hands of consumers over how they use and control their cards.

From breaches to fraud

Details are still continuing to emerge over the BA breach. However, the carrier has claimed that names, email addresses and card details including numbers, expiry dates and CVV numbers were stolen. It is also very specific about the time period where hackers accessed the data: 22:58 BST, 21 August 2018 until 21:45 BST, 5 September 2018. That has led some security experts to speculate that it may have been made possible thanks to a compromise of the airline’s web infrastructure, allowing the hackers to siphon off data as it was entered into the site or mobile app. Similar attacks have been raging around the world, with one prolific threat group running a “digital card-skimming campaign” that has caught out hundreds of major e-commerce sites including Ticketmaster.

Whether it’s via these advanced attacks or more traditional raids on customer card databases like the breach at Dixons Carphone involving nearly six million cards, cyber-criminals are now experts at monetising stolen data. The cybercrime economy is worth an estimated $1.5tr annually, with around $160bn of this coming from trade in stolen data — much of it financial. With those details, criminals can either clone cards for future use or, if they’re of the chip and PIN variety, use the data to conduct CNP fraud.

The impact on consumers, and the banks, can be severe. Soon after, Social media was flooded with angry BA customers complaining about the frustration and inconvenience of having to cancel their cards as a precaution. Most lenders only selectively send replacement cards when there has been a major data breach, forcing customers who want to minimise risk to proactively contact their bank — with all the extra time and effort that entails. If multiple cards are linked to a breached account, as was the case with one BA customer who spoke to the BBC, the negative impact can be many times greater.

Controlling fraud

Breaches will always happen. In fact, they’re likely to ramp up even further in the run up to the festive period. A determined attacker is almost impossible to stop and the economic imperative will continue to draw cyber-criminals into the underground economy in ever greater numbers. Of course, IT security teams should continue to invest in advanced detection and prevention tools, alongside best practice processes for securing systems — especially in light of the GDPR and PCI DSS requirements.

But we should also be looking to put more control into the hands of consumers. Now used by thousands of financial institutions around the world, card control applications offer a simple but effective way to reduce fraud and improve customer satisfaction. Enabling cardholders to control where, when and how each of their cards is used, means they could add extra restrictions to cards suspected of being breached. For example, a user might keep the card switched “off” by default until they want to use it, to minimise the risk of fraud. Other granular restrictions can be added in a couple of clicks, such as: where it can be used; what time of the day; how much can be spent; and what types of transactions are permissible. Detailed transaction alerts complete the picture: offering peace of mind to customers that any unusual activity will be spotted and blocked in real-time.

Card controls are not a silver bullet, but they should be considered an important pillar in an industry-wide response to the escalating challenge of online breaches and fraud.  

Latest blogs

Béla Vér ApPello

The survival of banks is at the mercy of their technology vendors

Governments around the world have responded on a scale not previously witnessed to protect people around the world from becoming a victim of COVID-19. With many lockdowns still in place and now coordinated on a local level to respond to second Read more »

Nóra Bézi Bitrise

The future of finance and banking apps: balancing security and innovation

The fintech revolution in the mobile space Fintech mobile applications are rapidly becoming the norm when it comes to handling our personal finances. As these apps grow in popularity and continue to define our relationship with money, the number Read more »

Will Hurst Monevo

How can lenders leverage open banking data to tackle Covid-19 pandemic challenges

We have seen extraordinary levels of Government-backed support made available to the public and businesses alike in responding to the health crisis by our banks through payment holidays, grants and the furlough scheme. While we keep collective Read more »

Nish Kotecha and Noslen Suárez PhD Finboot

How blockchain can help us have trust in the food we eat

Today’s food supply chains are global, connected and generally efficient, but the COVID-19 pandemic has shone a spotlight on areas of weakness. The urgent need for robust and resilient systems and processes has been brought sharply into focus, and Read more »

Chris Miller RSA Security

Back to Normality: Five Steps to Stay Resilient After Disruption

The financial services sector has lived through many global disruptions, but the nature of recent events has put an unprecedented strain on operational resilience; from needing to ensure critical functions could continue with skeleton staff and Read more »

Related Blogs

Matt Hooper IMImobile

Police warn of 63% rise in SIM swap scams - response from industry expert

Now that banking on mobile devices is the norm, SIM swap fraud is becoming a growing concern across the industry. There is serious pressure on banks and mobile operators to address the issue before serious reputational damage is done; with the Read more »

David Gibson Varonis Systems

Yahoo! data breach

The fact that this is the second Yahoo! breach that has been disclosed in the last 3 months just goes to show how deep some of these major data breaches go. Many organisations are breached just as severely as Yahoo!, but may never know as they are Read more »

Magazine
ALL
Free Newsletter Sign-up
+44 (0) 208 819 32 53 +44 (0) 173 261 71 47
Download Our Mobile App
Financial It Youtube channel