Card guardians

Community bankers, experts share insights on protecting customers in the age of data breaches.Recent years have seen the ascendance of a new kind of bank heist: data breaches. With increasing success, hackers, the new-age bank robbers, are making off with customer card data — the digital equivalent of keys to the bank vault. They do so by stealing customers' card information from the systems of other companies..These cyber criminals act in anonymity; they never break into a bank or its computer systems. They also are often beyond the reach of the law's long arm. The most well-known of these heists have been on a large scale, such as Target's breach, in which the card information of about 110 million people was stolen..Target, however, is just one of a growing number of large scale breaches. In 2013, customers' data was stolen from some 410 companies, according to IT security company Symantec. That's up from 253 in 2012, and 208 in 2011. Eight of the breaches in 2013 exposed more than 10 million identities each. Only six breaches exposed that many identities in 2011 and 2012 combined..Breaches have become a continuing threat for banks, because banks cannot control other companies' systems. They are stuck playing cleanup and paying for customer account monitoring, reissuing cards and fraud. As the frequency of data breaches increases, however, the industry is coming up with best practices to deal with the new brand of thievery. .Information is key.Banks have effective options for dealing with breaches ranging from reissuing cards to fraud monitoring to educating customers. The strategy chosen comes down to the number of customers affected, the customer data stolen, the timeframe, the locations involved and the tools available to the bank, said Lily Thomas, vice president and senior regulatory counsel for the Independent Community Bankers of America..Without breach information, bankers act in the dark, Thomas said. The consequence can be money wasted. If, for example, hackers only stole customers' contact information, then a bank may not need to reissue cards, she said. Whereas, when customers' card numbers and card verification values are stolen, a timely reissue may prevent fraud. .Timeframe and geography play key roles in identifying affected customers, Thomas said. Banks need to know, for example, how long hackers had access to customer data moving through a retailer's system. They also need to know if data was stolen from specific locations or across the retailer's entire footprint, Thomas said. Unfortunately for banks, much of this information is not shared by retailers..In March, however, banks and retailers took a step forward in solving this information sharing problem. Through advocacy by ICBA and the American Bankers Association, the Financial Services Information Sharing and Analysis Center now oversees a new internet portal which provides bankers the information they need about retailer breaches..Bankers also can use the Federal Bureau of Investigation's InfraGard as a resource, said Randy Romes, principal, Information Security at CliftonLarsonAllen in Minneapolis. "Card processors and networks are often the conduit for banks trying to find out what information was stolen in a breach. Bankers who join InfraGard have a secure communication channel with the FBI," he said. InfraGard is a non-profit, public-private organization created by the FBI. The FBI vets all new members to the organization; InfraGard currently has nearly 56,000 members..Protecting customers after a breach.After a bank confirms the details of a breach where card data is involved, many simply reissue affected cards, Thomas said..Community banks spent more than $90 million to reissue some 7.5 million cards as a result of the Home Depot data breach. More than 4 percent of community banks reported fraud on affected accounts..Community banks also spent about $40 million reissuing more than 4 million cards in the wake of the Target and Neiman Marcus breaches. Fraud costs were still relatively low. Less than 1 percent of community banks reported fraud on their accounts. "The fraud numbers would have been larger had community banks not reissued cards as quickly as they did," Thomas said, noting that criminals often use cards that are near their expiration first. "They know their window to access funds is shorter than for cards that expire at a later date.".The cost of producing a new card is about $1.50. It will go up to $3.50 to $4.50 per card with EMV, said Terry Dooley, chief information officer at SHAZAM, the card network based in Johnston, Iowa. Thomas added that the total cost to reissue cards, prior to EMV and including personnel and other costs, is between $10 and $15 per card..The $324 million First National Bank, Waverly, Iowa, replaces all cards connected with a breach, said Susan Whitson, the bank's executive vice president and chair-elect of the Iowa Bankers Association. "Our experience is that some cards may not have fraudulent activity for some time," she said. "It will happen when you least expect it.".Whitson also said the bank will either pay for reissuing cards, for fraud monitoring or to make customers whole from fraud. The bank eliminates the latter two options by reissuing cards, she said. "There is a cost to add fraud monitoring and there can be additional costs depending on the monitoring we'd like to do," she said. "It becomes a judgment call, either way it costs us. We are taking care of our customers by reissuing. It is about their peace of mind.".Dooley said banks with smaller card bases often just replace cards involved in a breach because their tolerance for risk is lower. Banks with a larger card base tend to manage the risk with fraud monitoring while allowing customers who are worried about a compromised card to request a new one, he said..After First National Bank receives the list of cards used at a breached retailer from its card service provider it both calls customers and sends a letter. The ability to make a new card at the branch, rather than waiting for the manufacturer, was an important capability after the Target breach, Whitson said. "Some customers were leaving for the holiday and did not have time to wait for the card to come in the mail," she said. "The ability to make one for them in the branch allowed us to protect them and reduce inconvenience for them.".Communicating with customers.It can take a few days after a breach for card processors to identify the cards involved, Whitson said. "Given that some time has already elapsed we reach all our customers within the first 48 hours after receiving the list," she said..The immediate attention needed by First National Bank's staff has been and remains the largest impact of breaches, Whitson said. "We have a number of our branch staff assist our customer service area when a breach occurs," she said. "Normally about 5 percent of branch staff touches cards day-to-day. When a breach happens we can have as much as 30 percent of our staff dedicated to it.."It is unfortunate but we have become quite practiced at dealing with breaches," she continued. "Now, not a week goes by without one. Our card personnel have to make sure that our fraud system is catching all that it should; it is a daily task. That is definitely an extra cost of doing business.".For the $233 million Grand Rapids State Bank in northern Minnesota, the security breaches of 2013 brought a flood of calls into the bank. "We usually have one person answering calls; we had six people answering phones after Target's breach," said Noah Wilcox, the bank's president, CEO and chairman. At the time, that was more than 10 percent of the bank's employees..Inconveniencing customers is a main concern for banks which reissue cards. Depending on the amount of information stolen and the number of affected customers, some banks decide to monitor customer transactions rather than reissue cards, Thomas said. "Many customers have automatic debits that come off their card," she said. "It is a pain and a frustration for customers to switch that payment information.".Wilcox said Grand Rapids State Bank will notify customers when their card is involved in a breach. It reissues cards on a case-by-case basis. "Generally, unless it's thousands of affected cards, we monitor for unusual transactions in house," he said. "We are a community bank and we know our customers and their spending patterns. Our card services team will review the accounts at the beginning and end of the day for unusual activity. In some cases, we review and authorize each transaction.".Protecting customers and maintaining high levels of service also has become time intensive for Grand Rapids State Bank. With 2.5 people dedicated to card services, the bank is adding another person to the team. The team will balloon to six people when needed, Wilcox said. "We have increased the size of that department and we are looking at increasing it more because our business still needs to run, even while we are serving customers in the wake of a breach.".Retailers' weak protection of card data will continue to be exploited by hackers, however, until the liability for a breach falls on the party responsible, Wilcox said. "Retailers are under contract with VISA and MasterCard to secure payment data," he said. "If you look at any retailer breach, the merchant is in full violation of VISA and MasterCard security rules. If my bank is hacked I would and should be liable; if a retailer gets hacked they should bear that liability as well.".Tokenization to improve card security.Tokenization is the latest security measure the payments industry is implementing to protect cardholder information..The term tokenization refers to the process of converting a credit card number into a unique string of digits which changes with every transaction. Hackers need a decryption key to decode the card information. Tokenization substantially reduces the data breach problem because customer card data never touches a retailer's server; the retailer only sees the "token.".The payments industry has used tokens for some time; the card number for debit cards originally used with PIN authentication was, in essence, a token which provides access to the consumer's account, explained Terry Dooley of SHAZAM..The implementation of tokenization, however, poses challenges, Dooley said. An industry standard needs to be created for stakeholders to get the most out of tokenization, he said. "The standard should be supported by all networks and brands, and should not be unique to any specific network," he said. "Ideally, the issuers, merchants, and acquirers would have a single standard accepted by all network brands."