Article

From breach to outreach: Restoring cardholder confidence

The card is an extension of your institution, so it's your FI that cardholders look to for protection. Losing their trust is a big problem — and a big expense

December 30, 2014

by Mark D. Smith, Sharenet ATMs

In recent months, Americans have gotten an education — a reluctant one — about how software hackers can steal card data and personal information during brash attacks on big box retailers.

The card data that's been stolen runs into the millions. And consumers are very frightened, as evidenced by millions of calls to financial institutions requesting reissued cards.

Data breaches are occurring in well known and often-frequented retail locations. Cardholders are losing confidence quickly.

Until a solution, such as EMV, is in place in the U.S., we might see consumers using cash more often for everyday purchases. They might not use their cards as often for fear of another breach and the hassle of having to have cards replaced.

We might also see an accelerated race to mobile payments to offset card fraud, but these payment methods must still prove to be secure.

Bottom line: Consumers are confused, scared that their accounts are not safe, and upset when they have to replace their cards. Since the card is an extension of your institution, it is your FI that cardholders trust for their protection. Losing this trust is a big problem — not to mention the expense of replacing all those cards.

Every card issuer should be conducting outreach to calm cardholders' frazzled nerves. Consumers need to understand what you are doing to protect them.

Banks and credit unions have to make a concerted effort to reach out to their customers and members. Be sure your cardholders know about breaches that affect them and what they need to do should their data be compromised.

Here are some steps you can take to restore cardholder confidence:

Promote your surcharge-free ATM program

If your customers or members are using cash more often, you should be touting your surcharge-free ATM program. Provide them with ATMs in secure branch locations, secure retail locations and in the community for easy account access. Drive-up access might be preferable; offer the option of this convenience so customers don't have to leave their vehicles. They must know they are safe, regardless.

Promote ATM security features

Make sure your customers know that your ATMs are secured against card and identity fraud. Use anti-skimming devices to protect cards from being counterfeited; employ lockdown methods to secure network infrastructure; and demand that vendor partners be credible and accountable, as well.

Work only with ATM managed services organizations that have a proven track record and are proactive in helping to prevent data breaches. In addition, use only authorized and certified technicians to assure compliance and accountability. You want to know exactly who has had access to your payment and ATM devices.

Educate cardholders about fraud

Make certain that your cardholders know how to identify fraud and how to quickly resolve a situation that arises from it. The sooner a compromised card is deactivated, the less opportunity there is for fraudulent activity. Likewise, the sooner identity theft is addressed, the better.

Protect customers' identity

If criminals can get access to social security information, home addresses and other private data, they can conduct complex schemes that leave the victim's life a shambles. Many institutions are now offering free identity theft protection for limited times and under certain conditions. This is a good step to help preserve your integrity and image with your accountholders.

If a cardholder's data is compromised or their identity is stolen, do everything possible to absorb the hassle for that customer to ensure their continued peace of mind and confidence in your programs. Addressing identity theft isn't as easy as cancelling a card and issuing a replacement — it can take months or even years to clear up.

Migrate to EMV cards and EMV-capable ATMs

EMV chip cards promise to secure cardholder data by making it difficult, if not impossible, for thieves to copy the cards. Although the liability shift for POS terminals is still a year away and the deadline to upgrade ATMs is not until 2016, many large banks and retailers such as Walmart have already begun to replace mag stripe cards with EMV cards. The sooner you migrate to chip cards and upgrade your ATMs to accept them, the better.

Be proactive and listen to sound advice from experts

Europe, Canada and other parts of the world already use EMV and are seeing drastic reductions in card fraud. When upgrading your ATMs, use only trusted third-party companies that follow strict rules for data protection and meet federal guidelines.

In some recent breaches, the compromise occurred when the hacker used "vendor credentials." That is, they used a vendor's password and system access to hack into a big-box retailer's database. They didn't capture data at ATMs — they captured it straight from the retailer's data center.

The breach raised no red flags when it occurred; it was only discovered after the fact. By then, the damage was done and fraudulent account activities were the result.

All parties in the industry have a role in the effort to stop card fraud. We must also encourage cardholders to remain vigilant and help catch compromises early. Prevention is the best medicine; there is plenty of information available to get the process started and add trust back into your relationships with cardholders.