Blog

Will consumers change behavior because of data breaches?

May 12, 2014 by Terry Dooley — SVP & CIO, ITS, Inc

New research indicates many consumers have altered their shopping behavior as a result of recent far-reaching retail data breaches.

Specifically, data analytics company Feedzai's "2014 Consumer Reaction to Financial Data Breaches Study" found that 22 percent of shoppers who were aware of the data hacks have changed how they make purchases, including 40 percent claiming to choose cash more often as their payment method of choice.

Midwesterners who have altered their payment habits totaled higher with 26 percent making changes, while 19 percent of consumers living in the Western U.S. reported switching up how they pay for purchases.

Not surprisingly, the survey concluded that data breaches result in a decrease in the number of consumers shopping at affected merchants. In fact, 28 percent of those surveyed admitted to ceasing to visit a compromised retailer altogether, following a security breach.

Although the recent, high profile data breaches occurred in physical retail stores, 52 percent of those asked said they consider making in-store purchases with their payment card to be more secure than shopping online with credit or debit.

Fifty-eight percent of younger consumers, aged 18 to 34, said they view data breaches as an expected part of shopping with credit or debit, while just 38 percent of shoppers aged 55 to 64 said the same.

Interestingly, more than half (60 percent) of respondents pointed to merchants as the responsible party for preventing future data hacks. Just 13 percent placed that responsibility on financial institutions.

Of course, that brings little comfort to FIs, which have spent $153 million to date, and reissued more than 15 million payment cards in the aftermath of these breaches.

This survey brings to light an interesting conversation, one that lingers under the water's surface. Who should be responsible for protecting personal data and payment credentials?

If someone downloads 10 applications and all of them ask for banking or payment credentials and one of them happens to be malware, who should be responsible?

Should the FI be able to approve applications that request consumer banking and payment information if they are expected to own the risk?

Before mobile payments, it was difficult to target individual users (takes a long time vs. an aggregation point). There is a need for additional authentication, but what authentication creates a silver bullet that protects everyone?

Unfortunately, there isn't one. That said, consumer security is the strongest when the authentication is layered with at least one layer being something they know and control.