Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/25/2019
11:35 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Financial Institutions on the Hook for Data Breaches this Holiday Shopping Season

American consumers will hold financial institutions accountable for compromised data regardless of who's at fault; Banks stand to lose nearly half of customer base, according to new study from Terbium Labs

Fears of data loss, identity theft and fraud are leaving American consumers on edge this holiday season, and they're prepared to hold their financial institution responsible for the damages. This is according to "How Fraud Stole Christmas", a new study released today by leading digital risk protection company Terbium Labs, which found that a strong majority of shoppers (68 percent) would hold their bank at least partly responsible for fraudulent activity, regardless of how the compromise occurred.

The Blame Game
Americans are on high alert heading into the busy holiday season, as 66 percent believe they could easily become a victim of fraud, while another 65 percent believe they are at a higher risk of having their financial information exposed as a result of their holiday shopping.

If and when these fears turn into a reality, consumers have made it clear they expect their financial institution to be accountable, even if it wasn't the original source of the data breach. Just over half of holiday shoppers (51 percent) say they'd blame both the original source of the data compromise, such as a retailer, and the financial institution that issued the payment card, while another 17 percent say they'd only hold their financial institution responsible regardless of how the compromise occurred.

According to the data, this will have a direct impact on the bottom line as financial institutions stand to lose almost half (45 percent) of their customer base if data is compromised over the holidays. This includes nearly two out of 10 consumers (19 percent) that say they'd leave the bank and close their account following a data breach, and another 26 percent that would only keep their accounts if their financial institution took specific actions to improve security.

Consumers fail to minimize the risk
Putting even more pressure on the banks this holiday season, shoppers will be increasing their potential for exposure, while disregarding best practices that could keep their data safe in the first place. For example, consumers aren't limiting themselves to one payment option. More than a third (35 percent) plan on using a mix of both debit and credit cards, while nearly half (49 percent) say that they'll use between two and three cards in total. This common tendency to spread holiday spending across multiple cards creates a much greater volume of cards in circulation – and far more opportunity for cyber criminals to capture payment data from multiple accounts. 

Unfortunately, only seven percent of respondents plan on using two-factor authentication when shopping online. Instead, more than a third (38 percent) say they'll prioritize monitoring their transaction history, even though 14 percent say they get frustrated when purchases that aren't suspicious get flagged too often. Despite expressing clear concern over fraud, this indicates that few consumers are willing to take a proactive approach to combatting the threat altogether. 

"Financial institutions are under heavy scrutiny by consumers during the holiday season, and should be taking customer trust and loyalty very seriously," said Emily Wilson, VP of Research at Terbium Labs. "Cyber criminals thrive during peak holiday shopping – the hustle and bustle of transactions and unusual shopping patterns create countless opportunities to capture payment data and attempt fraudulent transactions. Consumers are distracted, and prefer reactive measures to account for fraud, all while holding financial institutions to a high standard in keeping their data safe and their accounts secure. If financial institutions don't take proactive measures to monitor customer data and detect the first sign of exposure, they could face significant consequences in the new year."

Anxiety over identity theft
Despite the potential for payment card compromise during the holiday shopping blitz, American consumers are most concerned over identity theft. In fact, respondents ranked Social Security numbers (23 percent) as the type of data they are most worried will be compromised this holiday season. This was just ahead of two types of financial information – debit card numbers (22 percent) and credit card numbers (21 percent). This fear is certainly warranted, as cybercriminals can easily steal an identity with just a stolen Social Security number, name and address. 

"Consumers recognize the potential for payment fraud," Wilson said, "but the threat of identity theft is still firmly front of mind. The wave of massive breaches exposing personal data in recent years has left consumers more worried than ever about protecting their identity information – making the stakes even higher for financial institutions who need to secure that data."

For full analysis into these findings, along with additional survey data, the "How Fraud Stole Christmas" research study can be downloaded here.

Survey Methodology
Terbium Labs surveyed over 1,000 consumers in the United States to better understand their shopping behaviors and preferred payment strategies during the 2019 holiday shopping season. The survey was fielded in October 2019 and includes responses from consumers aged 18 years and older.

About Terbium Labs
Terbium Labs empowers organizations to reduce the risk of inevitable data exposure. Matchlight, the company's comprehensive digital risk protection (DRP) platform features continuous digital asset monitoring, robust analytics, and actionable intelligence, to quickly identify and minimize the impact of exposed data across the Internet – whether it's the open, deep, or dark web. Featuring its patented data-fingerprinting technology that ensures private data stays private, unique fusion of data science and machine learning, and dedicated analysts, Terbium Labs provides pinpoint accuracy for early detection and remediation of data exposure, theft, or misuse across the digital landscape. Learn more about Terbium Labs' unique approach to DRP by visiting www.terbiumlabs.com or on Twitter @TerbiumLabs.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16772
PUBLISHED: 2019-12-07
The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.to...
CVE-2019-9464
PUBLISHED: 2019-12-06
In various functions of RecentLocationApps.java, DevicePolicyManagerService.java, and RecognitionService.java, there is an incorrect warning indicating an app accessed the user's location. This could dissolve the trust in the platform's permission system, with no additional execution privileges need...
CVE-2019-2220
PUBLISHED: 2019-12-06
In checkOperation of AppOpsService.java, there is a possible bypass of user interaction requirements due to mishandling application suspend. This could lead to local information disclosure no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers...
CVE-2019-2221
PUBLISHED: 2019-12-06
In hasActivityInVisibleTask of WindowProcessController.java there�s a possible bypass of user interaction requirements due to incorrect handling of top activities in INITIALIZING state. This could lead to local escalation of privilege with no additional execution privileges need...
CVE-2019-2222
PUBLISHED: 2019-12-06
n ihevcd_parse_slice_data of ihevcd_parse_slice.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android...