Financial Services

When the Consumer Financial Protection Bureau (CFPB) takes authority on July 21, debt collectors and communications companies should pay close attention. If the CFPB has its way, the rules may be changing. Old laws, new technologies The rules governing consumer communications for debt collection haven’t seen a major update since they were written in 1977. While the FTC has enforcement power in this area, it can’t write rules—Congress must provide direction. Consequently, the rules guiding the debt collection industry have evolved based on decisions by the courts. In the meantime, technology has outpaced the law. Debt collectors have taken advantage of the latest available methods of communication, such as cell phones, autodialers and email, while the compliance requirements have largely remained murky. At the same time, complaints about debt collection practices to the FTC continue to rise. While the number is relatively low compared to the amount of overall activity, the FTC receives more complaints about debt collectors than any other industry. The agency has also raised concerns about how new communication tools, such as Facebook and Twitter, will impact the future of debt collection. Priorities for the CFPB While mortgages, credit cards and payday loans will be the early priorities for the CFPB, high on the list of to-do items will be to update the laws governing consumer communications for debt collection. Under the Dodd-Frank Act, the CFPB will be responsible not only for enforcing the Fair Debt Collection Practices Act (FDCPA), but it will also have a new ability to write the rules. This raises new issues, such as how new regulations will affect how debt collection companies can contact consumers. Even as lenders and communications companies have expressed concern about the CFPB writing the rules, the hope is that the agency will create a more predictable legal structure that covers new technologies and reduces the uncertainty around compliance. Faced with the prospect of clarifying the compliance requirements around debt collection, the ACA (Association of Collection and Credit Professionals) has started to get in front of the CFPB by putting together its own blueprint. Will the CFPB be ready by July 21? Over the last year, the CFPB has been busy building an organizational structure but still lacks a leader appointed by the President and confirmed by the Senate. (Elizabeth Warren is currently the unofficial director.) Without a permanent director in place, the agency will be unable to gain full regulatory authority on July 21 – the date set by the Treasury Department. Until then, the CFPB will be able to enforce existing laws but will be unable to write new regulations. Despite the political uncertainty, debt collectors and communications firms still need to be prepared. One way is to ensure you’re following industry best practices established by ACA. To help you be ready for any outcome, we’ll continue to follow this issue and keep you apprised of the CFPB’s direction. Let us know your thoughts and concerns in the comment section. Or feel free to contact your Experian rep directly with any questions you may have. Helpful links: Association of Credit and Collection Professionals Fair Debt Collection Practices Act (PDF) Consumer Financial Protection Bureau (CFPB)

The Communications Fraud Control Association’s annual meeting and educational event was held last week (June 14 – 16) at the Allerton hotel in Chicago, IL.   The Communications Fraud Control Association is made up of communications and security professionals, fraud investigators, analysts, and managers, law enforcement, those in risk management, and many others.   As an organization, they started out as a small group of communications professionals from the major long distance carriers who were looking for a better and more collaborative way to address communications fraud. Now, almost 30 years later, they’ve got over 60 members – a great representation of the industry yet still a nimble size. From what I hear, this makes for a specialized but quite effective “working” conference. Unfortunately I was not able to attend the conference but my colleague, Kennis Wong, attended and presented on the topic of Account Takeover and existing account fraud. It’s an area of fraud and compliance that Experian has spent some R&D on recently, with some interesting findings. In the past, we’ve been more focused on helping clients prevent new account and application fraud. It might seem like an interesting time to expand into this area, with some studies citing large drops in existing account fraud (2011 Identity Fraud Survey Report by Javelin).  BUT...consumer costs in this area are way UP, not to mention the headline-grabbing news stories about small business account takeover.  Which means it’s still a large pain point for financial institutions.   Experian’s research and development in existing account fraud, combined with our expertise in fraud scores and identity theft detection, has resulted in a new product which is launching at the end of this month: Precise ID for Customer Management. Stay tuned for more exciting details.

Whether you call it small business, commercial, or corporate account takeover, this form of existing account fraud has been in the headlines lately and seems to be on the rise. While account takeover happens to individual consumers quite frequently, it’s the sensational loss amounts and the legal battles between companies and their banks that are causing this form of commercial fraud to make the news. A recent BankInfoSecurity.com article, Fraud Verdict: Opinions Vary, is about a court opinion on a high profile ACH fraud case - Experi-Metal Inc. vs. Comerica Bank – that cites a number of examples of corporate account takeover cases with substantial losses: ·         Village View Escrow of Redondo Beach, Calif.:  lost $465,000 to an online hack ·         Hillary Machinery: settled with its bank for undisclosed terms in 2010. ·         The Catholic Diocese of Des Moines, Iowa:  lost $600,000 in fraudulent ACH transactions. I was curious what information was out there and publicly available to help businesses protect themselves and minimize fraud losses / risk. NACHA, the electronics payment association, had some of the best resources on their website.  Labeled the  “Corporate Account Takeover Resource Center”, it has a wide variety of briefs, papers, and recommendations documents including prevention practices for companies, financial institutions, and third-party service providers. There’s even a podcast on how to fight ACH fraud!  One thing was interesting to note, though. NACHA makes a point to distinguish between ACH fraud and corporate account takeover in this statement at the top of the web page: Corporate Account Takeover is a form of corporate identity theft where a business’ online credentials are stolen by malware. Criminal entities can then initiate fraudulent banking activity. Corporate Account Takeover involves compromised identity credentials and is not about compromises to the wire system or ACH Network. ACH fraud and wire fraud, terms mistakenly used to describe this type of criminal activity, are a misnomer. The ACH Network is safe and secure. Mostly I agree –the ACH Network is safe and secure. But from an F.I.'s or company’s perspective, corporate account takeover and ACH Fraud often go hand in hand.

High-profile data breaches are back in the headlines as businesses—including many in the communications sector—fall prey to a growing number of cyberattacks. So far this year, 251 public notifications of data breaches have been reported according to the Privacy Rights Clearinghouse. The latest attack comes on the heels of the Obama administration’s recent proposal to replace conflicting state laws with a uniform standard. The idea is not a new one—national breach notification legislation has been in discussion on Capitol Hill since 2007. With the addition of the White House proposal, three data breach notification bills are now under consideration. But rather than waiting for passage of a new law, communications companies and businesses in general should be aware of the issues and take steps to prepare. Replacing 48 laws with one Currently, notification standards differ on a state-by-state basis: 46 states, plus the District of Columbia and Puerto Rico each enforce their own standards. The many varying laws make compliance confusing and expensive. While getting to a single standard sounds like a good idea, finding a single solution becomes difficult when there are 48 different laws to reconcile. The challenge is to craft a uniform national law that preempts state laws, while providing adequate consumer protection. Five things to look for in a National Breach Notification Law Passing a single law will be an uphill battle. In the meantime, these are some of the issues that will need to be resolved before a national breach standard can be enacted: What types of personal information should be protected? First and last name + other info (e.g. bank account number) What should be classified as “personal” information? Email addresses and user names Health and medical information (California now includes this) What qualifies as a breach and what are the triggers for notification? What information should be included in a breach notice? How soon after a breach should notification be sent? Some states require notices be sent within a set number of days, others ASAP. Potential penalties What could happen if a company doesn’t comply with the proposed laws? Under the White House bill, fines would be limited to $1,000/day, with a $1 million cap. The two bills in House would impose penalties of $11,000/day, maxing out at $5 million. How to prepare before a national standard is passed Although the timing for passage is uncertain, communications companies need not wait for a national law to pass before taking action. Put a plan in place instead of sorting through 48 different laws. Preparation can be as simple as making a phone call to your Experian rep about our data breach protection services. Having managed over 2,300 data breach events, Experian can help you effectively mitigate loss. In addition to following updates on this page, you can also stay informed about the progress of pending data breach legislation by following the Data Breach Blog. Share your thoughts and concerns on the current proposals by leaving a comment. For further reading on this subject:   Experian Data Breach Blog   State Security Breach Notification Laws     Obama Administration Proposal: Law Enforcement Provisions Related to Computer Security (pdf of the full bill)     Obama national breach notification proposal: Good news, bad news for firms     2011 Data Breach Investigations Report (PDF)

For communications companies, acquiring new accounts is an ongoing challenge. However, it is critical to remember that managing new and existing accounts – and their respective risks – is of tremendous importance. A holistic view of the entire customer lifecycle is something every communications organization can benefit from. The following article was originally posted by Mike Myers on the Experian Business Credit blog. Most of us are pretty familiar with credit reports and scores, but how many of you are aware of the additional tools available to help you manage the entire credit risk lifecycle? I talk to credit managers everyday and as we’re all trying to do more with less, it’s easy to forget that opening accounts is just the first step. Managing risk on these accounts is as critical, if not more so, than opening them. While others may choose to “ship and chase”, you don’t need to. Proactive alert/monitoring services, regular portfolio scoring and segmentation are key components that a successful credit department needs to employ in the constant battle against “bad” accounts. Use these tools to proactively adjust credit terms and limits, both positively and negatively. Inevitably some accounts will go bad, but using collection research tools for skip tracing and targeting services for debt collection will put you first in line for collections. A journey of 1,000 miles begins with a single step; we have tools that can help you with that journey and all can be accessed online.

At Experian’s recent client conference, Vision 2011, there was a refreshing amount of positive discussion and outlook on origination rates and acquisition strategies for growth. This was coming not only from industry analysts participating in the conference but from clients as well. As a consumer, I’d sensed the ‘cautious optimism’ that we keep hearing about because my mailbox(the ‘original’ one, not email) has slowly been getting more and more credit card offer letters over the last 6 months.   Does this mean a return to prospecting and ultimately growth for financial institutions and lenders? It’s a glimmer of hope, for sure, although most agree that we’re a long way from being out of the woods, particularly with unemployment rates still high and the housing market in dire shape. Soooo…..you may be wondering where I’m going with this…. Since my job is to support banks, lenders, utilities and numerous other businesses’ in their fraud prevention and compliance efforts, where my mind goes is: how does a return to growth – even slight – impact fraud trends and our clients’ risk management policies? While many factors remain to be seen, here are a few early observations: ·         Account takeover, bust out fraud, and other types of existing account fraud had been on the rise while application fraud had declined or stayed the same (relative to the decrease in new originations); with prospecting and acquisition activity starting to increase, we will likely see a resurgence in new account fraud attempts and methods. ·         Financial institutions and consumers are under increasing risk of malware attacks; with more sophisticated malware technology popping up every day, this will likely be a prime means for fraudsters to commit identity theft and exploit potentially easier new account opening policies. ·         With fraud loss numbers flat or down, the contracted fraud budgets and delayed technology investments by companies over the last few years are a point of vulnerability, especially if the acquisition growth rate jumps substantially.  

The end of 2010 was a transitional time for credit card lenders.  Card issuers were faced with the need to jump-start “return to growth strategies” as a result of diminished profits stemming from the great recession and all of the credit tightening actions deployed over the last two years.  Lenders were deliberate in their actions to shrink balance sheets eliminating higher risk customers.  At the same time, risk adverse consumers were, and continue to be, more thoughtful about spending, taking deliberate measures to buy what they perceive to be necessary and able to pay back. Being the only safe bet in town, the super prime universe went from saturated to abundantly over-saturated, and only recently have lenders begun to turn the ship in anticipation of continued relief in default trends.        As a result of sustained relief in credit card defaults and over-saturation in the prime+ space, more lenders have begun loosening policies. This has created price competition with 74% of new offers including low introductory rates for longer durations, averaging 12 months, up from 9 months just one year ago. The percent of annual fee offers decreased as well to 21% from 34% one year prior. Continuing the trend of competing for the prime+ segment, lenders have increasingly been promoting loyalty programs, in many cases, combined with spend-incented rebates. In fact, over a third of new offers were for rewards based products, up from 26% prior to the start of the economic turn in 2007. Lenders are now shifting gears to compete in new ways focusing on consumer demand for payment choices. Regardless of a consumer’s credit profile, lenders and technology providers are investing in innovative payment solutions. Lenders understand that if the Starbucks “My Coffee Card” is only available on their customer’s iPhone, Blackberry or Android using a re-loadable Starbucks app, then traditional card issuers will lose purchase volume. What is becoming more and more critical is a lenders ability to leverage new data sources in their targeting strategies. It is no longer enough to know what products provide the most relevance to consumer needs. A lender must now know the optimal communication channel for unique segments of the population, their payment preferences and the product terms and features that competitively match the consumer’s needs and risk profile. Lenders are leveraging new data sources around income, wealth, rent payment, ARM reset timing and strategic default, wallet spend and purchase timing.Loading...

About a month ago, Senior Decisioning Consultant Krista Santucci and I gave a presentation at Experian’s 2011 Vision Conference on Decisioning as a Service. Due to the positive feedback we received, I thought it might be of interest to members of the communications industry who might not have had the opportunity to attend. A common malady The presentation revolved around a case study of an Experian client. Like many communications industry companies, this client had multiple acquisition systems in place to process consumer and commercial applications. In addition, many of the processes to mitigate fraud and support Red Flag compliance were handled manually. These issues increased both complexity and cost, and limited the client’s ability to holistically manage its customer base. The road to recovery At the beginning of the presentation, we provided a handout that listed the top ten critical functionalities for decisioning platforms. After a thorough review of the client’s system, it was clear that they had none of the ten functionalities. Three main requirements for the new decisioning platform were identified: A single system to support their application processes (integration) A minimum of 90% automatic decisions for all applications (waterfall) The ability to integrate into various data sources and not be resource intensive on their IT department (data access)     Decisioning as a ServiceSM is a custom integrated solution that is easily applied to any type of business and can be implemented to either augment or completely overhaul an organization’s current decisioning platforms. We designed this client’s solution with a single interface that manages both consumer and commercial transactions, and supports a variety of access channels and treatment strategies. Following implementation, the client immediately benefited from: Streamlined account opening processes A reduction in manual processes Decreased demand on IT resources The ability to make better, more consistent decisions at a lower cost The agility to quickly respond to changing market needs and regulatory challenges     Evaluate your own business Do you recognize some of your own challenges in this post? Download our checklist of the top ten critical functionalities for decisioning platforms and evaluate your own system. As you go through the list, think about what benefits you would derive by having access to each of the capabilities. And if you’d like to learn more about Decisioning as a Service, please complete our form.  

By: Kennis Wong  Data is the very core of fraud detection. We are constantly seeking new and mining existing data sources that give us more insights into consumers’ fraud and identity theft risk. Here is a way to categorize the various data sources. Account level - When organizations detect fraud, naturally they leverage the data in-house. This type of data is usually from the individual account activities such as transactions, payments, locations or types of purchases, etc. For example, if there’s a purchase $5000 at a dry cleaner, the transaction itself is suspicious enough to raise a red flag. Customer level - Most of the times we want to see a bigger picture than only at the account level. If the customer also has other accounts with the organization, we want to see the status of those accounts as well. It’s not only important from a fraud detection perspective, but it’s also important from a customer relationship management perspective. Consumer level - As Experian Decision Analytics’ clients can attest, sometimes it’s not sufficient to look only at the data within an organization but also to look at all the financial relationships of the consumer. For example, in the situation of bust out fraud or first-party fraud, if you only look at the individual account, it wouldn’t be clear whether a consumer has truly committed the fraud. But when you look at the behavior of all the financial relationships, then the picture becomes clear. Identity level - Fraud detection can go into the identity level. What I mean is that we can tie a consumer’s individual identity elements with those of other consumers to discover hidden inconsistencies and relationships. For example, we can observe the use of the same SSN across different applications and see if the phones or addresses are the same. In the account management environment, when detecting existing account fraud or account takeover, this level of linkage is very useful as more data becomes available after the account is open. Loading...

The Consumer Financial Protection Bureau (CFPB) is a new regulatory agency that is still evolving. But even now it’s clear that it will have unprecedented powers with a broad reach across industries – including communications. Although there are questions about how the CFPB will operate, there are still steps you can take to prepare. To help you get ready, let’s review a few of the areas you should expect CFPB to affect your business, followed by three questions you can help your customers answer. 3 Ways the CFPB Will Impact Business: Consumer disclosures must be clear and easy to read. The goal is to ensure that financial terms and conditions of services (especially for credit cards and mortgages) are disclosed in clear, easy-to-understand terms that allow consumers to compare offers. Consumer products to be examined rather than industries – Regulatory agencies are typically structured around the kinds of businesses they supervise. With the CFPB, we’ll see a regulator with a perspective more focused on consumer financial products and services. Transparency on how credit scores affect terms & conditions – Greater transparency about credit scores and how they are used to determine loan rates will also be a priority. Lenders are required to disclose a score they used in all risk-based pricing notices and adverse action notices beginning July 21, 2011.   CFPB Takes Authority on July 21 The CFPB receives full regulatory and enforcement authority on July 21, so it’s important for covered entities to continue complying with current law and striving to follow industry best practices. Companies need to demonstrate that they have taken steps to increase consumer credit education and transparency of credit scores, as these items top the CFPB agenda. Experian Consumer Education Resources Experian is addressing the growing need for consumer education by offering Experian Credit EducatorSM, a credit education service in which consumers engage in a one-on-one credit education session with an Experian credit professional agent,  together reviewing  a copy of their credit report and VantageScore® credit score. Answers to 3 Consumer Questions: As part of Experian Credit Educator, consumers learn the answers to three main questions: What’s in a credit report? What is a score, and what types of information can increase or decrease a score? How does credit affect my financial situation?     Experian Credit Educator allows lenders to provide customers a personalized education service, thereby advancing customer engagement while improving customer satisfaction, loyalty, portfolio quality, and cross-sell opportunities. Do you have questions about the CFPB’s role? Leave a comment or contact your Experian representative if you need assistance in complying with new regulatory requirements.

It’s that time of year again – when people all over the U.S. take time away from life’s daily chores and embark upon that much-needed refresh: vacation! But just as fraud activity spikes during the holidays, there are also fraud trends suggesting spikes in fraudster activity during the summer. With consumers on vacation, identity theft becomes easier. Consumers are most likely to break their normal spending trends and break patterns established by fraud analytics; and consumers are less likely to be as attentive to elements that can help minimize fraud while out of town. There has been plenty of research to demonstrate that fraudsters perpetrate account takeover by changing the pin, address, or email address of an account. Now, fraudsters are more likely to add themselves as an authorized user to the account, which may not be considered a high-risk flag in transactional decisioning strategies. By identifying risky behaviors or patterns outside of a consumer’s normal behavior and an engaging in a knowledge based authentication session with the consumer, it is possible to help minimize the risk of fraud. Knowledge based authentication provides strong authentication and can be part of a risk-based approach to on-going account management, protecting both businesses and consumers from being burned, at least by fraudsters, while on vacation.

By: Kari Michel On March 18th 2011 the Federal Reserve Board approved a rule amending Regulation Z (Truth in Lending) to clarify portions of the final rules implementing the Credit CARD Act of 2009. Specific to ability to pay requirements, the new rule states that credit card applications generally cannot request a consumer's "household income" because that term is too vague to allow issuers to properly evaluate the consumer's ability to pay. Instead, issuers must consider the consumer's individual income or salary. The new ruling will be effective October 2011. Given the new direction outlined in the latest rules, we've been hard at work on developing 2 income models to support these regulatory obligations and enhance the underwriting and risk assessment process - Income InsightSM and Income Insight W2SM.  Both income models estimate an individual’s income based on an individual credit report and can be used in acquisition strategies, account management review and collection processes.  Why two models? Income InsightSM estimates the consumer’s total income, including wages, investments, rentals and other income. Income Insight W2SM estimates wages only.  Check them out - and let us know what you think! We want to hear from you.

By: Kennis Wong When we think about fraud prevention, naturally we think about mininizing fraud at application. We want to ensure that the identities used in the application truly belong to the person who applies for credit, and not identity theft. But the reality is that some fraudsters do successfully get through the defense at application. In fact, according to Javelin’s 2011 Identity Fraud Survey Report, 2.5 million accounts were opened fraudulently using stolen identities in 2010, costing lenders and consumers $17 billion. And these numbers do not even include other existing account fraud like account takeover and impersonation (limited misusing of account like credit/debit card and balance transfer, etc.). This type of existing account fraud affected 5.5 million accounts in 2010, costing another $20 billion. So although it may seem like a no brainer, it’s worth emphasizing that we need to have fraud account management system and continue to detect fraud for new and established accounts. Existing account fraud is unlikely to go away any time soon.  Lending activities have changed significantly in the last couple of years. Origination rate in 2010 is still less than half of the volume in 2008, and booked accounts become riskier. In this type of environment, when regular consumers are having hard time getting new credits, fraudsters are also having hard time getting credit. So they will switch their focus to something more profitable like account takeover. In addition to application fraud, does your organization have appropriate tools and decisioning strategy to minimize fraud loss from existing account fraud?  

While the majority of your customers may be consumers, most telecommunications companies also work with a number of business accounts. Understanding business credit scores — and what attributes have the most impact on them — can go a long way in helping you identify good customers as well as better manage risk. The following article was originally posted by Peter Bolin on the Experian Business Credit blog. There are a number of factors that impact business credit risk scores. Keep in mind that most risk models are built using multivariate statistical methods that not only look at each attribute, but also look for the interaction between the attributes. However, there are three general factors that will impact a business score. Recency: How recently has the business been delinquent? Events that have happened recently tend to be most predictive of business behavior in the near future. For example being days beyond credit terms (DBT) in the past 30, 60, and 90 days will tend to negatively impact, on average, a business’s credit score versus those that are current. Frequency: How frequently is the business delinquent or applying for credit? If a business has multiple beyond terms events then the algorithm will reflect this behavior and will tend to impact the score to the low side. In addition, if a business is frequently applying for credit (called inquires) then this will also negatively impact the score. Monetary/Usage: How large is the debt burden? Businesses that carry large balances in relation to credit limits tend to be more risky than those that carry lower balances in relation to credit limits. This is called the utilization ratio or balance-to-limit ratio. As the debt burden increases interest payments also grow placing more stress on cash flows. This tends to negatively impact a business’ risk score. Please comment on this post to let me know of specific topics you want to hear more about.

The next time a consumer asks about his or her credit score, consider it an opportunity. Recent changes to the Risk-Based Pricing (RBP) rule may provide new opportunities to strengthen relationships by educating consumers about what their credit scores mean, how they’re used, and how they can be improved. For many lenders and other businesses, this could be the first time they’ve had a chance to speak directly and openly with customers about their credit scores. The RBP rule is intended to improve financial literacy As we’ve discussed, the Risk-Based Pricing Rule was instituted in response to policymaker concerns that consumers were not being sufficiently informed of the impact that credit reports can have on their annual percentage rate (APR). Now, when a lender makes a credit decision based on a consumer credit report and does not offer the best possible rate, or denies credit, the RBP Rule requires lenders to notify the customer about the decision – through either an explanation of the rate offered or disclosing a credit score. New requirements take effect on July 21 RBP compliance is changing following recent passage of the Dodd-Frank Wall Street Reform and Consumer Protection Act. Companies will now be required to provide all customers with a credit score within a Risk Based Pricing Notice, along with educational material. The new requirement is effective July 21, 2011. This is also the date when the new Bureau of Consumer Financial Protection (CFPB) is set to be fully operational. How to prepare for consumer questions about credit scores Experian offers a number of resources to help lenders answer consumer questions. Online resources, including the Ask Experian column and our extensive Credit Education section, provide fundamental information to help consumers better understand credit scores and credit reports. The Experian Credit Score Basics booklet, plus more than 20 other educational documents, are available electronically and formatted for easy printing and distribution. All documents, PowerPoint presentations, virtual seminars and education videos are available on a free mini-disk. Customized training and education is available The Experian Public Education team can also provide customized, live Internet-based training and education for our clients’ employees to help them effectively answer customer questions about credit reports and credit scores. For a free mini-disk or more information about training events, please contact Rod Griffin, Experian’s Director of Public Education, at 1 (972) 390-3528, or email clientcorner@experian.com. Take a moment to check out our Risk-Based Pricing microsite, too. Note: While Experian is happy to provide our observations related to the new Risk-Based Pricing Rule, please work with your own legal counsel to ensure that you comply with your obligations under the rule.