Data breach industry predictions High-profile data breaches dominated the headlines in 2017, and unfortunately, these attacks are anticipated to only increase in frequency and magnitude in 2018. Breaches like those that affected LinkedIn, Dropbox and Yahoo, serve as a wake-up call for organizations to implement processes for safeguarding sensitive data and defending against attacks. However, for every advancement in cybersecurity, cybercriminals become more sophisticated in their techniques. Just when it seems like we have learned our lesson from one breach, another, more significant one occurs. As cybercriminals continue changing the rules mid-game, it has become clear that while they’re playing chess, we’re still playing checkers. To help better prepare you and your organization for potential cyber threats, our team has put together its yearly data breach industry predictions on the issues and trends surrounding data security in 2018. Here are our five predictions for 2018: The U.S. may experience its first large-scale attack on critical infrastructure, disrupting governments, companies and private citizens. Failure to comply with new EU regulations will result in large penalties for U.S. companies. Perpetrators of cyber-attacks will continue to zero in on governments – this could lead to a shift in world power. Attackers will use artificial intelligence (AI) to render traditional multifactor authentication methods useless. Vulnerabilities in Internet of Things (IoT) devices will create mass confusion, leading to new security regulations. Download our complimentary report to learn more about how these trends will shape the coming year, see how we scored against our 2017 predictions, and check out our new section revisiting predictions dating back to our inaugural 2014 report.

“Are we next?” That’s the question companies around the world are grappling with as more high-profile data breaches make headlines. At a time when one in four organizations experience cyber-attacks, mishandling the response can do more damage than the breach itself. We take precautions against dangerous situations every day. With years of practice either in school or at work, most of us know what to do if there’s an emergency. We conduct drills repeatedly because when we immediately know how to respond to a threatening situation, we can minimize destruction. Because of the high probability of a cyber-attack, businesses need to treat breach responses like internal drills, repeatedly practicing until it becomes instinctive. Prepare your data breach response drill A well-prepared incident response strategy should first define all breach scenarios (e.g., ransomware, malware, phishing, etc.) and their specific steps. Assembling a qualified team is also critical, individual roles and responsibilities should be defined and clearly communicated. After finalizing the essential components of your incident response plan, regular testing is crucial to ensuring your organization is equipped to handle the unexpected. Practice makes perfect Below are six principles to help guide your data breach response drill effectively: Bring in an outsider. Enlist the expertise of someone outside your organization to run the drills and serve as a moderator. A third-party facilitator allows you and your team to focus on individual tasks and responsibilities. Put aside plenty of time. At a minimum, give your team half a day to do the exercise and to debrief. It’s an exercise for everyone. All internal and external team members who will be involved in a data breach response need to participate in this activity. Expect the unexpected. Your drills should include various likelihoods and situations. Another benefit to bringing in an outside moderator is that they can throw unpredictable scenarios at your team. Debrief. After the exercise, the entire team should review, discuss each mock situation in detail, and identify any areas in need of improvement. Repeat every six months. Keep your team aware of the latest developments in the world of cybersecurity and prepared to tackle cyber threats by conducting drills every six months. Executing these drills are invaluable and help prove to your stakeholders, customers and employees that your company takes data security seriously. The more you practice putting your plan into action, the better prepared you’ll be in a real-life situation. Visit our website for more information about our offerings and how Experian can help you prepare and respond to data breaches.

Traditional verification and validation parameters alone are not enough to stop identity fraud. Fortunately, there are many emerging trends and best practices for modern fraud and identity strategies: Applying right-sized fraud and identity proofing solutions to reduce user friction and manage fraud risk appropriately. Maintaining a universal user view by employing diverse breadth and depth of data assets and applied analytics. Expanding the user view through a blended ecosystem by collaborating with vendors, peer agencies, and partners in identity and fraud management. The future of identity proofing is more than just verifying individual identities. Check out our tip sheet linked below for more strategies. Modernize your fraud and identity strategies>

  The journey to a mortgage is complex and expensive, so of course the transaction will require more than a few swipes on a smartphone. The U.S. existing home median sales price in October was $274,000 – not cheap. Still, with advancements in digital verification, lenders can dramatically accelerate the process, providing benefits to both their own operations and the consumer mortgage experience. Underwriting a sizeable loan can take weeks with the task of collecting income and asset documents to analyze and verify. In fact, one source from the Mortgage Bankers Association says the average mortgage application has ballooned to 500 pages. The consumer is typically asked to find, print and scan papers revealing insights around employment status and wages, bank and retirement accounts, debts and beyond. The good news is that this process can be handled digitally, and I’m not talking about simply scanning and emailing. Verification solutions exist to enable consumers to grant limited and secure access to digitally verify assets and income. As lenders evaluate verification solutions, one of the key differentiators to seek is Fannie Mae Day 1 Certainty, which claims to slash the average cycle time for income validation by 8.1 days, employment validation by 11.9 days, and asset validation by 6.1 days. * Fannie Mae features a list of approved vendors who provide Fannie Mae-approved verification reports. This group of authorized suppliers receive freedom from representations and warranties for more efficient risk management, and additionally receive the benefit of a more streamlined process through Fannie Mae’s Desktop Underwriter® (DU®). DU’s latest enhancement leverages a verification of asset report derived from aggregated bank account data, something Finicity (an Experian partner) is approved to utilize. Building on Day 1 Certainty, Finicity is participating in a new single source pilot with Fannie Mae to validate income, assets and employment. While it will take time for lenders to embrace this new technology – and consumers will need to feel comfortable granting the digital access and understanding how the process works – the thought is the mortgage journey will become faster and offer an optimized borrower experience. Like so many other aspects in our lives, mortgage is bound to go digital. *Average days saved reflects data captured between January 2017 and June 2017.

Alternative Data Shedding New Light on Consumers Why Investors Want Alternative Data Banks and Tech Firms Battle Over Something Akin to Gold: Your Data Alternative data for credit has created national headlines in the past year and a lasting buzz in the financial services world. But what exactly qualifies as alternative data in credit? How can it benefit lenders? Consumers? Ask two people these questions and you may get very different answers. Experian defines alternative data as FCRA-compliant data points that are not typically considered when evaluating a potential customer’s creditworthiness. These data points may include rent payments; utility payments, including gas, electric; telecommunications payments, such as mobile telephones; insurance payments; and any other recurring financial obligations. Taking these alternative data points into account can benefit consumers and lenders in multiple ways. Consider that roughly 45 million Americans have either no credit history, or a credit history that is too scarce or outdated to manufacture a credit score. This group of consumers includes not only minority consumers or those from low income neighborhoods, but also the shared economy workforce and millennials without traditional credit histories. Some estimate 121 million U.S. adults are credit-challenged with thin-to-no credit file and subprime credit scores below 600. “People with little or no credit history, or who lack a credit score, have fewer opportunities to borrow money to build a future, and any credit that is available usually costs more,” said Richard Cordray, while he was director of the Consumer Financial Protection Bureau. Indeed, these consumers are in a catch-22; many lenders will not lend to consumers with credit scores of under 620. In turn, these consumers have trouble building credit, and they are blocked from achieving goals like buying a car, owning a home or starting a business. By combining credit reports with alternative data, a more complete picture of subprime, near-prime and thin-file consumers can develop. And analysis of this data can help lenders evaluate a consumer’s ability to pay. When alternative data like rent payments and an individual’s short term lending history are trended appropriately, it can be an accurate predictor of an individual’s financial behavior, and can be an important step toward promoting greater financial inclusion for more consumers. In addition to using alternative data in underwriting, lenders can leverage the data to help with: Expanding the prospecting universe. Data can be used to enrich batch prospecting decisioning criteria to identify better qualified prospects, suppress high-risk consumers, and offer a more complete borrowing history Account review. Alternative data can help signal a consumer’s financial distress earlier, better manage credit lines and grow relationships with existing consumers. Collections. Identify consumers who are rebuilding credit with specialty finance trades, or who are exhibiting high-risk behaviors in the alternative financial services space. More info on Alternative Credit Data More Info on Alternative Financial Services

For most businesses, the customer experience is at the heart of every strategy. Debt collection shouldn’t be different. Here’s why: 21% of visits to an online debt recovery system were made outside the traditional working hours of 8 a.m. to 8 p.m. Of the consumers who committed to a repayment plan, only 56% did so in a single visit. PricewaterhouseCoopers reported that 46% of consumers use only digital channels to conduct banking, avoiding traditional offline channels. Conversely, data collected by Gallup between 2013 and 2016 showed that 48% of American banking customers would only consider using a bank that offered physical branches. The debt collection process is an often-overlooked opportunity to build customer relationships and loyalty. Leverage data and technology to replace outdated approaches, minimize charge-offs and create environments that value each customer. Learn more>

It’s no secret. Consumers engage and interact with brands through a variety of channels, including email, direct mail, websites and mobile. And since most organizations work to keep the consumer experience at the core, they tend to invest in an omnichannel approach that caters to the consumer’s preferences. The lone exception may be during the collections process. Often, once an account falls behind on payment, the consumer experience falls behind with it. But should it? While many banks and financial institutions view the collections process merely as an opportunity to collect outstanding debt, the potential is much more. If treated effectively, the collections process can present an opportunity to develop a positive customer relationship that builds loyalty over time. If handled poorly, the collections process could cost an organization a number of lifetime customers. To correct this, banks and financial institutions need to implement the same omnichannel approach in the collections process as they do with every other consumer interaction. Collections can no longer be treated as a linear process that leads from one channel to the next. There needs to be a more personalized touch — communicating with consumers through preferred channels, contacting them at the most opportune times. Sound complex? Sure. But consider a recent Experian analysis that invited consumers to establish a nonthreatening dialogue with an online debt recovery system. The analysis revealed 21 percent of visits to an organization’s website were outside the traditional working hours of 8 a.m. to 8 p.m. Furthermore, of the consumers who committed to a repayment plan, only 56 percent did so in a single visit. Each consumer is different. So is each situation. And banks and financial institutions need to acknowledge those differences. Luckily, technology can address the complexities of an omnichannel and personalized approach. Platforms such as Experian’s PowerCurve® Collections enable banks and financial institutions to simplify the collections process for both the consumer and the organization. By treating the collections process the same as any other stage in the consumer journey, organizations have an opportunity to build a relationship. And to do so, banks and financial institutions need to leverage the data and technology at their disposal. If they do so appropriately, they’ll minimize their charge-offs and also create a lifetime customer. To learn more about leveraging the collections process to build customer loyalty, download our white paper Getting in front of the shift to omnichannel collections.

Experian on the State of Identity podcast In today’s environment, any conversation on the identity management industry needs to include some mention of synthetic identity risk. The fact is, it’s top of mind for almost everyone. Institutions are trying to scope their risk level and identify losses, while service providers are innovating ways to solve the problem. Even consumers are starting to understand the term, albeit via a local newscast designed to scare the heck out of them. With all this in mind, I was very happy to be invited to speak with Cameron D’Ambrosi at One World Identity (OWI) on the State of Identity podcast, focusing on synthetic identity fraud. Our discussion focused on some of the unique findings and recommended best practices highlighted in our recently published white paper on the subject, Synthetic identities: getting real with customers. Additionally, we discussed how a lack of agreement on the definition and size of the synthetic identity problem further complicates the issue. This all stems from inconsistent loss reporting, a lack of confirmable victims and an absence of an exact definition of a synthetic identity to begin with. Discussions must continue to better align us all. I certainly appreciate that OWI dedicated the podcast to this subject. And I hope listeners take away a few helpful points that can assist them in their organization’s efforts to better identify synthetic identities, reduce financial losses and minimize reputation risks.

The credit card marketplace is a crowded and complex landscape. Recent research by Experian shows the average U.S. consumer has 3.1 credit cards and 2.5 retail cards, with an average balance of $6,354 and $1,841, respectively. So how can you build upon your existing customer relationships and offer the right products to the right people at the right time? By understanding consumer behavior. Pretty simple concept. But targeting viable consumers and making enticing offers takes some detective work. Gone are the days of demographic-based approach to audience segmentation for credit marketing campaigns. Consumers are now engaged on their smartphones, laptops, tablets, fitness bands, across countless apps, browsers, emails and more. Simply knowing a person’s gender and age doesn’t provide any information about how he spends the day, his consumer behaviors, personal interests, unique wants or needs. Developing rich consumer personas based on transaction credit data can be a powerful tool to understanding consumers so lenders can design more relevant and personalized credit offers, experiences and products to a very targeted audience. Experian DataLabs can help by analyzing transaction data to understand the consumers in your portfolio. For example, looking at your portfolio of 40-year-olds in the U.S. provides basic demographic information. A closer look at transaction data could reveal unique details within the age group to help you group and target, such as: Frequent travelers: These road warriors log serious miles. If they’re not traveling for work, they’re cashing in miles for vacation. This unique group leads your portfolio in airfare, cruise line, car rental, hotel and travel agency spend. With so much time spent away from home, this group is rarely found in grocery stores. Local business owners: Advertising, computer equipment, and software are typical expenses of this segmented group. There may be an opportunity to capture spend outside their business activity or to ensure they have the right card to fit their business needs. Constant commuters: These consumers use their card for local travel and transportation. And they are less likely to use their card for expenses related to other types of travel or maintaining a vehicle. After a long day, they like to grab a drink while waiting for the train. Online Shoppers: Consumers in this group use their card with various online merchants, including Amazon, Etsy, iTunes, and PayPal. Online shoppers are also above average spenders in elementary education, child care services, and family clothing. Social hipsters: They can be found meeting with friends for coffee and drinks, and are more likely to rely on local transportation and tend to eat out instead of cooking in. Effective audience segmentation ensures that your marketing dollars are invested in real people who are most likely to respond on certain media, have already expressed an interest in your product, and are geographically accessible to a specific retail location. Every campaign should be as dynamic and unique as its consumers. The powerful combination of consumer and transaction data allows you to customize audience segments to maximize customer engagement and drive campaign success.

Sophisticated criminals work hard to create convincing, verifiable personas they can use to commit fraud. Here are the 3 main ways fraudsters manufacture synthetic IDs: Credit applications and inquiries that build a synthetic credit profile over time. Exploitation of authorized user processes to take over or piggyback on legitimate profiles. Data furnishing schemes to falsify regular credit reporting agency updates. Fraudsters are highly motivated to innovate their approaches rapidly. You need to implement a solution that addresses the continuing rise of synthetic IDs from multiple engagement points. Learn more

As we enter the holiday season, headlines abound around the shifts and trends in retail. How are consumers shopping? What are they buying online versus in-store? How can retailers maintain share and thrive? To gain some fresh perspective on the retail space, we interviewed John Squire, CEO and co-founder of DynamicAction, a business featuring advanced analytics solutions designed specifically for eCommerce, store and omnichannel retail teams. Squire has had a tenured career in the retail and technology sectors serving in key executive roles for IBM Smarter Commerce and Coremetrics. He has spent the past decade guiding nearly every retail brand to a better understanding of their customers and utilization of their data to make profitable decisions.  Business headlines claim we are in the midst of a retail apocalypse. Is this statement a reality?  The reality is that retail is in a renaissance – a revolution driven by the most empowered, connected consumer in history, a burgeoning technology infrastructure and retail tech innovators who have disrupted the status quo. The most agile of retailers and brands are leaning forward to serve their customer with remarkable experiences in the store, online and anywhere the customer decides to interact with the brand. And for those retailers, the days ahead are filled with newfound opportunity. However, the retailers and brands who don’t have a strong core purpose beyond being filler between anchor stores may no longer have a place in this new world of retail. The strongest retailers and brands will tap into their wealth of customer data to better understand, and therefore better serve their customers, creating long-term relationships. They should only continue gain in strength as consumers concentrate more and more of their time (and wallets) with businesses that passionately focus on their unique needs and buying patterns. It seems like shoppers are increasingly turning online to make their purchases. Is this the case, and do we see seasonal spikes with this trend? The key for successful retailers is to understand that customers aren’t just searching, browsing, buying and returning online OR in-store. They are shopping online AND in-store … and even online while in-store. Shoppers simply do not see channels, and the sooner that retailers reorganize their mindset, their organizations and their data understanding around this reality, the more successful they will become. Shoppers are indeed moving online with increasing frequency and larger amounts of their overall spending. Connecting data across the enterprise, across their partners and across social channels is critical in enabling their retailing teams to make decisions on how best to simultaneously serve their customers and their company’s shareholders. If retailers have a store credit card to offer to consumers, how can they encourage use and get them to maximize spend? Are there particular strategies they should employ? As with any loyalty program or service item, consumers are looking for tools and offers they value. Therein lies the opportunity and the challenge. Value can come in many forms, depending on the individual. Does the credit card offer travel or retail points, or dollars that they can accumulate? Does the credit card save them time? Provide them with additional purchasing power? Reduce their friction of making large purchases? Increase the security of the initial purchase and long-time use of the product or service? The competition for just a consumer’s current and future wallet is being upended by retailing offers that are serving up entertainment, services, convenience and broader product selections. Understanding the high-value activities correlated to their VIP consumers generating the highest amount of profit for the business is the essential to building strategies for encouraging card use. Beyond online shopping, are there other retail trends you see emerging in the coming year? What excites you about the space? Online shopping is not a trend; it is retail’s greatest disruption of the last 100 years. Digitization of shopping in both the online and store setting is what thrills me. One to watch is Wal-mart. The company is taking a highly energized track to build a business of next-gen brands and using their supply chain acumen to battle Amazon, while simultaneously gaining huge amounts of market share from other less sophisticated and strong retailers. In addition, seeing how next-gen brands like Warby Parker, Everlane, Untuckit, Bonobos, Indochino and Rent the Runway are rapidly building out a store experience, albeit radically different than the stores of the past, is exciting to watch. Seeing the growth in Drone deliveries outside the US for retail and commercial applications is surely the next big jump for ‘Next Hour’ in-home delivery. Made-to-order with a very short lead-time is also a big trend to keep an eye on. However, what excites me most in the industry is the universal mind shift that is becoming undeniable in retail: that data understanding and action will be the very basis for customer centricity and companies’ growth. Retailers have had access to these data pools for ages, but the ability to sync the data sets across channels, make sense of the findings and take action at the speed the consumer expects is truly the next leap forward for great retailers. To learn more about the state of retail credit cards, access our latest report.

With 81% of Americans having a social media profile, you may wonder if social media insights can be used to assess credit risk. When considering social media data as it pertains to financial decisions, there are 3 key concerns to consider. The ECOA requires that credit must be extended to all creditworthy applicants regardless of race, religion, gender, marital status, age and other personal characteristics. Social media can reveal these characteristics and inadvertently affect decisions. Social media data can be manipulated. Individuals can represent themselves as financially responsible when they’re not. On the flip side, consumers can’t manipulate their payment history. When it comes to credit decisions, always remember that the FCRA trumps everything. Data is essential for all aspects of the financial services industry, but it’s still too early to click the “like” button for social media. Make more insightful decisions with credit attributes>

The sheer range of dynamic and emerging fraud tactics can impede agencies from achieving security. These threats must be met with a variety of identity proofing and management tactics. Without monitoring, performance assessments and tuning, a singular and static identity proofing strategy can be exposed by evolving schemes and the use of high-quality compromised identity data. Traditional verification and validation parameters alone are simply too obtuse and can be circumvented easily by those with criminal intent. Static rules based on overly simplistic verification and validation checks can be outsmarted by intelligent fraudsters. Conversely, those same static rules must also have built-in mechanisms to accommodate true-name users who initially may not meet that criteria for identity proofing. Vast and diverse user populations, more arduous — and arguably more difficult to achieve — digital identity guidelines put forth by the National Institute of Standards and Technology, and operational constraints all pose significant challenges for government. But there are ways for government to modernize identity proofing successfully. Modern fraud and identity strategies There are many emerging trends and best practices for modern fraud and identity strategies, including: Applying right-sized fraud and identity proofing solutions. To reduce user friction or service disruption and manage fraud risk appropriately, agencies need to apply fraud mitigation strategies. Such strategies reflect the cost, measured risk and level of confidence, as well as compliance needed, for each interaction. This is called right-sizing the fraud solution. For example, agencies can cater a fraud solution that ensures a seamless experience when a citizen is calling a service center, versus an online interaction, versus a face-to-face one. Maintaining a universal view of the user. Achieved by employing a diverse breadth and depth of data assets and applied analytics, this tactic is the core of modern fraud mitigation and identity management. Knowing the individual user extends beyond a traditional 360-degree view. It means having knowledge of a person’s offline and online behavior, not only with your agency, but also with other agencies with which that user has a relationship. Expanding user view through a blended ecosystem. Increasingly, agencies are participating in a blended ecosystem — working with vendors, peer agencies and partners. There exists a collaborative culture in identity and fraud management that doesn’t exist in more competitive commercial environments. Fraudsters easily share information with one another, so those combatting it need to share information as well. Achieving agility and scale using service-based models. More agencies are adopting service-based models that provide greater agility and response to dynamic fraud threats, diverse population changes, and evolving compliance requirements or guidance. Service-based identity proofing provides government agencies the benefit of regularly updated data assets, analytics and expertise in strategy design. These assets are designed to respond to fraud or identity intelligence observed across various markets and industries, often protecting proactively rather than reactively. Future-proofing fraud solution choices. Technical and operational resources are always in relatively short supply compared to demand. Agencies need the ability to “code once” in order to expand and evolve their fraud strategies with ease. Future-proofing solutions must also be combined with an ever-changing set of identity proofing requirements and best practices, powered by a robust and innovative marketplace of service providers. The future of identity proofing in the public sector is more than just verifying individual identities. New standards in digital identity proofing are a responsive result of mass data compromise and failures in legacy techniques. Achieving compliant and confident identity assurance requires a layered approach, flexibly designed and orchestrated to accommodate diverse identity assertions, evidence, and contextual invocation of technologies and data assets. Government must now use risk-based approaches and mitigation strategies to identity threats quickly and determine the type of fraud before damage is done. Download our recent report in which we discuss the primary challenges of identity proofing in the public sector and what modernization of identity proofing looks like.

  Juniper Research recently recognized Experian as a Fraud Detection and Prevention Market Leader in its Online Payment Fraud Whitepaper. Juniper also shared important market insights in the report. The transactional value of card-not-present fraud is estimated to reach $19.3 billion in 2022. Online payment fraud is anticipated to grow 13.7% annually from 2017 to 2022. Digital banking fraud should reach $7.9 billion by 2022. $50.9 billion is expected to be spent on fraud detection and prevention software between 2017 and 2022. Fraud’s not going away anytime soon. Protecting your organization and customers is the new cost of doing business. Don’t wait until 2022 to start protecting yourself. Read the report>

The data to create synthetic identities is available. And the marketplace to exchange and monetize that data is expanding rapidly. The fact that hundreds of millions of names, addresses, dates of birth, and Social Security numbers (SSNs) have been breached in the last year alone, provides an easy path for criminals to surgically target new combinations of data. Armed with an understanding of the actual associations of these personally identifiable information (PII) elements, fraudsters can better navigate the path to perpetrate identity theft, identity manipulation, or synthetic identity fraud schemes on a grand scale. Using information such as birth dates and addresses in combination with Social Security numbers, criminals can target new combinations of data to yield better results with lower risk of detection. Some examples of this would be: identity theft, existing account takeovers, or the deconstruction and reconstruction of those PII elements to better create effective synthetic identities. Experian has continued to evolve and innovate against fraud risks and attacks with an understanding of attack rates, vectors, and the shifting landscape in data availability and security. In doing so, we’ve historically operated under the assumption that all PII is already compromised in some way or is easily done so. Because of this, we employ a layered approach, providing a more holistic view of an identity and the devices that are used over time by that identity. Relying solely on PII to validate and verify an identity is simply unwise and ineffective in this era of data compromise. We strive to continuously cultivate the broadest and most in-depth set of traditional, innovative and alternative data assets available. To do this, we must enable the integration of diverse identity attributes and intelligence to balance risk, while maintaining a positive customer experience. It’s been quite some time since the use of basic PII verification alone has been predictive of identity risk or confidence.  Instead, validation and verification is founded in the ongoing definition and association of identities, the devices commonly used by those individuals, and the historical trends in their behavior. Download our newest White Paper, Synthetic Identities: Getting real with customers, for an in-depth Experian perspective on this increasingly significant fraud risk.