Best Practices for Educating & Protecting Your Members in Light of the Equifax Breach

Transcription

1 Best Practices for Educating & Protecting Your Members in Light of the Equifax Breach October 10, 2017 Presented by: Ann Davidson, VP of Risk Consulting at Allied Solutions & Sally King, Co-founder of NXG Strategies

2 Agenda Latest updates on the Equifax data breach Update on potential fraud exposure What you and your members need to know Key takeaways Q & A

3 Equifax Data Breach Representative Greg Walden was perhaps the harshest in his criticism: I don t think we can pass a law that fixes stupid, he said. Walden further compared the breach to a robbery at Fort Knox, saying Equifax had forgot to lock the doors and failed to notice the thieves were emptying the vaults. Equifax warned of vulnerability but failed to fix it Waited 40 days to tell the public about the data breach! 145 million consumers are at risk! That s what we know today.

4 Polling Question Have you posted or sent out information to your members on the Equifax data breach? Yes No Not Sure

5 Polling Question Do you have a written data breach plan in place? Yes No Not Sure

6 Why is Equifax Different from Other Card Breaches? It is the largest breach to date, with million individuals at risk Neither you nor your members can replace the data that was exposed: Members' name Members' date of birth Members' social security number Members' drivers license number Card numbers (for some of the breached records) In a card breach, you can block and reissue a new card number

7 Equifax Data Breach Vulnerabilities Credit union and member alerts! Be aware of increased phishing attempts using: Phone Text Don t respond, click links or open attachments! How are you authenticating your members today?

8 Fraud Risk Exposures Authentication Risk Identity theft (subsequent identity fraud) New account and account takeover Account takeover leads to money in the bad guys pockets Transaction Risk Payment card fraud debit and credit (card/card number) ACH ODFI & RDFI debit and credit items Wire incoming/outgoing/recurring Paper check deposits Loan fraud Digital fraud A2A, P2P, home banking, bill payment, remote deposit

9 Best Practices for Equifax Data Breach Monitor and follow up on the data breach Uncover and report the fraud type Review your fraud monitoring reports on all fraud Work closely with your vendors to respond immediately Watch closely for subsequent fraud attacks Equifax data breach is high risk Utilize solutions to help respond to your member risk of identity theft Continue to educate both internal staff and external accountholders what to watch. Education is key!

10 Risk Mitigation for Members Monitor all credit accounts and loans Immediately report suspicions Set password/passcode on accounts Set lower daily dollar limits on accounts Watch activity daily Sign up for alert notifications Sign up for the credit bureaus fraud alerting services Sign up for free credit monitoring services Place a freeze on all three credit bureau accounts Sign up for identify theft Stay informed about what happened and what to do

11 New Account Fraud Management Validate all new account information Watch for any type of immediate wire, ACH or new loan requests. Watch for full service deposits at an ATM with immediate withdrawals Verify how cards are being activated Limit the dollar amount on outgoing wires, ACH, and debit card transactions Educate new account holders to be cautious when entering their accounts online and to require personal info not compromised in the breach for account access Recommend that new members create a required password/passcode for access to their accounts

12 New Account Fraud Management Limit the dollar amount on loans Implement multiple layers of authentication; consider using biometrics, security tokens or device authentication Perform extensive authentication prior to approving loans Institute a waiting period on loan, debit card or product applications Require strong passwords for account access Review each new applicant's credit reports in detail Use other authentication measures to confirm the ID is real Train employees about red flags of new account fraud and loan fraud on and ongoing basis Network with peers in the industry if you think a new loan applicant or new account applicant seems suspicious

13 Key Takeaways Better understanding of: Equifax breach Types of potential fraud exposure Action steps to stay aware of what could happen next Solutions to respond to and recover from the Equifax data breach Education, understanding, sharing and networking is key to help all of us work together in order to stay ahead of the fraudsters!

14 Identity Protection in the Post-Equifax Breach World

15 Data Breach Totals Since ,073,490,127 FOUR TIMES the number of adults in the U.S. Yahoo! 3 billion, December 2016 MySpace 360 million May 2016 Equifax million, September 2017 EBay 145 million, May 2014 Target 110 million, November 2013 LinkedIn 100 million, May 2016 AOL 92 million, October 2007 JP Morgan Chase 83 million, October 2013 Anthem 76 million, February 2015 Sony PlayStation Network 77 million, April 2011 Home Depot 53 million, September 2014 TJ Maxx 45.7 million 2007 Ashley Madison, 32 million, August 2015 OPM 21.5 million, July 2015 Experian (T-mobile) 15 million, October 2015 Scottrade 4.6 million, October 2015 UCLA Health 4.5 million, July 2015

16 Additional Recent Breach Incidents September 21 the Securities and Exchange Commission (SEC) disclosed that hackers breached its Electronic Data Gathering, Analysis and Retrieval (EDGAR) system through a software vulnerability and the stolen data was possibly used for illegal stock trading. September 25 Deloitte hit by a cyber-attack, revealing clients non-public information. Hackers possibly accessed usernames, passwords and personal details of the firm s blue-chip clients. Per media reports, the account access authentication simply required a single password and did not have a two-step verification.

17 Cyber Crime is Soaring Compounded annual growth of detected security incidents around the world has increased 66% year-over-year since 2009 Worldwide there are millions of cyber-attacks detected each day Carried out by sophisticated criminal enterprises Source: The Global State of Information Security Survey 2015, a worldwide survey by CIO, CSO and PwC

18 Over 10 billion attacks per day Source: 30 Sept Live cyberattack map showing the top.1% of reported attacks (avg. over 10 million per day) that s a total of over 10 BILLION attacks per day worldwide

19 Monetizing Stolen Data Date of Birth $11 Set of online service credentials $19 Health insurance credentials $20 Credit card with mag stripe or chip data (with freshness date) $20 Name, address, SSN and DOB $15-65 Set of business account credentials $ Loan application/portfolio $250 Sources: 2015 Trend Micro the Global Black Market Prices for US Data SecureWorks Underground Hacker Markets Annual Report, April 2016.

20 Monetizing Stolen Logins itunes Account User Name/Password $11 Fedex.com, Continental.com and United.com accounts $6 Groupon credentials $5 GoDaddy.com, ATT.com, Sprint.com, Verizonwireless.com, Tmobile.com and other wireless provider accounts $4 Facebook and Twitter logins $2.50 Dell.com, overstock.com, Walmart.com, tesco.com, bestbuy.com and target.com $1.50 Sources: 2015 Trend Micro the Global Black Market Prices for US Data SecureWorks Underground Hacker Markets Annual Report, April 2016.

21 Where Criminal Activity Lives 1 % 99% Image licensed for use by NXG Strategies, LLC Surface Web Deep Web Dark Web Google, Facebook, Amazon, Twitter, Instagram, All Search Engines Database-Driven Information (Academic Information, Medical Records, Govt Docs, Intranets) Stolen Data Trafficking through Online Criminal Storefronts, Drug Trafficking, Terrorist Group Communications, etc.

22 Online Criminal Data Merchants Online stores sell stolen card numbers, and print and sell with plastic Includes fake chip (i.e. fallback) Sold by quantity ( dumps ) Grouped by state Grouped by BIN Includes freshness date Check-out with Bitcoins, Western Union, Money Gram Advertised sales Money-Back guarantees Operated from countries with no extradition treaty with U.S.

23 Examples: Criminal Storefronts From:

24 Source: Federal Trade Commission Criminals will post samples of stolen data on websites in order to make the data public as an advertisement. How fast will identity thieves use the stolen info? Answer: 9 minutes

25 FTC Research Study May fake consumers in a database were loaded to a website used by hackers to make stolen credentials public Names, addresses, addresses, phone numbers and payment information (bitcoin wallet, credit card or online payment service) There were 1,200 attempts to use the stolen data, beginning only 9 minutes after posting Thieves tried to buy clothing, games, online dating memberships and even pizza Two-factor authentication prevented the thieves from being successful

26 Dark Web Scan Offers 26

27 Dark Web Monitoring Monitors malicious command and control networks, black market forums, known compromised machines and servers, phishing networks and exploited websites SSN, Name, Address, DOB address, user name, passwords Other credentials Credit card numbers Bank account numbers Passport number Insurance contract numbers Professional license numbers Gaming credentials Other identifying information

28 EXAMPLE: Compromised Corporate /Passwords Actual dark web search of one bank s (Includes number of user names/passwords found using financial domain and to which hack it was attributed)

29 Not All Dark Web Monitoring is Alike Some services use non-malicious Botnets (internet robots) scour the surface web looking for exposed data. Others use both botnets and human operatives who infiltrate criminal networks to gather stolen data, compare transactions and determine common points of compromise to alert an organization of a breach. Dark web monitoring uses the rich cache of data collected by botnets AND operatives to alert registered consumers. YAHOO BREACH: Dark Web Monitoring notified hundreds of thousands of Yahoo users with Dark Web Monitoring about the breach 6 months before the official announcement from Yahoo.

30 30

31 High Risk Transactions Monitoring Monitors for Knowledge-Based Authentication process during a high risk transaction in a network of participating organizations Provides an alert if the credentials used match a registered subscriber Consumer can respond with me or not me Not me response goes back to the organization conducting the transaction Online authorization Account management activity Password reset Online transfer Online purchase Loan application Medical billing request Address change Fraud inquiry New accounts Change of account ownership

32 Credit Freeze Restricts access to your credit report Must request to lift the freeze if applying for a job, renting an apartment, buying insurance, etc. Contact EACH agency (Equifax, Experian, TransUnion) Supply your name, address, date of birth, SSN and other personal information. Fees vary based on where you live, but commonly $5 - $10 Receive PIN (personal identification number) or password from EACH agency or password. Keep this in a safe place. You will need it if you choose to lift the freeze. To lift you must contact all three bureaus unless you know which bureau(s) a potential employer, creditor or insurance company will contact for your report.

33 Credit Monitoring Monitors for changes in your credit file and alerts of the change typically via and SMS text message One bureau or three bureau monitoring available Does NOT provide an alert of account takeover Does NOT provide an alert of noncredit identity theft, which more than half of all identity theft

34 Federal Trade Commission Report Financial Fraud Total: 50% Non-Financial Fraud Total: 71% Based on 399,225 consumer complaints. NOTE: 25% of identity theft complaints have more than one type of identity theft Source: Federal Trade Commission Consumer Sentinel Report, February 2017

35 Professional Identity Recovery CASE ASSIGNMENT Dedicated Identity Recovery Advocate assigned upon case submission Victim provided direct /phone No time limit for recovery INITIAL CONTACT & RESEARCH Assist with fraud alert placement Assist with police report filing Credit reports reviewed DOCUMENTATION Assist with Fraud Affidavit Educational materials Offers Limited Power of Attorney (LPOA) Free Credit Monitoring During Recovery REMEDIATION Advocate will contact creditors, government agencies, and others for the consumer RECOVERY Petition to expunge any fraudulent records created by the crime Obtain credit reports to validate FOLLOW-UP Advocate will follow-up with the consumer for 12 months Free Credit Monitoring after case is closed for 12 months

36 Financial Institution Assets at Risk

37 Time for Questions! If you have remaining questions that were not addressed today, please reach out: To receive ongoing education on industry-related topics: Sign-up for our fraud education newsletter: Sign-up for our corporate newsletter: Follow us on social media