Republished from CU Times dated May 3, 2021. By James McCabe.
When many credit unions were figuring out how to protect their institutions and survive during the COVID-19 pandemic of 2020, several credit unions decided to take decisive action to support the members outside of the CU walls. With the pandemic creating a perfect storm of vulnerability for many members, especially the older members, it was apparent that everyone was facing an avalanche of attacks.
Some credit unions have boldly stepped up their commitment to help members in this unique and unprecedented time by providing their members with services that protect against the tidal wave of ID theft & fraud happening around them. Members saw these highly effective and protective services as an added value from their credit union as they became included with their checking accounts for just a nominal monthly fee. Typically, these new protective services' retail value was worth at least (10) ten times more than the account level fee, which resulted in member acceptance rates of over 90% ….thus generating non-interest income as well.
With more ID fraud and theft happening outside of credit and finances, these services were just what members needed to stay protected against all forms of cyber assaults from hackers and other ID thieves. Dark web monitoring and fully managed ID theft recovery services included in these strategic services to members also assured the members of an ultimate safety net against any form of ID theft or fraud…financial or non-financial. The amount of COVID-19 related scams, schemes, and fraud happening in 2020 was beyond anyone's imagination. So these special actions by credit unions were well received by members as powerful means to defend their identities.
Unfortunately, 2021 is not forecasted to be any better. The Experian Data Breach Forecast predicts that this will be the year of the 'Cyber-demic.' It is hard to believe that 2021 could surpass the horrific ID fraud loss seen in 2020. Leading up to the start of the pandemic, the annual recorded consumer ID fraud loss was $13 billion. By the end of 2020, the figure had more than tripled to a record of $43 billion. And according to the 2021 Javelin Strategy & Research Report, the total combined consumer and business fraud loss in the country was $56 billion, demonstrating how consumers (your members) faced a double dose of physical and financial harm during the pandemic.
Credit unions that implemented protective ID programs in 2020 also positioned their members for a defense against the 2021 continuation of the same potential attacks and more. Your members are already facing a massive amount of unemployment benefits fraud. There was $63 billion lost to fraudulent unemployment claims in 2020, and if things don’t change, 2021 is trending towards a nationwide loss of $300 billion. In addition, the ID Theft Resource Center already calculates that the 1st quarter of 2021 saw a 564% increase over the 4th quarter 2020 for breached records….and that does not include the announcement in early April 2021 of 500 million LinkedIn users who were breached.
In mid-March 2021 the FBI issued a statement on the sharp rise in Phishing scams, and the statistics show that consumers (members) still need to be made aware of these attacks. Each time a credit union implements a protective ID program, they also provide thorough education and awareness updates. This action is critical to ensure that members fully understand the dangers they face from some very sophisticated criminals and to fully appreciate the protection they now receive from their credit union.
With the recent report by Canalys showing that more data records were breached in the past 12 months than in all the previous 15 years combined, it is clear that the cyber-demic is in full force. And, unfortunately, it will continue according to all major predictors. So, at what point does it make sense to implement the kind of protective services your members need in these times of heightened risks? Clearly, members are willing to accept and appreciate these services when presented with a robust value proposition by their credit union. And clearly, these are the kind of services that set credit unions apart from other financial institutions…..going the extra mile for their members.
Republished from CU Times dated February 18, 2021. By James McCabe.
As if 2020 wasn’t bad enough, we have entered 2021 with another looming danger that continues to expand and wreak havoc in your members’ lives. I call it the “cyber-demic,” a cyber-warfare that’s spreading like we haven’t seen before, caused by hackers who are leveraging COVID-19 to steal, sell and damage your members’ identities. Even more unsettling is that unlike the pandemic, there’s no vaccine to slow down these attacks that are rapidly spreading and will continue to haunt individuals and businesses alike.
A detailed article from TechRepublic about the 2021 Experian Data Breach forecast painted a grim picture of what’s yet to come:
What is your credit union doing to support your members in the midst of these 2021 predictions? Your members face significant risks on several fronts, and attacks can strike without any warning.
As COVID-19 continues to headline the news, the vaccine rollout will present opportunities for criminals to prey on the fear, confusion and misinformation that your members are confronting. The advent of contract tracing organizations is creating new avenues for criminals to steal your members’ personal health information (PHI) – for example, thieves may pretend to be contract tracers to maximize the amount of information they can steal. Health records continue to be the most valuable data to resell on the black market, a trend that opens your members up to vicious attacks of all kinds.
With COVID-19 protocols requiring more and more of your members to set up work-from-home environments, along with the evolution of the 5G network, cyber-hackers have numerous opportunities to attack. These technological hacking geniuses know all the vulnerabilities of home networking. The extensive connectivity of 5G technology makes your members more vulnerable to being caught off guard. According to the 2021 Experian Data Breach Industry Forecast, with the technological control of a house’s security and other devices, criminals will more regularly hold a household hostage in exchange for money, valuable information or just for the potential fame.
Add to all of this the fundamental uncertainty of day-to-day restrictions and potential new mandates on the public, and it is easy to understand why your members are wondering how to best protect their lives, families and assets. Credit unions have always demonstrated their ability to step forward and provide sound financial advice and guidance in uncertain times. And now, more than ever, members need extra support and guidance from their credit union.
Have you considered new ways to protect members outside the walls of your credit union with new services that could include ID theft and fraud recovery, and robust protective monitoring? This monitoring could include Dark Web monitoring to alert members when their non-financial data (i.e. PHI) is being attacked or used against them. You could also offer members mobile phone protection and perhaps some well-positioned discount programs to save them money. These kinds of services are available, and several components can extend to their whole family. Bringing these enhanced services goes a long way to increase member engagement and generate non-interest income, and it’s something hundreds of credit unions are doing today.
Cybersecurity preparedness has been a mantra of the NCUA for over seven years. Yes, the vulnerabilities of data breaches are ever-present for credit unions, and fraud is getting worse all the time. But the “front-line” targets beyond the credit union are your members, and they require serious help. Why not heed the cyber-demic warnings of the 2021 Experian Data Breach Industry Forecast and do what other financial institutions aren’t doing – bring more protection and guidance to members to expand their faith and trust in their faithful credit union?
As if the COVID-19 pandemic and its ramifications haven't given members enough to worry about, it is now the time of year when criminals also focus on tax fraud, and they're using several schemes to attack your members.
Many members are not aware of just how easy it can be for criminals to submit a false tax return to the IRS in their name, using their personal information. Thieves are using personal information that has been collected and stolen from various data breaches and sold over the years on the Dark Web. In 2020 alone, according to a newly released 2021 report by Risk Based Security, the volume of records comprised of recorded data breach events in 2020 "jumped by 141% to a whopping 37 billion records", the largest number seen since 2005.
On the false return, the thieves make it appear as though there is a significant refund owed and in the member's name, using their social security number, claim that refund for themselves. And then they vanish, leaving your members with the clean-up process, which requires hours of paperwork and waiting to correct the situation so that their "real" federal tax return to be submitted. It often takes months or longer to get resolved so that the member can receive their money.
Unfortunately, most tax fraud victims (your members) don't realize that they've been attacked until they go to submit their own tax returns and have it rejected because the criminals beat them to it.
Cyber-thieves are also using your members' personal information to submit fraudulent unemployment insurance claims, which means, according to KrebsOnSecurity, many members are likely to be told they owe significantly more in taxes than they actually do. Scammers use stolen data to complete the false claims for benefits and then have the funds deposited into an online account under their control.
Now seems like the perfect opportunity for your credit union to take some positive action to help your members defend themselves. You might want to consider what hundreds of other credit unions are doing. Providing members with ID Theft Protective services that go far beyond anything they could find on their own…..and these services prove to create greater member engagement and strong, residual, non-interest income. These ID Theft Protective services defend your members from all fraudulent attacks that could devastate their livelihood.
With COVID-19, natural disasters, and other challenges affecting nearly all of us, now is an opportune time for credit unions to bring a positive message of support and protection to members. It only makes sense that members want the credit union that they trust with their finances to protect their identity as well.
Republished from CU Times dated October 19, 2020. By James McCabe.
Over the past nine months, our country has experienced an unprecedented pandemic that featured a transmittable virus that spread "like wildfire" to millions of Americans. Unfortunately, the world's criminals have preyed upon this fast-spreading viral disease to create the spread of criminal activity that has moved as swiftly as the virus itself.
With October being National Cybersecurity Month, it is disheartening to say that Americans, including thousands of your members, face the worst ever epidemic of ID theft & fraud. It is a tidal wave of criminal attacks hitting your members from so many directions, which makes them defenseless if they are in the sights of the bad guys.
We've seen the warnings for all of these attacks coming from so many sources. The FBI, CIA, Homeland Security, and other national watchdogs have been trying to expose the criminals and their many forms of assault on innocent individuals.
In March, we saw the first signs of attack coming via the Phishing email avalanche that hit Americans with a 600% increase in just one month.
Then in April, we were all alerted to the several devious ways that crooks were creating Stimulus Check Scams against Americans (including your members) who were desperately in need of the funds to stay afloat.
There was a critical alert announced in May from several Federal Agencies that the coronavirus pandemic was helping to facilitate "malicious attempts leveraging stimulus-themed emails and text messages to obtain personally identifiable information and bank account details from individuals." The IRS, Homeland Security, and Secret Service, among others, are particularly concerned about the intrusions happening within healthcare organizations and are encouraging heightened controls, especially on teleworkers operating in unsecured places.
In May, the Institute on Aging also released a warning about criminals aggressively targeting the elderly. Elders, who maintain the vast majority of the nations' wealth and face more isolation from being the pandemic's highest risks, have become an appealing prey for cybercriminals. Elder members need some focused attention at this time and it would benefit credit unions to show them some special support.
A Beazley study released in June also indicated that businesses are also highly targeted by sophisticated thieves. Phishing scams and the confusion of the virus have made it an excellent opportunity to drive up ransomware attacks on a wide variety of industries. Credit Union members are also affected, as many of them are consumers, employees, and owners of these vulnerable businesses.
Perhaps one of the most alarming warnings came in June by the FBI, when they announced that there had been significant attacks on mobile banking apps and fake banking apps developed by criminals. COVID-19 has caused more people (your members) to bank remotely and has increased mobile banking usage. According to the FBI, "Hackers are increasingly aiming at mobile banking app users to steal credentials and commander bank accounts."
In light of this mountain of evidence that credit union members are facing unprecedented levels of risk for ID theft and fraud events, the question becomes, "What will credit unions do to help them?" The answer starts with an awareness campaign that educates members about what is happening around them with cyber hacking, phishing emails, stimulus scams, and various fraud attacks. Now is the time to create an "eye's wide open" moment for members to be on guard and ready to defend themselves.
Of course, credit unions can go the extra mile for members, which is what credit unions are known for, and incorporate protective ID theft and fraud services as part of their member-owned accounts. Hundreds of credit unions nationwide have begun to provide their members with this "ultimate safety net of protection." Programs are readily available to make this happen while also providing the opportunity to generate much needed non-interest income to offset growing fraud loss, pandemic-related revenue gaps, and secure funding to maximize institutional protection as well.
All of this being said….wouldn’t NOW be a good time to give members a positive solution to fight this spreading crime wave? Where else would you want your members to go than the credit union they trust?
The Increased Vulnerability for Fraud, Scams, and ID Theft Attacks on Students….What Can Credit Unions Do?
It is that time of year when students' vulnerability for ID theft attacks goes up exponentially as they head back to school. And this year, they face a dramatically more substantial threat posed by the increased time they spend online taking virtual classes.
The criminals are always excited about the idea of capturing student information and using it as a means to attack them or their parents. Thieves can also potentially gain access to all kinds of financial data from school applications and financial aid documents passing through the internet. Or they might gain access to the students' computers and steal files of personal & financial data. The COVID-19 crisis has definitely made students a prime target (COVID-19 scams targeting college students) for those preying upon our fears and the significant distractions from this national emergency.
So what can credit unions provide in the way of services to help create a safer environment for students and their parents (your members)? There would be nothing quite as powerful as an extensive array of ID Theft & Fraud Protective services. These are the type of services to provide your members' families a means to detect attacks and effortless recovery solutions in case thieves make it past defensive measures. Many credit unions have implemented these kinds of protective services with targeted programs that incorporate these services and generated substantial non-interest income.
Again, with the new distance learning that has affected most many states, your members face an ominous risk for phishing attacks and hacking attacks like never before. Your credit union is also operating at a higher risk in this COVID-19 environment. A recent study by Beazley Insurance indicates that financial institutions and the healthcare industry are prime targets of phishing scams, which has resulted in a 25% increase in ransomware in the 1st quarter of 2020 alone.
What can credit unions do to protect themselves in these unsettling times? Some solutions that protect your members from ID theft & fraud also come with protection for the credit union, such as data breach recovery & restoration services. Although every financial institution is responsible for having a robust incident response plan, it is wise to have another set of expert eyes on the situation to ensure that your credit union addresses every aspect of a breach response.
Republished from CU Weekly dated July 8, 2020. By James McCabe.
As the country continues its battle against the COVID-19 pandemic, there is a war being waged against consumers by criminals who are finding insidious and ingenious ways to wreak havoc.
Researchers at Barracuda Networks noted a 667 percent increase in phishing emails during March alone. These emails were malicious attempts to lure consumers into clicking on dangerous links and subsequently downloading computer viruses that lead to malware, ransomware, and individual ID theft attacks.
By the middle of this past April, the Federal Trade Commission had received over 17,000 complaints. It determined that criminals had already stolen more than $13 million in COVID-19 related scams and attacks.
Several U.S. federal agencies are posting alerts on nearly a weekly basis to warn consumers (your members) about aggressive attacks designed to prey upon the fear and distraction related to the COVID-19 crisis. In May, the Feds issued a joint warning with the Department of Homeland Security Cybersecurity and Infrastructure Security Agency, Department of the Treasury, the IRS, and the Secret Service about COVID-19 CARES Act payment fraud scams.
In June, the FBI has made it clear that hackers are now targeting mobile banking app users to steal their credentials and commandeer bank accounts. Now is the beginning of a dangerous time for anyone who thinks the bad guys aren’t going to find a way to take over our phones and all the personal data they store.
Based on this continuous news about attacks on your members, credit union executives have an excellent opportunity to come to the aid of their members when it counts the most. Why not take this moment to bring members a source of protection from their credit union that they could not afford anywhere else?
Now is the opportune time to bring your members a suite of ID theft and fraud protection & recovery services that provide them and their families, the ultimate safety net against the avalanche of attacks happening around them. Search out the best resource for this kind of protection and give your members a positive message during this time when good news is seldom being heard.
In the wake of the coronavirus pandemic is a tsunami of criminal activity designed to play on your members’ fears and distractions. Perhaps one of the greatest threats is the use of phishing emails to attack members to gain access to all sorts of personal data and financial information. On the heals’ of the formal FBI warning to all Americans about increased criminal attacks related to the pandemic, there are two prominent sources who see phishing emails as one of the greatest threats on the rise
Last week, an article published by The Hill noted that there had been an astounding 667% increase in phishing emails in the previous 30 days alone. This article points out, “These types of emails try to lure individuals into clicking on dangerous links or download attachments that typically include computer viruses.” The article also notes, “as the coronavirus crisis continues, researchers are expecting hackers to grow increasingly sophisticated at using coronavirus to lure individuals.” Furthermore, The Hill reported that even the World Health Organization itself experienced an unsuccessful cyber-attack within the past few weeks, and they are seeing a dramatic increase in hacking attempts.
Another prominent subject matter expert on ID theft and data breach activities, Mark Pribish, notes in his recent newsletter, “the vast majority of data breach events are the result of phishing emails and not high technology hacking tools.” Mark also references the 2019 Internet Crime Report in pointing out that “phishing scams were the most common type of internet crime last year where 114,000 U.S. consumers lost more than $57.8 million in 2019 as the result of phishing.”
Credit Unions have the opportunity to reach members and sound the alarm about this tidal wave of phishing emails coming at them, thus creating a powerful awareness moment. It would be an incredible time also to consider how you might be able to bring members protective services with high-value propositions. Your members need extra support and guidance during this unique time in our history and providing a positive service right now would also go a long way to increase their loyalty and engagement with your credit union.
Republished from CU Times dated April 3, 2020. By James McCabe.
In a time when security threats are compounding due to the crisis, CUs should show members how they're protecting them.
In December 2019, an article in CPO Marketing acknowledged that the FBI had issued a warning to the auto industry about being a target for cyberattacks. The U.S. automotive industry has become a target for cybercriminals because of the vast amount of personal data it contains. It is rare when you hear the FBI single out a particular industry followed with substantial warnings like this one, which says, "Automotive companies need to develop proactive defensive security measures to deal with all of the risks highlighted by the FBI warning." And ditto for the credit unions who work with auto dealers to be on guard and extend protections to their members.
Although this FBI warning went out to the auto industry, it affects more than just dealers. Credit unions who offer auto loans and members who receive financing are also at risk. The article mentioned above, clearly states that “In particular, when an enterprise shares data or partners with other organizations, it needs to be aware not only of the risk directly posed to its systems but the risk to its partners’ systems as well.” The financial data of members is a part of the automotive industry’s growing risks, and members should be aware so that they can ask the auto dealers how their data is protected.
Members also need to understand that identity theft is not just happening on debit or credit card transactions. Criminals are using stolen data to go beyond the typical financial transactions to pull off much more significant crimes. For example, cyber thieves who use stolen identities for medical fraud and to make big-ticket purchases can create nightmares and years of torment for the victims.
Compounding this specific attack on the auto industry and indirectly, your credit union, the COVID-19 pandemic has made the auto industry and other businesses even more susceptible to attacks, establishing an entirely new dynamic to the threats that already existed. Cyber thieves are using this time as an opportunity to attack while dealerships and other companies are hyper-focused on managing the effects of the coronavirus. As a result, another FBI warning has emerged about coronavirus scams and the need for vigilance and awareness as these attacks increase.
The current state of the world and anticipated new attacks are hitting very close to home for the credit union world, and it warrants a serious new assessment of your credit unions' overall cybersecurity preparedness. There is a new magnitude of fear and distraction within consumers (your members), and unfortunately, this creates the perfect feeding ground for criminals to attack.
Also, imagine the level of criminal activity that will happen when millions of Americans are sent government funds as part of the coronavirus stimulus package. It won’t take the ingenious criminals long to find a way to intercept funds or deceive recipients in some calculated scheme.
All of this allows credit unions to be purposeful in reacting to the FBI warnings and to demonstrate their commitment to looking after their members' well-being. Many credit unions are putting into place a strategy of ID theft protection that provides a heightened level of protection for the whole credit union and its members in a manner that also increases member engagement.
In closing, it is another fantastic opportunity for credit unions to show how they care for their members beyond the walls of the institution and how they differentiate themselves in the financial industry. Bring your members solutions that demonstrate the understanding of their growing risks and offer some expanded education & awareness. They may not immediately connect the FBI’s warnings to the auto industry or about the COVID-19 pandemic to threats that pertain to them, so a credit union centric reminder could be just what members might need. And giving the members a powerful, positive message in this time of fear and trepidation will solidify your relationship with them during the worst of times. Thus, making way for long-term success when the good times return.
We are facing an unprecedented time in our lives with the coronavirus upon us and people taking every imaginable precaution to “be safe” and survive the aftermath. Having three sisters who are nurses and who love to give advice, the basic practices of good hygiene are essential and the best way to avoid this virus. That is as far as this article will go on any medical aspects of this issue.
With the wave of fear going on, it might be a great opportunity for credit unions to look at the financial aspects of this unprecedented time and determine what other ways that members could be supported.
Understanding that the healthcare industry is the leading industry for data breach and ID theft related issues (medical ID theft & fraud), perhaps it might be prudent to look for ways to protect members as they find themselves possibly spending more time in urgent care facilities or hospitals. Criminals know that these healthcare operations are extremely distracted by the potential number of patients which could unfold….hopefully not….but these operations need to be prepared. For an example, in 2019, 40 million Americans were affected by health data breaches.
Members might really appreciate a symbol of protection and concern from their credit union at this time. Although you can’t provide a medical solution to offer, you could provide basic protection against the threats of medical fraud attacks and provide increased member awareness to be on guard. For those credit unions who might already have ID theft & fraud protection incorporated into services it is a fantastic time to remind members of these powerful services.
The coronavirus scams are already in full swing from the criminals and we can all expect it to only get worse as people continue to get bombarded with every imaginable negative news associated with this pandemic…driving up fear and uncertainty.
There are a wide variety of packaged solutions out on the market that incorporate fully managed ID theft & fraud recovery together with strong dark web monitoring to give members the ultimate safety net against criminal medical fraud & ID theft attacks. If nothing else, incorporating these kinds of services signifies to members the intent to be protective in whatever means possible….and help calm fears. It might even be practical to provide these services at no cost to the members for an extended period of time, thus showing a sensitivity to the economic effects of all of this as well.
These unprecedented times call for unprecedented action and credit unions have a powerful voice with their members to guide them and offer a positive message of identity protection and safety while they are dealing with the potential medical dangers at the same time. Any kind of positive news at this time could be received by members in the most significant way and remind them how credit unions uniquely go beyond their walls to enhance the lives of those they serve.
Republished from CU Weekly dated February 21, 2020. By James McCabe.
Over the past year, we have seen a continued incline in data breach events. A few years ago, it was not uncommon for a data breach to make news headlines once every month or two. In 2019, that began to change. The public announcement of a new data breach has become a weekly occurrence. That's because there was a 17% increase in data breach events in 2019 over 2018.
Not too surprisingly, 2020 has started with a series of breach announcements, which is indicating another record year for attacks. But, in addition to the increased frequency of breach events, the growing number of breaches involving "harmless" data is another notable trend that many people have shrugged off as just being annoying. Breaches like the one from Microsoft, which exposed 250 million customer records, didn't alarm as many people because it lacked the SSNs, birth dates, and credit card data that have impacted other breaches, such as those from the healthcare industry.
The recent wave of data breach activities that involve data such as email addresses, mailing addresses, phone numbers, and passwords are the breaches that can be the most dangerous because they're the ones that many consumers ignore and fail to react proactively. Many consumers (your members) do not realize that a non-financial data breach can be just as detrimental because a hacker only needs a small bit of personal data to cause havoc on someone's identity.
Your members need to be aware that criminals are keenly interested in this "non-financial" data to allow them access to more critical data. For example, the stolen Instagram passwords of 419 million users could be the gateway to financial and other sensitive accounts since over 60% of adults use the same login credentials for multiple accounts, and 44% of consumers change their passwords once a year or less.
Hackers also use inconsequential data from breaches such as PhotoSquared App, Estée Lauder, and Arizona Department of Education to round out the data that they previously collected from the same individuals. The breach events of Equifax and Capital One exposed almost every adult (147+ million) US citizen's social security number. Having a closer to complete data file on a person allows criminals to do more damage, which is why there has been such a dramatic increase in New Account and Account Takeover Fraud in the past five years (138% higher in 2019 than in 2014).
Credit Unions have a significant Member-centric focus that sets them apart from other financial institutions. So wouldn’t it be credit union-centric to provide members with education, awareness, and protective services against ID theft & fraud events, unlike other financial institutions? Fighting the ever-increasing complacency of consumers (members) can add another differentiating factor for your credit union. Hundreds of credit unions are implementing value- rich ID theft recovery & monitoring programs for members that set them apart in ways that enhance member engagement and can also generate non-interest income.
Members are often confused and bewildered about how to combat the risks that they know they are facing with the rapid advancement of data technologies. Cell phones and other mobile devices are especially a concern since they are typically the storing mechanism for everything about an individual. This is particularly true of the Millennial generation. Now is the opportune time for credit unions to investigate the introduction of member protective services and education/awareness programs that will help members protect ALL of their data - even their seemingly "harmless" personal information. Because as we know, there's no such thing as a "harmless" data breach.
Jim McCabe, Senior Vice President, Identity Theft Services at Vero.