Cybersecurity is back in the news, thanks in no small part to a number of government reports and developments with WikiLeaks. It’s also becoming increasingly important to businesses and lawmakers alike. Although not a new concern for the telecommunications industry, cybersecurity is quickly becoming a priority for the new Congress as pressure increases to develop a national plan. What should cybersecurity protect? A national cybersecurity plan would likely entail setting baseline security standards to protect critical networks – many of which are run by private organizations. For policymakers, the challenge will be to craft guidelines that protect consumer data and still allowing technological innovation. Last year, we saw a number of legislative proposals debated before Congress that would place new requirements on network infrastructure and strengthen coordination between federal regulators. So far, the proposals have been broad and have only raised additional questions. The hurdle for lawmakers will be addressing how existing data protection laws fit within new proposals in order that businesses do not face over burdensome requirements. Where does the FCC fit in? When it comes to cybersecurity, the role of the FCC is even more undefined – however that’s changing. Last summer, the FCC asked for public comments about the creation of a Cybersecurity Roadmap to identify vulnerabilities to communications networks and to develop countermeasures and solutions to cyber threats. The roadmap was first recommended as part of a broader strategy to create a National Broadband Plan that required the FCC to identify the five most critical security threats and establish a two-year plan to address them. While the Commission has accepted public comments, it’s unclear when a final Roadmap will be introduced. A national breach notification standard As part of a comprehensive plan, policymakers are also looking at what happens after a breach occurs. Currently, 46 states have passed laws requiring companies to notify consumers after a security breach. As a result, policymakers have begun to examine whether a national data breach law is necessary given the varying degrees of consumer notification. The FCC has indicated their support of a uniform law and has recommended that Congress include telecoms in the legislative discussion. Despite the uncertainty, one thing is sure: cybersecurity will be increasingly important to monitor during 2011. One way to stay current is to subscribe via email or RSS as we continue to look at the latest legislative or regulatory developments concerning the wireless and telecommunications industry. In the near future, we’ll be taking a look at recent data privacy recommendations by federal regulators and the privacy agenda of the new Congress. Meanwhile, if you’d like more information on Data Breach Notification or Fraud Management Compliance, your Experian representative can help. Let us know your concerns regarding cybersecurity and pending legislative issues so that we can address them in future posts.

Many compliance regulations such the Red Flags Rule, USA Patriot Act, and ESIGN require specific identity elements to be verified and specific high risk conditions to be detected. However, there is still much variance in how individual institutions reconcile referrals generated from the detection of high risk conditions and/or the absence of identity element verification. With this in mind, risk-based authentication, (defined in this context as the “holistic assessment of a consumer and transaction with the end goal of applying the right authentication and decisioning treatment at the right time") offers institutions a viable strategy for balancing the following competing forces and pressures:   Compliance – the need to ensure each transaction is approved only when compliance requirements are met;   Approval rates – the need to meet business goals in the booking of new accounts and the facilitation of existing account transactions;     Risk mitigation – the need to minimize fraud exposure at the account and transaction level. A flexibly-designed risk-based authentication strategy incorporates a robust breadth of data assets, detailed results, granular information, targeted analytics and automated decisioning. This allows an institution to strike a harmonious balance (or at least something close to that) between the needs to remain compliant, while approving the vast majority of applications or customer transactions and, oh yeah, minimizing fraud and credit risk exposure and credit risk modeling. Sole reliance on binary assessment of the presence or absence of high risk conditions and identity element verifications will, more often than not, create an operational process that is overburdened by manual referral queues. There is also an unnecessary proportion of viable consumers unable to be serviced by your business. Use of analytically sound risk assessments and objective and consistent decisioning strategies will provide opportunities to calibrate your process to meet today’s pressures and adjust to tomorrow’s as well.

By: Staci Baker There has been a lot of talk in the news about the Dodd-Frank Act lately. According to the Dodd-Frank Resource Center of the American Financial Services Association (AFSA), “The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, which passed on July 21, 2010, is unprecedented in magnitude, and will impact every sector of the financial services industry.”  The aim of the Act is to put measures in place that address the issues that led to the financial crisis. This is done by setting up new regulatory bodies, and limiting the dealings of banks and other financial institutions. For the purpose of this blog, I will focus on describing the new regulatory agencies.  The Bureau of Consumer Financial Protection (CFPB), is an independent watchdog housed within the Federal Reserve. The CFPB has the authority to “regulate consumer financial products and services in compliance with federal law.”[ii] They are responsible for the accuracy of information, hidden fees and deceptive practices for consumers from within the following industries – mortgage, credit cards and other financial products. The Financial Stability Oversight Council is “charged with identifying threats to the financial stability of the United States, promoting market discipline, and responding to emerging risks to the stability of the United States financial system.”ii Through the Treasury, this council will create a new Office of Financial Research, which will be responsible for collecting and analyzing data to identify and monitor emerging risks to the economy, and publish the findings in periodic reports.  These new regulatory agencies are critical to US business processes, as they will more closely monitor business practices, create new tighter legislation, and report findings to the public. The legislation that is created will decrease risk levels posed by large, complex companies, as well as address discrepancy that has been raised throughout the financial crisis.     What are your views of the Dodd-Frank Act? Do you believe this is the legislation needed to stem future financial crisis? If not, what would help you and your business?  

Increased incidence of “involuntary renters” According to the Mortgage Bankers Association, one out of every 200 homes will be foreclosed. The incidence of “involuntary renters” will increase as a high foreclosure rate continues, in turn, fueling the current trend of consumers who rely solely on mobile service instead of landlines. Implications for communications companies Does it necessarily follow that foreclosure equals bad risk? I don’t think so. For example, many consumers who have undergone foreclosure were subjected to a readjusted ARM that doubled or even tripled their mortgage payments. While taking a mortgage out of a consumer’s credit file can negatively impact the overall credit score, it can also potentially generate a more positive cash flow. The consumer’s new rent payments would be lower than the readjusted mortgage would have been, making the consumer a potentially good customer for communications services. Wireless companies, in particular, prefer to approve customers for regular installment plans (as opposed to prepaid plans). The goal, for nearly all communications companies, is to qualify customers for service without the need for a deposit. The key, when assessing credit risk, is to look at the total credit/payment history, not just the credit score alone. Best Practices for qualifying involuntary renters: Validate ID/authenticate. Checking the credit application information against several data sources will help avoid potential fraud. Look at the overall credit picture, especially the current debt-to-income ratio. Review third-party data for payment history. Along with the typical payment data, Experian now offers rental histories through RentBureau. This data has the ability to increase credit report accuracy for renters. Consider the basic lender mentality. Consumers who have exhibited good payment history on utilities, credit cards, and other debt in the past are likely to continue that behavior despite having lost their house to foreclosure.   Considering the total credit picture allows you to rank-order customers and group them into populations that are lower risk, identifying, for example, those who can be serviced without an upfront deposit. In future posts, I’ll provide some guidance for rank-ordering customers as to their credit-worthiness.

In an attempt to out-innovate competitors, today’s communications companies seem busier than ever. The number of new products, services, devices and bundles continues to skyrocket, giving consumers more shiny new options than ever before. A double-edged sword More choices means greater opportunity to cross-sell, upsell or otherwise optimize customer value. But there is also increased risk, due to process or information gaps between internal acquisition, billing, account management and collections teams. There are also threats from the outside. Avoid being hit by “cyclers” These include hard-to-monitor, multiple-account households, and high-risk account “cyclers” who attempt to game the system by manipulating personal data; for example, providing different information when opening an account, buying a device or activating service. Undetected, such activity can severely impact corporate profitability. Fortunately, you can gain a clearer picture of both positive and negative activity by using assets and resources you already own. Extra benefits. No extra cost. The first step is working with IT to better mine internal data by linking disparate databases together (tips and best practices will be presented in future posts). This will give you a holistic view of all accounts. Experian recently did this with greater-than-expected success. In a similar effort, one utility we know identified more than $2.5 million in uncollected bad debt from current, active customers. What benefits can you expect? Besides gaining insight into driving the full value of multi-product customers, linking together internal data sources also enables you to: Illuminate resell/cross-sell opportunities and unfulfilled revenue potential Mitigate risk by identifying low value, high risk customers, and fraudulent behaviors Help in-house credit professionals “bridge the gap” with marketing and work in a more collaborative and integrated fashion Improve the customer experience across sales and support Best practices yield best results You already own the data you need. The secret to success is linking it together and putting it to work—without burdening already overworked teams. A structured set of best practices can make it happen. So what say you? What challenges does your communications company face with regard to customer data?

Experian’s Fraud and Identity Solutions team recently conducted a webinar entitled: “A risk-based approach to finding opportunity in today’s market: New approaches to fraud, compliance, and operational efficiency in an evolving economy.” I specifically discussed the current business drivers and fraud trends we, as a consumer and commercial authentication services provider, hear most often from our existing and potential clients. I was encouraged to have the following forces validated by our audience, and I thought they’d be worth sharing with you via this forum. In what I believe to be rank order with most influencing first:   Customer experience is king. The addressable market for most of our clients is effectively an ever more limited pool of viable consumers. From the consumer’s perspective it’s a ‘buyer’s market’. ‘Good’ consumers know they are ‘good’ and those 750 scorers don’t tolerate poor customer service.   Risk seeking credit policies may be making a comeback. Many of our clients are starting to heal from the past few years, and are ready to get back on the bike. However, this does open the door more widely for application fraud activity and risk.     New products and associated solicitations and access channels translate to higher risk as fraud prevention and fraud detection processes may be less robust in the early launch stages and certainly less time-tested.     Human & IT resources are still in short supply. As these new channels open and fraud risk increases, necessary fraud prevention and authentication oriented resources are still overly constrained and often significantly lagging in proportionality behind the recovery-minded marketing minds.     Regulatory pressures continue to equate to higher operational costs, in the form of fraud referral rates, in process engineering and human intervention and activities, not to mention the opportunity costs associated with denial of service to those ‘good’ consumers I just mentioned.     So, hosted services and solutions are where it’s at these days. Our clients want their vendors, including us at Experian, to save their IT resources, deliver quicker to market services, such as fraud models, knowledge based authentication, and other authentication tools, and provide collective capabilities that would otherwise be years away if left to the mercy of their internal development queues.     All products and processes are under review, as you might imagine. Cost control is no longer a back-burner policy and focus. ROI is the key metric these days, and likely above any other. Our clients demand flexible tools that can be deployed in multiple process points and across multiple business units. Blanket policies (including fraud prevention and authentication) are no longer good enough. Our clients’ tailored products, access channels, and market segmentations require the same level of unique design in the products we deliver.    

In the communications industry, effective acquisition is a multi-step process, best begun by asking (and accurately answering) simple, but critical questions: Who are our best prospects? Where can we find them? What should we offer them and how? Of course, the “why” is obvious—beating competitors to the punch. The similarities of today’s increasingly undifferentiated products and services make attracting high-quality customers more critical than ever. On the surface, the “who” seems equally straightforward. But it’s surprising how many communications companies still blanket the nation with ads and offers without knowing whom they want to reach or which messages to lead with. This brings us to the “how” of effective acquisition. Banks get it right Banks provide a good acquisition model. In these days of tight budgets and high expectations, most would never dream of investing in a campaign without first creating a well-defined, data-driven segmentation strategy. To get the results they want, institutions usually establish some credit-score threshold, check past payment history and assess other factors and behaviors, before starting up their marketing machine. Not surprisingly, the rewards for this foresight often include higher response rates, lower costs and greater value per promotional dollar. What’s next? Once you zero in on a fresh crop of qualified prospects the “whats” come next: what’s the best marketing channel? What products or services should we offer? What terms? Again, clean historic data, combined with up-to-date information from surveys and questionnaires can reveal surprising insights into why customers choose your company or offer over your competitors’. In communications, as in banking, reliable data is a proven source for answers to a whole slew of customer-acquisition questions. But does it offer similar value in other phases of customer lifecycle management? And if so, how? Funny you should ask. Because that’s exactly what future posts here will cover, so please check back often.

When we think about fraud prevention, naturally we think about mininizing fraud at application. We want to ensure that the identities used in the application truly belong to the person who applies for credit, and not from some stolen identities. But the reality is that some fraudsters do successfully get through the defense at application. In fact, according to Javelin’s 2011 Identity Fraud Survey Report, 2.5 million accounts were opened fraudulently using stolen identities in 2010, costing lenders and consumers $17 billion. And these numbers do not even include other existing account fraud like account takeover and impersonation (limited misusing of account like credit/debit card and balance transfer, etc.). This type of existing account fraud affected 5.5 million accounts in 2010, costing another $20 billion. So although it may seem like a no brainer, it’s worth emphasizing that we need to continue to detect fraud for new and established accounts. Existing account fraud is unlikely to go away any time soon.  Lending activities have changed significantly in the last couple of years. Origination rate in 2010 is still less than half of the volume in 2008, and booked accounts become riskier. In this type of environment, when regular consumers are having hard time getting new credits, fraudsters are also having hard time getting credit. So naturally they will switch their focus to something more profitable like account takeover. Does your organization have appropriate tools and decisioning strategy to fight against existing account fraud?

Many compliance regulations such the Red Flags Rule, USA Patriot Act, and ESIGN require specific identity elements to be verified and specific high risk conditions to be detected. However, there is still much variance in how individual institutions reconcile referrals generated from the detection of high risk conditions and/or the absence of identity element verification. With this in mind, risk-based authentication, (defined in this context as the “holistic assessment of a consumer and transaction with the end goal of applying the right authentication and decisioning treatment at the right time") offers institutions a viable strategy for balancing the following competing forces and pressures: Compliance – the need to ensure each transaction is approved only when compliance requirements are met; Approval rates – the need to meet business goals in the booking of new accounts and the facilitation of existing account transactions; Risk mitigation – the need to minimize fraud exposure at the account and transaction level. A flexibly-designed risk-based authentication strategy incorporates a robust breadth of data assets, detailed results, granular information, targeted analytics and automated decisioning. This allows an institution to strike a harmonious balance (or at least something close to that) between the needs to remain compliant, while approving the vast majority of applications or customer transactions and, oh yeah, minimizing fraud and credit risk exposure and credit risk modeling. Sole reliance on binary assessment of the presence or absence of high risk conditions and identity element verifications will, more often than not, create an operational process that is overburdened by manual referral queues. There is also an unnecessary proportion of viable consumers unable to be serviced by your business. Use of analytically sound risk assessments and objective and consistent decisioning strategies will provide opportunities to calibrate your process to meet today’s pressures and adjust to tomorrow’s as well.

Cell phone use on the rise A Wikipedia list of cell phone usage by country showed that as of December 2009, the U.S. had nearly 286 million cell phones in use. In parallel, a recent National Center for Health Statistics study found that one in every seven homes surveyed received all or almost all their calls on cell phones, even though they had a landline. Study results further indicated, one in four homes in the U.S. relied solely on cell phones. This statistic highlights these households had no land line at all during the last half of 2009. Since this time, the number of households that fall within this category have increased 1.8 percent. Implications for communications companies The increasing use of cell phones, coupled with the decreasing use of landlines, raises some very important concerns for communications companies: The physical address on file may not be accurate, since consumers can keep the same number as they jump providers. The increased use of pre-paid cell phones shines a new light on the growing issue that contact numbers are not a consistent means of reaching the consumer. These two issues make locating cell phone-only customers for purposes of cross-selling and/or collections an enormous challenge. It would certainly make everyone’s job easier if cell phone providers were willing to share their customer data with a directory assistance provider. The problem is, doing so, exposes them to attacks from their competition and since provider churn rate concerns are at an all-time high, can you really blame them? Identifying potentially risky customers, among cell phone-only consumers, becomes more difficult. Perfectly good customers may no longer use a landline. From a marketing point of view, calling cell phones for a sales pitch is not allowed, how then do you reach your prospects?     What concerns you? Certainly, this list is by no means complete. The concerns above warrant further discussion in future blog posts. I want to know what concerns you most when it comes to the rise in cell phone-only consumers. This feedback will allow me to gear future posts to better address your concerns.

By: Staci Baker According to Wikipedia, mobile banking is defined as, “a term used for performing balance checks, account transactions, payments, credit applications, etc. via a mobile device such as a mobile phone or Personal Digital Assistant (PDA).” However, as several large lenders and phone carriers test mobile banking and mobile payments, there is still much to be deciphered. Will it help businesses compete? Is it safe for a consumer? Should a bank offer a mobile solution; and if so, what precautions will they need to take to ensure their customer’s information, i.e. fraud, consumer identity? Peter Garuccio, spokesman for the American Bankers Association in Washington D.C., noted that “various experts predict that some 20 million people may be banking via cell phone this year, and that number is projected to skyrocket to 50 million by 2013.” And, according to a mobile payment study by Juniper Research ,“Combined market for all types of mobile payments is expected to reach more than $630B globally by 2014.” For the purpose of this blog, I will focus on the mobile banking solution, and questions to consider before entering into the mobile banking arena. Mobile banking today is akin to online banking a few years ago. It’s new, getting a lot of press, late adopters want more information, while the early adopters are already participating and it appears to be on the verge of taking over more conventional banking and payments. Before entering into the world of mobile solutions, there are a few things to consider: How will new regulations, such as the Durbin Amendment to the Frank-Dodd Act (a new Interchange fee proposal), affect implementation and usage? The current average interchange fee is between $1 and $1.30, the new cap at $.12 will reduce the charges by up to 90%.While the interchange fee proposal will not be finalized until after February, it is not known how the new “swipe fee” legislation will affect mobile solutions. If the new amendment directly affects debit cards only, mobile solutions can become a new revenue stream for many lenders. As more information becomes available regarding the Durbin Amendment, I will relay additional details and implications. What fraud prevention solutions do you have in place? Fraud is an issue in all industries; therefore utilizing fraud best practices specific to your market, or identifying fraud trends is essential in keeping retailers, consumers and your company safe. As consumers replace the need for a wallet with a phone, identity theft can become an issue. This is especially true of phones with minimal security, or if their phone gets into the hands of a hacker. Therefore companies can initiate an identity theft prevention program to raise awareness in consumers and retailers. As well as implement new internal processes and requirements. As we delve further into an IT-led economy, businesses will continually need to adjust how they do business in order to meet consumer demand, as well as finding new revenue streams. I am curious, how many businesses have already begun to implement a mobile solution, and what issues or results have you already seen? If you have not already implemented a mobile solution, is this in your planning for the upcoming year?

By: Kari Michel Lending institutions are more challenged today than ever before when assessing credit risk to find creditworthy consumers. Since 2006, the start of the housing bust and recession, consumer’s overall creditworthiness has deteriorated, especially those consumers who once had a high score (low risk). “For example, a study earlier this year by VantageScore® Solutions LLC found that the probability of serious delinquency, defined as nonpayment for 90 days or more, had increased by 417 percent among “super prime” borrowers between June 2007 and June 2009. Default risk during the same period rose by 406 percent for the second-highest rated category of “prime” consumers, and nearly doubled for those at the “near prime” scoring level.”* The VantageScore® credit score model is one example of a credit risk model that was recently redeveloped to capture the changing consumer behavior of repayment. The development data set included 45 million consumer credit profiles for the time period of 2006 to 2009.  The VantageScore® credit score will be released for lenders use January 2011. *Source: The Washington Post, “Walk-aways leading to big changes for all borrower’s credit score, November 5, 2010 Link for article:  http://www.washingtonpost.com/wp-dyn/content/article/2010/11/05/AR2010110502133.html

By: Kristan Frend According to the 2011 Identity Theft Assistance Center Outlook (ITAC), new forms of small business identity theft are emerging. This shouldn’t be a surprise that criminals view small business accounts as a lucrative funding source. What is surprising is that the ‘new’ form of small business identity theft consists of the U.S. Postal Inspection Service reporting a surge in criminal rings using small business information from stolen mail, check writing software and other tactics to counterfeit checks. That’s the new wave of small business identity theft??? I consider this one of the least sophisticated types of fraud that can easily be eliminated by small business owners not leaving mail unattended. Reading this report makes me realize that we have a long way to go in identifying and reporting the more sophisticated types of small business fraud.  As I’ve mentioned before, the industry has come a long way in advancing consumer fraud solutions.  Yet, as fraud has migrated into business accounts, we as an industry still have a ways to go in reporting the latest business fraud trends and tracking statistics.  I’m adding this to my wish list for 2011… What’s on your wish list? On a side note, I’ve noticed nearly all of the articles posted in our blog include no reader comments. I’d like to think that this means our readers are too busy to add comments and/or our articles are so well-written that they answer all of your questions. One can dream right? Seriously though, as we approach 2011 and plan our topics, we’d love to hear from you- if you can think of any topic you’d like us to cover more in depth, please let us know.

By: Kristan Frend As my colleague Margarita Lim discussed in her December 3rd article, the SSA announced that it will change how social security numbers (SSNs) will be issued, with a move toward a random method of assigning SSNs. For organizations that currently incorporate the validation of an applicant’s SSN issue date and state as a part of their risk-based decisioning, they will lose this piece of applicant authentication post-randomization. But there is some good news - first, this validation piece won’t be entirely terminated on day one of the SSN randomization for organizations. All the change means is that the newly issued SSNs will be randomized. In other words, the only SSNs that the issue data and state won’t be validated on day one are the SSNs that have just been issued to the recently born or immigrants. Given that its likely newborns won’t be applying for credit for another 18 years, the bulk of the newly issued SSNs that organizations will see for a while are those belonging to adults who were recently issued a SSN…A growing number of applicants, but not the majority of applicants. The other bit of good news is this may actually be a good thing for all of us in the long run.   While we’ll end up losing the ability to validate an applicant’s SSN issue data and state, the criminals will be at an even greater disadvantage. Consider this- Last year researchers* were able to “identify all nine digits for 8.5 percent of people born after 1988 in fewer than 1,000 attempts. For people born recently in smaller states, researchers sometimes needed just 10 or fewer attempts to predict all nine digits.” I don’t expect this change to drastically reduce third party fraud rates but over time it should eliminate one component of identity theft and ultimately benefit an organization’s Customer Information Program. *The National Science Foundation, the U.S. Army Research Office, Carnegie Melon Cylab, and the Berkman Faculty Development Fund provided support for the research.  To view the entire study, please visit http://www.pnas.org/content/106/27/10975.full.pdf+html.

By: Ken Pruett The majority of the customers I meet with use some sort of Velocity Checks to assist with their Fraud and Compliance process. However, there are still quite a few that do not, especially when opening up New Business Accounts. Historical data checks have proven to be an effective form of identity theft prevention for both Consumer fraud and Commercial Fraud. We see scenarios where a perpetrator will have one successful penetration of a business and opens up a fraudulent account.  They then try and replicate this against the same business. All of the information may be different, with the exception of one element, often the phone number. Without velocity checks, this may not be identified at the time the account is being opened. More sophisticated rings try to be more creative in their fraudulent attempts. They may gain access to a consumers information and then go and apply at a variety of entities. They are more careful, so they never attempt to target the same business twice. They are aware that many companies have velocity checks, so they do not want to take a chance of having their information questioned. At a minimum, the use of in-house velocity checks should be a standard process for you fraud detection measures. Typical data elements to check against are; name (business or consumer), address, phone number, and Social Security Number. A fraud best practice would be to use a tool that provides velocity checks and incorporates the information into a fraud prevention tool. There are tools that provide checks across multiple businesses and this typically provides the best level of protection. By looking at inquiry information across multiple businesses, you are able to help prevent being a victim of some of the more sophisticated rings. Don’t find yourself being the easiest target. Once you get hit, it could snowball and you may be victimized multiple times. We all know there is no way to stop all of the fraud, but let’s not make it too easy on the perpetrators. Try and find a way to use some sort of velocity checks in your process to at least minimize your fraud risk.