Toni Lapp

English

Research Papers in Economics

FALL 2005 . TEN 8
he letter from the retailer was
generic but polite, explaining
that the company was investi-
gating the theft of customer
data that included credit card and debit
card numbers. Midway through, the real
purpose of the correspondence emerged:
to notify the Designer Shoe Warehouse
(DSW) customer that her account infor-
mation was among the data stolen
months before. 
The same letter was sent to 1.4 mil-
lion other customers who made
purchases with charge cards or checks,
including Federal Trade Commission
chairwoman Deborah Platt Majoras.
Clearly, no one is exempt from the
threat of breached data.
T
IMPLICATIONS OF electronic payments and
nonbank processing
R
ecent trends away from paper transactions toward
electronic payments and nonbank processing of retail
payments are brought about by the desire to increase
efficiency by exploiting economies of scale in payment pro-
cessing, argues Senior Economist Richard Sullivan in
his working paper “The Supervisory Framework
Surrounding Nonbank Participation in the U.S. Retail
Payments System: An Overview.”
There are many implications to the increased reliance
on electronic payment networks. The scale of operations
and the interdependencies among elements of the network
increase the potential for widespread disruptions. 
Sullivan’s paper describes the supervisory structure
over nonbank participants in the U.S. payments system
and reviews how policy tools such as standards setting,
disclosure, clarifying legal responsibilities, and supervi-
sion can each play a role in improving control of pay-
ments system risk.
TO ACCESS A PDF VERSION of the full document, pub-
lished by the Payments System Research Department of the
Federal Reserve Bank of Kansas City, go to
www.KansasCityFed.org/TEN.
BY TONI LAPP, SENIOR WRITERThe question of how to
protect consumers’ privacy
has been around for years,
long before a number of
breaches this year resulted in
millions of consumers’ per-
sonal data being exposed. 
When the issue came
up in Congress, U.S. finan-
cial institutions favored an
“opt-out” system that was
put into law by the
Gramm-Leach-Bliley Act in
1999. In other words, con-
sumers who don’t want
their personal information
to be shared must opt out
in writing, a scheme that fa-
vors businesses who want to
sell their customers’ infor-
mation. The law, known as
GLBA, also established that
financial institutions have a
responsibility to protect
“nonpublic” information
such as account numbers
and Social Security numbers. 
As a result, some ob-
servers think GLBA has
become a double-edged
sword. Financial institu-
tions asked for freedom to
use the information, and
now they have to bear the
responsibility to protect it. 
According to a recent
working paper by Richard
Sullivan, senior economist
in the Payments System
Research Department at
the Federal Reserve Bank of Kansas City, data
breaches are examples of operational risk in
payments. Sullivan’s paper discusses risk con-
trol in the U.S. retail payments system in light
of the proliferation of electronic payments. 
So how well are companies doing? 
In the first half of 2005, 50 million ac-
counts had been breached in a variety of
incidents. More disturbing is that the issue has
moved beyond financial in-
stitutions and even their
vendors, as the DSW case il-
lustrates. The shortcomings
of GLBA have been clear in
many of these cases; the leg-
islation, as currently written,
only applies to financial in-
stitutions that deal directly
with consumers.
“What’s troubling me is a
lot of the data that’s a target
for hackers is your account
information; that’s where the
money is. And more of that
information is in a more
readily accessible form in fi-
nancial and nonfinancial
institutions as well as at re-
tailers,” said Sullivan.
The weakest link
Identity fraud is actual-
ly on the decline. A 2005
study by a credit industry
consultant found that in a
year’s time, 9.3 million
American adults were vic-
tims of identity fraud, a
7.9 percent drop from a
study in 2003. 
However, the mean cost
of each theft increased 12
percent. Thieves are stealing
more from their victims. The
average out-of-pocket cost to
the victim was $652, and the
time spent to resolve ensuing
problems averaged 28 hours.
Clearly, identity fraud is
costly, consuming money and time.
Thieves are going where the access is: the
Internet. While identity theft in general is de-
clining, attacks on Internet users appear to be
increasing, based on a seven-year study by the
Financial Crimes Enforcement Network.
Reports of suspicious activity tied to Internet
or online banking were on the rise by 2002.
A lot of publicity has been given to the
FALL 2005 . TEN 9
security view of
Joshua Peirez, senior vice president and associate
general counsel at MasterCard International, was
at the Federal Reserve Bank of Kansas City recent-
ly to address officials involved in supervision,
research and operations at the Bank. Peirez, who
has testified before Congress on the issue, spoke
largely about risk in the payments system in the
wake of recent data breaches. 
WHAT IS HIS VIEW OF PROPOSED LEGISLATION? 
THE PUNISHMENT NEEDS TO MATCH THE CRIME.
“It is critical that criminal penalties are increased
to fit the magnitude of these crimes and that the
crimes themselves are easy for law enforcement
and prosecutors to prove,” says Peirez.
THE GRAMM-LEACH-BLILEY ACT, with its require-
ments for storing sensitive data, should be
expanded beyond defined “financial institutions,”
says Peirez. Any entity-retailers, marketers and
payments processor that stores, transmits or uses
sensitive consumer data also should have clear
obligations to safeguard this data. 
HAVING A UNIFORM NOTIFICATION LAW that pro-
vides consumers with notice both when they rea-
sonably need it and in a way that they can make
use of the information makes sense, says Peirez.
It is important to work to find the right balance so
that consumers are not overnotified or undernoti-
fied. It isn’t easy to accomplish, but it is impor-
tant, says Peirez.
An insider’s
proposals
 risks posed by electronic payment methods;
however, most thieves obtained personal infor-
mation using “offline” methods—billfolds
were lost or stolen, acquaintances or family
members abused their access or mailboxes were
compromised. 
That said, a number of means for infor-
mation to fall into the wrong hands exists in
the world of electronic payments. The chart
above shows the most common methods crim-
inals use to access sensitive information.
With the growing complexity of technolo-
gy and the increasing innovations in payment
methods, it’s a reasonable public policy ques-
tion to ask what rules regulators are creating to
address changing security risks. 
When national media reported earlier this
year that 40 million credit cards stored by a
technology service provider had been
breached, it shed light on the potential for
fraud when a customer makes a purchase with
a charge card.
After all, such purchases involve a
labyrinth of steps during which a weak link can
be exploited by a thief.
The company responsible for the breach,
CardSystems Solutions Inc., is a payment
processor, which acts as an intermediary be-
tween merchants and credit card issuers like
MasterCard and Visa. 
What of the protections mandated by
GLBA? The law only applies to financial insti-
tutions providing services to consumers.
Because of the need for advanced technol-
ogy in the era of electronics payments
processing, outsourcers such as CardSystems
have sprung up in recent years. The danger is
that outsourcers add another step in the move-
ment of money, another place in a network for
people to tap into.
As the number of outsourcers increases, so
will the risk to the payments system.
So who’s watching for weak links?
In his paper, Sullivan describes the su-
pervisory structure over providers of
technology services to banks, which is ad-
ministered by a little-known agency named
the Federal Financial Institutions
Examination Council, or FFIEC. FFIEC
comprises members of all the federal agencies
responsible for regulation and supervision of
U.S. depository institutions, including the
Federal Reserve System. The FFIEC assesses
risk in providers of technology services to
FALL 2005 . TEN 10
We have little systematic evidence on whether data breaches
are occurring more or less in bank or nonbank organizations.
“
“
0% 5% 10% 15% 20% 25% 30%
28.8%
11.4%
8.7%
8.7%
8.0%
5.2%
2.6%
2.5%
2.2%
1.7%
Lost, stolen wallet, checkbook or credit card
Friends/acquaintances/relatives with access to it
Corrupt employee who had access to the info
Offline transaction
Stolen paper mail/fraudulent change of address
Computer spyware
Taken from the garbage
Online transactions
Computer viruses/hackers
Phishing
Primary Methods of Identity Theft
(From Known-Cause Cases)
SOURCE: JAVELIN STRATEGY AND RESEARCH
 banks and coordinates examinations of the
riskiest providers. 
Typically, the team that reviews the firm
comprises examiners from member agencies,
such as the Federal Reserve, the Federal Deposit
Insurance Corporation and the Office of
Comptroller of the Currency. This ensures that
the firm only undergoes one exam, but that all
agencies are kept apprised of developments. This
program reduces regulatory burden on a firm
and improves supervisory efficiency.
Nonbank providers of payment process-
ing services are part of the supervision
program. The FFIEC risk assessment would
likely place the largest payments processors in
the supervision program, but due to limited
information, resources and jurisdiction, only
125 payment processors are supervised,
Sullivan notes in his paper.
CardSystems Solutions was one of about
500 payments processors; clearly many of these
firms go unsupervised. Whether this poses
much risk to payments is uncertain.
“We have little systematic evidence on
whether data breaches are occurring more or
less in bank or nonbank organizations or
among supervised or unsupervised technology
service providers,” says Sullivan. 
Public policy
Who should bear the costs of security
breaches? When credit cards are used fraudu-
lently for online purchases, merchants pay for
the fraud, not the card issuer. Some argue that
this gives little incentive for card issuers to im-
plement anti-fraud measures. Similarly,
cardholders may not have incentive to exercise
vigilance when they are protected by loss limits.
To protect the payments system, analysts
have proposed legal reform and regulation to
rationalize liability and responsibility for risk
in contracting relationships for payment pro-
cessing. Lawmakers are considering more
severe consequences for mishandling sensi-
tive information.
It is likely that public disclosure will be ad-
dressed by future legislation. The CardSystems
Solutions breach was discovered by Australian
bank officials in late 2004, yet it wasn’t report-
ed in the United States until June 2005.
Officials have declined to say when the FBI
was notified. 
What frustrates researchers trying to study
the issue is the lack of cold, hard data. Out of
millions of data exposures occurring this year,
it is unknown how many resulted in actual
losses to individuals.
The letter to the DSW customer intimat-
ed as much: “We cannot know if your credit
card or debit card will or will not be used by
the thieves to commit fraud,” it said.
Sullivan says getting better information on
these crimes should be a priority: “As a society we
will have to deal with these things as they come
along. You can’t fix security problems until you
know what they are and how bad they are.”
FALL 2005 . TEN 11
COMMENTS/QUESTIONS are welcome
and should be sent to teneditors@kc.frb.org.
T
SPYWARE: These are programs that, when installed on a
computer, can change settings, display advertising, track
Internet behavior and report information back to a central
database. Spyware may be installed unintentionally by
users, and can be very difficult to remove. This type of
breach was responsible for 5.2 percent of cases of identity
theft, the single most common online breach.
PHISHING: In this type of attack, an e-mail that appears to
come from a legitimate company (for instance, eBay) is sent
to recipients, who are asked to go to a site to update
records and verify username and password. The site is actu-
ally a place to collect that information and steal identities,
money, records and more. Phishing was cited in a recent
study in 1.7 percent of identity theft cases.
HACKING: Many types of malfeasance—computer
worms, Trojan horses and more—fall under this moniker.
Hackers, a term used to describe criminals who subvert
computer security without authorization, were responsible
for about 2.5 percent of known cases of identity theft.
CardSystems Solutions was victim to hacking.
Modus Operandi
There are a number of methods
the criminally minded can employ ONLINE
to do harm:
1
2
3

A breach of trust : protecting privacy in the age of electronic payments

http://www.kansascityfed.org/publicat/TEN/pdf/Fall05NB.pdf

A breach of trust : protecting privacy in the age of electronic payments

Abstract

Similar works

Full text

Available Versions

Research Papers in Economics