Below are several important recommendations to help banks and credit unions ensure customer accounts are not put at risk by the flood of compromised data from recent data breaches:

Protect the front door. Assume customer accounts have already been compromised and implement a multi-layered, device-based security protocol at login. This will ensure access for legitimate customers while providing insights into any unauthorized login attempts. You may not be able to control how consumers manage their digital identities, but you can help protect them from potential financial damage.
Stress account alerts. A growing number of fraudulent transactions are identified by consumers who are using email or text alerts. Encouraging customers to use this option engages them in the account monitoring process and can reduce the time to detect any fraud.
Adopt an omni-channel fraud strategy. Early adopters of mobile technology used native applications and mobile-optimized websites to offer banking on the go. Too often they did so without the same protections as provided for online banking. It is important to have a consistent security policy across channels to ensure new offerings don't introduce new risks.
Don't rely solely on traditional data sources for account openings. While traditional identity verification sources such as credit bureaus and shared databases are important, they do not provide a silver bullet. Sophisticated attackers are using legitimate data elements to create synthetic identities – and even 100% legitimate identities – to acquire credit lines and bank accounts that can be sold underground.
Act on intelligence. Once an account has been directly targeted or compromised, lock down associated accounts, contact customers and proactively reissue cards. Many institutions do not have device-level visibility to online logins, but this is where fraud staging activities are most likely to be perpetrated.
Lighten the regulatory load. Partner with information security organizations to ensure compliance with data protection and security standards so fraud prevention teams can focus on identifying and prevent attack rather than appeasing regulators. By developing strong partnerships with relevant oversight authorities helps ensure that you are involved in planning upcoming compliance requirements.

The days and weeks following a breach are a time of heightened risk. Even after a breach has occurred, the risk can be managed. Arming your organization with a layered security strategy that includes device intelligence will prepare them for the onslaught of fraudulent account creation activity, attempted account takeovers or unauthorized transactions that follow in the wake of any high-profile breach.

Instant Insights /

At War With the Ghost Army

Related Stories

Recommended For You