Take On Payments, a blog sponsored by the Retail Payments Risk Forum of the Federal Reserve Bank of Atlanta, is intended to foster dialogue on emerging risks in retail payment systems and enhance collaborative efforts to improve risk detection and mitigation. We encourage your active participation in Take on Payments and look forward to collaborating with you.
Comments are moderated and will not appear until the moderator has approved them.
Please submit appropriate comments. Inappropriate comments include content that is abusive, harassing, or threatening; obscene, vulgar, or profane; an attack of a personal nature; or overtly political.
In addition, no off-topic remarks or spam is permitted.
August 2, 2021
Ransomware: To Pay or Not to Pay?
Ransomware attacks against high-profile corporate, educational, and governmental entities continue to make the news. What the media often overlook, however, are the continuing attacks against consumers' home networks and devices. Imagine your panic when you turn on your personal computer and you get a message demanding $500 in cybercurrency or gift cards for your tax, banking, investment management, family photo, and other important files that a criminal has encrypted. Do you pay or not?
Law enforcement and cybersecurity professionals almost all say "no.” A March 2021 report from a cybersecurity firm described a study of 15,000 consumer ransomware attacks in 2020 worldwide. In more than half of these attacks (56 percent), the victims paid the ransom—but only 17 percent of those making payment regained full access to their files. Adults 55 and older were the age group least likely to pay a ransom (11 percent), while the 35–44 age group, at 65 percent, were most likely to pay.
Arguments against payment are threefold:
- It encourages further attacks because the victim has already shown willingness to pay.
- It rewards criminal behavior and provides funds for additional attacks.
- It may not result in 100 percent recovery of files.
Those consumers making a ransomware payment do it because they hope the payment will restore their files faster and they'll soon resume normal use of their computer.
As this type of cybersecurity attack against consumers and business continues to increase, education about its process and the defenses that should be undertaken are critical. What is the best way to provide that? Let us know what you think.
May 17, 2021
Common Learnings from Fishing and Phishing
As a youngster growing up in Southeast Georgia, one of my favorite summer pastimes was fishing with my older brother at the local creek using cane poles and some corn niblets or, if we really hit the bait treasure box, pieces of beef hot dog. There is a reason they call it fishing and not catching as most days we barely got a nibble. But there were those days when we would land a nice-sized bluegill.
As I grew older and my fishing opportunities expanded, I began to learn more about the science and techniques of fishing. To increase the catching, there was a level of knowledge needed as to what type of bait (artificial or live) and what fishing technique (bottom, slow, or fast retrieve) to use to target the species of fish I wanted.
I reviewed the FBI's 2020 Internet Crime Report recently and learned that there were more than 240,000 phishing/smishing/vishing/pharming incidents in 2020—an increase of 110 percent over 2019 (and these are just those that were reported). Losses from these incidents were estimated at $54 million. Reading about this made me flash back to my fishing learnings. I reflected that in phishing, as in fishing, there are those people who simply throw out a baited hook to see what bites they get. They blast out a generic email to tens of thousands of email addresses they bought or otherwise acquired illegally, promising fortunes if you only pay, in advance, a finder's fee or the taxes, with gift cards or cryptocurrency. (These messages have advanced over the years to eliminate the poor grammar and misspellings and provide a more believable scenario about the money that belongs to you.)
It has become obvious to me from my research, from seeing the attacks firsthand, and from listening to my colleagues that criminals are becoming more sophisticated in their messages. They are quick to take advantage of current health or natural disaster crises, sending links to “breaking news” that contain malware or links to false websites to capture your personal information or other credentials. They have become very skilled in identifying a target and researching that individual's hobbies or life events through social media, which allows them to craft a message that appears legitimate and appeals to the target's interest.
My colleagues and I are constantly trying to better educate the public about these threats through our posts, webinars and other publications. Just when we think we've seen it all, the criminals come up with a new twist on an old scheme, such as what we saw over the last year regarding the stimulus payments. The bad guys are always going to be out there hoping they can get a nibble from you so they can try to set the hook and reel you in. Don't let yourself be the catch of the day.
January 25, 2021
Resolve for Better Data Privacy
On the heels of a year that saw, among other things, ransomware attacks occurring about every 11 seconds and a significant supply chain breach affecting 18,000 public and private entities, better data privacy should top our collective list of New Year's resolutions. But if this wasn't among our resolutions, we still have National Privacy Day on January 28 to remind us of the need to be vigilant.
Frank Sinatra sang to us in "Love and Marriage" that you can't have one without the other. Likewise, you can't separate data privacy from data protection. Organizations that place a high value on data privacy implement strong data protection measures. Without doing so, privacy can't be assured.
The National Cyber Security Alliance, sponsor of National Data Privacy Day, has created calls to action employing a few basic privacy concepts that individuals and businesses can follow to keep data safe online.
For individuals: Own Your Privacy
- Personal info is like money: Value it. Protect it. Beyond personally identifiable information, this extends to e-commerce purchases, IP address, and location.
- Keep tabs on your apps. Don't just click "OK" on those pop-ups asking to access your location, contact lists, photos, and other personal data. Consider why it is needed and how it will be used and stored. Also, closely examine links and attachments in text messages and emails to keep malware and viruses off your mobile device.
- Manage your privacy settings. Revisit the data access permissions on your apps and web services.
For businesses: Respect Privacy
- If you collect it, protect it. Consider the data your business collects, the business purpose it serves, the way it is stored (such as data encryption), and the length of time it is stored.
- Adopt a privacy framework. Establish a privacy culture in your organization that manages risk and promotes transparency.
- Conduct an assessment of your data collection practices. Evaluate their adherence to applicable privacy regulations.
- Remember that transparency builds trust. Promote transparency with customers in the collection, use, and sharing of their personal data.
- Maintain oversight of partners and vendors. Ensure that third-party service providers share your priority for data privacy and protection.
As many of us will likely continue to work remotely well into 2021—and will likely continue our heavy use of the internet and e-commerce adopted last year—the new year provides a good opportunity to examine apps and behaviors that could put your data privacy at risk. For me, this includes reviewing locations where my payment information and other personal data are stored.
How will you resolve to better protect your data in 2021?
November 9, 2020
Cheering on the Team—Go ACH!
Did you see the commercial during the last SuperBowl about ACH payment innovations? No? Me neither. Of course, that's because there wasn't one. In fact, it doesn't appear there needs to be public advertisements for ACH payments. Why? With value processed on the network having increased more than $1 trillion over the past seven years , ACH doesn't have to be a household name. What you do need to know is that there is lots of growth and innovation happening with ACH behind the scenes these days, and I am an ACH cheerleader.
According to Nacha, the organization responsible for administering the ACH network and its private-sector Operating Rules, the Automated Clearing House (ACH) network processed 34.7 billion transactions valued at $55.8 trillion in 2019. That's, respectively, 7.7 and 8.9 percent growth over 2018. That's also 47 times more than the combined 2019 net sales of Walmart, Amazon, Kroger, Costco, and Walgreens, which was $1.186 trillion, according to National Retail Federation rankings. As for the number of transactions, the total volume of U.S. ACH payments in 2019 translates to approximately 75 payments per person. Any way you count it, it's hard to deny that, as with a line of scrimmage, there's action around ACH.
Innovation, too, has been burgeoning. The Federal Reserve System's Retail Payments Office, which is located at the Atlanta Fed, is one of two ACH network operators, so we have a front row seat. We're seeing lots of fintech creation, including, for instance, mobile apps and voice-activated or conversational payments. Much of this innovation takes place through a democratic rule-making process, whereby stakeholder work groups study recommend opportunities for modernization. These groups have been extremely busy.
October 30 was the deadline for all depository financial institutions participating in the ACH Network to register their primary representative in the ACH Contact Registry. Nacha will maintain this database on behalf of registry members, making it easier for them to contact one another. For them to have fast access to live humans managing ACH operations can be critical, especially when mitigating time-sensitive fraud events such as business email compromise.
In the never-ending fight against fraud, three changes will take effect in 2021. First, Supplemental Fraud Detection for WEB Debits (WEB debits are also known as internet-initiated entries). With this change, ACH originators will be required to include account validation within a commercially reasonable fraudulent-transaction detection system for the first use of new account information. This validation will help block ineligible receivers. Second, security requirements for stored data will be enhanced. Third, a new return-reason code will be created for unauthorized returns, allowing financial institutions to immediately differentiate unintended mistakes from suspected fraud.
Next spring, another highly anticipated ACH change will occur. A new Same Day ACH processing window deadline of 4:45 p.m. goes live on March 19, 2021, which will expand access to same-day processing, especially beneficial to financial institutions in the Central, Mountain, and Pacific Time zones.
ACH was the very first payments system I studied, and I've been an ACH cheerleader ever since. I'm very excited for all the changes that are in play. And while my family and friends—well, most people for that matter—don't exactly celebrate the innovation wins with me, my payments teammates know how much work goes on around the ACH network to continue to make forward progress.