Introduction and summary
In this article, we consider the potential for data breaches that compromise the security of personal and account information to threaten consumer confidence in payment card systems in the United States. (1) In particular, we explore whether a large, well-targeted data breach (or a sequence of breaches over a relatively short period of time) might render inoperable a payment card system (for credit, debit, or prepaid cards), possibly resulting in its being abandoned, temporarily or otherwise, by a substantial number of consumers. (2) We recognize that, given the precautions that are in place in such systems, the probability of a catastrophic abandonment is quite low. But this probability is not zero. Recent events, as well as feedback from the industry, suggest that further study of such potential tail risks could be helpful. (3)
The shutdown or abandonment of one or more of these systems, even if the duration is relatively limited, might amount to a significant disruption in the flow of funds among consumers and businesses and, increasingly, from governments to households in the form of benefit payments. (4) Such transactions might be immediately shifted to alternative means of payment, but doing so could create substantial operational challenges for those payment systems. Sudden shifts away from payment card transactions to other payment methods might also invoke a policy response to an immediate crisis based on incomplete information--which would be less desirable than a response based on a process of carefully gathering and evaluating all the available information.
In the event of a crisis, the Federal Reserve maintains a legal and electronic infrastructure to provide liquidity to banks facing interbank settlement difficulties as a result of disruptions to the normal clearing and settlement cycles of card systems; however, this liquidity would have to quickly reach consumers and businesses, including nonfinaneial firms, that rely on these systems as a means to exchange value and whose payment behavior would be affected by even a temporary disruption in one of the card networks. To allow for efficient payment substitution in support of a smoothly functioning U.S. economy, there must also be multiple reliable ways to make and receive electronic payments.
For all of these reasons, researchers at the Federal Reserve Bank of Chicago and the Payment Cards Center at the Federal Reserve Bank of Philadelphia developed a series of questions and organized informal conversations with a variety of payment system participants, with the goal of better understanding the nature and significance of risks posed by data breaches to payment card systems. More specifically, to examine the adequacy of existing efforts to prevent, manage, and mitigate fraud in card-based payment systems, the Chicago Fed and Philadelphia Fed researchers conducted 17 industry interviews in 2009. The individuals interviewed represented a variety of domestic perspectives, including those of networks, banks, merchants, processors, independent sales organizations (ISOs), vendors, and information-sharing organizations. This article documents the insights gained through this exercise, but it does not identify individual organizations or respondents. Ideally, the information learned from these interviews would be helpful to other researchers considering the risks that data breaches may pose to retail payments in the United States, as well as how those risks can be mitigated in the most optimal manner.
In the next section, we provide an overview of the threat that fraud poses to the smooth operation of payment card systems in the United States. Then, we discuss specific measurements of losses due to payment card fraud, as well as the current scale and character of data breaches in the financial industry. After providing this background information, we summarize our industry interviews and discuss the lessons learned from them. …