Do We Have a Data Security Crisis in America?

On Monday, I tweeted (@dennisEFTA) my thankfulness for Congress being on recess as news broke on the Global Payments data breach. The saying goes Congress does two things: nothing or overreact. Nothing spells public policy disaster more than Congress overreacting to a perceived crisis (see Sarbanes-Oxley).

Do we have a data security “crisis” in America? I certainly do not possess the proper expertise in this area to give a good answer. FBI Director Robert Mueller recently told attendees at a RSA security conference in San Francisco that two companies exist in America: those that have been hacked and those who will be. We know when these breaches occur because most states have laws requiring companies to notify authorities and consumers when sensitive, personal information is unduly accessed or lost. At this writing, Congress has not acted on a national data breach notification bill.

This may change, however. We certainly do not have a shortage of cyber-security, data security and breach notice bills before the Congress. In fact, Congress has not passed any bill over the years due to overlapping jurisdiction and committees. Is data protection a commerce issue, a technology issue, a homeland security issue or a judicial issue? April 23 begins cyber-security awareness week in Washington. The House of Representatives leadership has difficult choices ahead on what bill to bring to the Floor for a vote. On the Senate side, the competition is between the Lieberman-Collins’ approach of possible government control over “critical infrastructures” and the McCain proposal to allow greater information sharing between the public and private sectors. And, has data security and breach notification taken a back seat to these larger cyber-security proposals?

While Congress struggles to untangle the jurisdictional mess, where is the American consumer in this debate? I speculate the real reason Congress has not enacted data security legislation is the lack of demand from the American public. We hear news reports of data breaches all the time. Some even receive letters from companies that their personal data has been lost or unduly accessed. Survey data suggest Americans are still very concerned about identity theft and conducting financial transactions over the Internet. I do not sense, however, Americans are expressing outrage to Members of Congress. Is one reason why most data breaches do not actually result in harm to the consumer? And, if financial harm does occur like unauthorized transactions on a stolen credit card, do Regulation E protections blunt consumer outrage?

I wish I had a good answer as to whether President Obama will sign any meaningful data security legislation into law by year’s end. Meantime, I can confidently write EFTA members spend great time, effort and resources protecting the billions of sensitive, financial records in their possessions. It’s the law (Gramm-Leach-Bliley’s Safeguards Rule), but it’s also good business and the right thing to do for the America consumer.

-Dennis

Director Cordray's Coming-out Party

Late last month I attended the Consumer Bankers Association conference where Consumer Financial Protection Bureau Director Richard Cordray gave his first speech before a large industry group.  Unlike his pseudo-predecessor Elizabeth Warren, both he and his remarks came across as reasonable and measured.

Mr. Cordray stated that the overarching goal of the Bureau is to make sure that the consumer is protected no matter what kind of financial product or service is being offered. He focused on the need for clear and concise disclosure and told his audience of mostly bankers that the Bureau will seek to level the playing field between banks and non banks. This will be accomplished by among other things, requiring simple and clear communication and disclosure to the consumer.

His most encouraging remark came in response to a question about bank profitability when he answered,  "Banks not only have a right to profit, but the market won't work without it".  Would that other members of this Administration believe, or at least say something similar.

To those involved in the financial services industry Director Cordray's presentation was more Mom and apple pie than anything. Which in itself is a nice break from Professor Warren. Time will tell if his actions ( or should I say enforcement actions) match his words.

Given the political genesis of the Bureau, there are likely to be big headlines and high profile CFPB enforcement actions in advance of the November elections. The timing on this will be purely coincidental.

Congress Zeroes in on Mobile Payments, but Uncertain of the Target

Mobile payments, mobile banking and mobile financial services are getting attention by lawmakers on Capitol Hill. Both House and Senate banking committees have conducted hearings in the last two weeks on the issue. More hearings are expected in the spring and summer.

At this writing, Congress appears to be in the “understanding” phase. Who are the players? What is the difference between mobile payments and mobile banking? What are the roles of wireless carriers and software providers? What are the legal protections for consumers? What is an “open mobile wallet?” How will mobile financial services affect the underserved? Is the United States behind other countries in the adoption of mobile financial services? Are mobile payments secure? What are the barriers to broader consumer adoption of mobile financial services?

Federal Reserve representatives testified at both the House and Senate hearings armed with new data on consumers and mobile financial services [link to report here found at efta.org]. The findings are clear. A vast majority of U.S. citizens has a mobile phone. Approximately 44 percent of mobile phones can connect to the Internet (i.e., smartphones). Please refer to the FRB’s report for additional statistics. Surprisingly, the underserved make greater use of mobile financial services than the banked.

Consensus emerged from both hearings about a possible gap in consumer protections when a mobile payment charge appears on a consumer’s wireless statement and not on a traditional card statement from a bank. It is unclear at this time on how Congress may address this. Mobile payment security was another popular theme expressed at both hearings. On this issue, perception may be a greater force working against mobile payment acceptance than reality. According to the FRB study, about half of the mobile phone users cited security as the reason not participating in mobile financial services.

It’s hard to tell where Congress will go next on the mobile financial services topic. The same probably could be asked of the industry itself. Players are coming and going. The banks, processors, networks, wireless carriers and device makers are competing and collaborating for this segment. I’ll check back when the next round of Congressional hearings start.

Louie's Looking for You

Interesting editorial this morning in the Wall Street Journal. In its role as the defender of free markets, the Journal's editorial board usually fires back in eloquent defense of financial institutions, hedge funds and the mortgage industry. This morning the editorial board put on their jeans and tee shirts and went down market to show some love to the storefront payday lending industry.

A payday loan is a short term loan meant to tide the borrower over until his next paycheck. It is a service targeted primarily to low and moderate income households, known as LMI households. According to a payroll industry survey more than three-quarters of households now live paycheck-to-paycheck.

Payday lenders are often accused of charging usurious interest rates, being an unregulated industry, and preying on the poor. Apparently that's all the mandate the new Consumer Financial Protection Bureau needs to jump into the payday lending wars. The Bureau held it first field hearing last week in Birmingham, Alabama to discuss the small loan industry, of which payday lending is a big part.

But the CFBP needs to consider the accuracy of the charges against the these businesses. Typically opponents of the industry will accuse payday lenders of charging 391 percent annually on a $100 loan. But that's misleading. Payday loans aren't annual contracts. They're short term loans. In reality most lenders charge $15 for that $100 loan. That's 15 percent, not 391 percent. The only way you get to 391 percent is by rolling over a two-week $100 loan 26 times.

As to the charge that payday lending is largely unregulated, the fact is that over 60 percent of the states regulate the practice already. The industry's position is that payday lenders would like to see regulation in all 50 states. In the interest of fairness, I should point out that regulation of this type often becomes a barrier of entry to new, potential competitors entering a market. So when storefront lenders cry "Regulate me!"they may be motivated less from a consumer standpoint and more from a desire for territorial protection.

As to the charge that payday lenders prey on the poor, the Journal cites a Federal Reserve study that found nearly all payday loan customers knew the terms of their loan agreements and were satisfied with the loan product.

So you have to ask the question: What does the CFPB hope to accomplish by regulating payday lenders? They provide a valuable service in the communities in which they operate. Where else could a laborer bringing home $190 a week borrow $100 to fix a 15-year old Econoline van? Payday lenders are already regulated at the state level, where the regulators are closer to the businesses and can probably protect consumers better. And the customers themselves seem satisfied with the deal they get.

Payday lending is part of what the Treasury Department terms "money services businesses, " or MSBs.  These include check cashing businesses, money transfer businesses, pawn shops, gold and silver dealers in and payday lenders. These are businesses that don't prey on the poor; they offer products no one else will. The problem in regulating MSBs like payday lenders is that you can regulate them out of existence but you can't regulate the need they meet out of existence. LMI households have the same need for credit as higher income households. The only difference is that LMI households have limited options. The next rung down from MSBs on the credit ladder is some guy named Louie with a real bad temper.

Overregulating, or squeezing might be a better word, payday lenders out of business only hurts LMI households because it further limits their credit options.

I know about MSBs because I worked with this industry for ten years. I know about the Louies of the world because my father had to borrow money from him once to make the rent. Didn't end well.

This is the world in which LMI households reside. They don't live in a federal office building and they don't live in a field hearing. They live in twilight zone between almost-made-it and never-will. And always waiting for them at never-will is Louie.

I have found over the years that regulatory agencies have some of the best and brightest stars in federal service. People who really know how to get their arms around a problem. Quick studies. And good analysts. But I wish next time this comes up, as it does periodically, some regulatory agency, whether it be the CFPB or someone else, would put assets on a case that have actually borrowed money from someplace other than a bank. Have actually cashed a check without having access to a bank. Or pawned a guitar in college to pay the rent. I think those folks would inform the debate more than a photo-op road show.

That's my opinion. What's yours?

ATM Fee Signage (Continued)

According to the Beaumont Enterprise a New York man is suing a Texas credit union alleging that it failed to post a notice on one of its ATMs stating the cost of using the machine, as required by the Electronic Funds Transfer Act.

Five weeks ago we blogged about lawsuits over fee notification which are costing the financial industry big bucks. I'm sure there are cases where the disclosure notice was missing from an ATM. The court will decide if this case is one of them. But the costs of the nuisance suits will eventually be passed on to consumers like in every other industry. In "ATM Fee Disclosure: Updating Regulation to Limit Jackpot Justice" we made the argument that nuisance lawsuits over this issue have become a get-rich quick cottage industry.

I know some people find it shocking that banks actually charge people - with whom they have no commercial relationship - to use the bank's equipment. Next thing you're going to tell me is that if a perfect stranger knocks on my door and wants to use my car I can't charge him for the gas.  

According to the court filing, the plaintiff in this particular case claims that that he used an ATM of the Firestone Community Federal Credit Union  in Orange and was charged two bucks, and that the fee notification was not posted on the machine as required by law.

If the plaintiff is successful in his legal quest, what would be the remedy? I personally think he should be compensated. I think a fair number would be - two bucks. If I ran Firestone Community FCU I'd issue him a bank check for two dollars and point him to one of the Lone Star State's many fine check cashiers. See how he likes those fees.

At some point ATM signage suits become frivolous. I would think, given the publicity that this issue has received within the credit union industry, that any credit union or bank would be crazy not to make sure by now that their fee notices were plastered to their ATMs with Gorilla Glue, Mighty Putty or something used in the space program.

Meanwhile, speaking of deciding,  I think its time for Congress to decide whether this whole thing over ATM signage has gotten out of hand. It's time to recognize, 15 years after ATM owners started charging for the use of their property, that fee notification on the screen, which is much more secure and visible, fulfills the intent of the EFT Act.

That's my opinion. What's yours?

Smart Cards - Just Around the Corner

   Those of us old enough to have voted for or against George H. W. Bush for president may remember the anticipation 20 years ago over a technology that placed a small microcomputing chip right in a payment card. As that technology was adopted in Europe and other places we were told that those "smart" cards were coming our way. Right around the corner, we were told.

   I thought of that reading a lead story on the PYMNTS.com website this week. The article focused on   the release of a white paper on the implementation of EMV in the U.S. The paper was sponsored by Gemalto, a significant provider of EMV-compliant card solutions, with an assist by VeriFone, an equally significant provider of EMV- compliant POS solutions.

   Leaving the motivation behind the paper aside for a moment, it does provide some interesting insights into the EMV debate. Not the least of these are some suggested reasons the migration to smart cards and EMV will be different this time around, and by implication, why it's take so long to get here in the first place.

   Let me say from the outset: I have no horse in this race. I am neither a proponent nor an opponent of EMV, smart cards, NFC or mobile payments. Like most consumers, my bank sends me a card and I use it. I don't question the technology.

  What I do wonder, like most inquisitive people, is just who pays for all this new stuff. There's a great line in the Jerome Lawrence/Robert E. Lee play Inherit the Wind. Henry Drummond, the lawyer-protagonist, tells the jury in his summation, "Gentlemen, progress is never a bargain. You always have to pay for it." So assuming that EMV represents progress in payment systems, I wonder how it gets paid for.

   Give Gemalto props for a paper that brings together most of the salient points of the EMV discussion in one pretty tight package. Unfortunately, the paper blunts its main argument - that the stars are in alignment for EMV. It does so by relying on some less-than-dynamic logic. Such as the old chestnut that the American payment system is positively antediluvian. We're reminded time and again that "(m)ost of the world has fully migrated or is in the process of migrating to EMV chip technology..." Or, "(g)iven the prevalence of EMV chip technology in the rest of the world..." we lower primates here should get with the program, lest we keep scraping our knuckles on a worn path of magnetic-striped cards.

   I have relatives in Europe. When we get together I often quiz them about their banking and payment systems, from a consumer standpoint. Just to compare notes. Far from being a bunch of silverbacks, I think we do a pretty good job in payments over here.

   The Gemalto argument also relies too heavily on Visa's August 9, 2011 announcement of its carrot-and-stick approach to goose the adoption of EMV. The carrot is a merchant dispensation, beginning in October of this year, from having to validate compliance with the PCI Data Security Standard - provided three-quarters of a merchant's transactions originate from chip-enabled terminals.

   The stick is Visa's intention to shift liability for counterfeit fraud (in the case of a chip card presented for transaction to a merchant who has yet to install chip-reading terminals) from the card issuer to the merchant's acquirer. Ouch.

   But unless merchants upgrade their equipment to accept mobile contactless NFC payments as well as chip cards, they won't benefit from the carrot -  escaping the annual PCI compliance validation. So says veteran industry analyst Avivah Litan in another article. She also points out that even if merchant processors do get to go directly to GO and collect $200, they still have to have their compliance validated by other card brands like MasterCard, American Express or Discover.

   And while you can say you'll shift liability to someone else, ultimately that cost will be shifted to someone else. And we know who that will be.

   None of this is meant to diminish the security advantages of EMV over our current magnetic-stripe card system. But if you're pinning your hopes on the American payments industry being shamed into putting on a clean shirt and adopting EMV, or on merchants, card companies, and processors all playing nice in the sandbox, given the litigious and legislative history of the last eight years, we might not be as close to EMV as you think.

   So, while EMV and chip cards might be right around the corner, the road to that corner still appears pretty long and still filled with some formidable obstacles.

   That's my opinion. What's yours?

  
  

Evaluating Dodd-Frank

   The financial services industry, like most other industries, devotes a great deal of attention to the regulatory process. Many of us in school learned the phrase "The president proposes; Congress disposes." The nation's chief executive proposes regulation, but it is the job of Congress to see those legislative proposals embodied in law as Congress sees fit.

   However, the second half of the equation might be "Congress directs; the regulatory agency effects." Congress upon the president signing a bill into law will direct the appropriate executive agency to implement and monitor the law. And this occurs through the regulatory process. How regulations are implemented and monitored is something most executives in the industry pay close attention to. Witness Gramm Leach Bliley, Sarbanes Oxley, and Dodd-Frank over the last decade or so.

   If you've been involved in the regulatory process, either from the perspective of a regulatory agency or an industry subject to regulation, you have to come away with a good deal of respect for the process. For regulators the challenge is to develop rules that conform with Congress' intent on a particular law. For industry the challenge is to protect the commercial viability of whatever is being regulated.

   It is a unique system where regulators seek comment from the public, evaluate thousands of pages of commentary and propose rules which in some form eventually make their way into the Code of Federal Regulations. The regulators I've been fortunate to work with take their job seriously, work hard, and want to get it right the first time. Most of the time the process works pretty well.

   However, it seems that this system, which has worked so well for so long, is struggling under the sheer weight of several pieces of sweeping, magisterial legislation. Among these is the Dodd-Frank Wall Street Reform Act.

   An editorial in the Wall Street Journal earlier this week claims that a new study shows that the quality of federal regulation is declining. It points to Dodd-Frank and the Accountable Care Act as examples. The Journal cites a Government Accountability Office report on the implementation of Dodd-Frank, Dodd-Frank Act Regulations: Implementation Could Benefit from Additional Analysis and Coordination.

   The regulatory agencies responsible for monitoring Dodd-Frank have a great deal of discretion and are not required to follow the guidance of the Office of Management and Budget, which states that regulatory agencies should include cost-benefit analyses in their review of existing legislation. Most of the independent regulators involved in overseeing Dodd-Frank told the GAO they try to follow the OMB guidance. But in its review of the agencies' rulemaking procedures the GAO found ten of the 32 rules implemented so far for Dodd-Frank were inconsistent with OMB's guidance on considering the benefits of a rule in light of the cost of implementing it.

      In burying the lead the GAO concluded that Dodd-Frank regulators "may be missing an opportunity to enhance the rigor and improve the transparency of their analyses."

   Perhaps more disconcerting, the GAO goes on to note that while the regulators are required to assess the impact of implementing the financial reform law, "some have not yet developed plans to review their Dodd-Frank rules." Yikes. Here we are, 18 months into Dodd-Frank, and some regulators still don't have a plan for figuring out whether the law is working as Congress intended or if the benefits being realized are worth the enormous costs of the Act. Huh?

   The Journal editorial ascribes political motivation to this decline in regulatory quality, but there may be more to it than that.

   You can blame the regulators for this sad state, but that might be like court-marshaling the troops when the general's battle plan goes awry. The real problem seems to be legislation that is breathtaking in scope, unprecedented in complexity, and  burdened with unrealistic implementation time frames. In fact, the regulators may be the first people who've actually digested and parsed what's in laws like Dodd-Frank or the ACA. It is almost inevitable that the quality of rules making and regulatory oversight would suffer.

   Let's hope that the era of panoramic, three-thousand page legislation is over and that the scope of regulatory oversight returns to its former state.

   That's my opinion. What's yours?