Target Data Breach Can Be Opportunity for Banks

COMMUNICATION STRATEGIES

Banks and credit unions are taking differing approaches to dealing with the recent security breach involving credit cards and debit cards used at Target stores over the holidays. Some banks are identifying compromised debit or credit cards and issuing fresh cards immediately while other banks are taking a watch-and-wait stance, taking action on a case-by-case basis if fraud is detected.

Either way, many banks are using a proactive, multichannel approach for keeping customers informed which can build much sought after loyalty and trust.

In what may turn out to be the largest data breach of its kind, Target reported in December that hackers had stolen credit card and debit card information connected to as many as 40 million customers who shopped at Target stores between Nov. 27 and Dec. 15. Since then, Target has issued additional information that another 70 million customers may have had personal information compromised, including names, phone numbers and email addresses. 

Subsequently, Neiman Marcus revealed it too had been the victim of a security breach, and there are some reporting that the POS system hacking could extend to additional retailers.

The full magnitude of the damage will not likely be known until later in January, when customers receive and examine their monthly statements and call their banks, security experts have said. In past cases, it has taken 30 to 45 days for the vast majority of bad charges to surface. Unfortunately, in a scenario with so much publicity, the impact of the breach may be felt for months . . . or longer.

So, the question is - What is the best way to communicate around a data breach of this nature? In working with a leading communications tracking firm, Competiscan, I was able to see a variety of communication strategies involving multiple channels and a variety of resolutions to the Target data breach.

"In today's environment, it's not a matter of if a data breach will occur, but when it will occur, and how well you respond. Do everything you can to prevent data breaches, but also fully plan out how you will respond if a breach occurs. Today's media and consumer demands that two-pronged approach." - Brian Lapidus, COO, Kroll Fraud Solutions 

Target Communication

The one thing that should be part of any crisis plan is the reality that you might have to be in communication with hundreds of thousands of customers instantly. Unfortunately, while Target did 'go public' almost immediately after becoming aware of the situation, they were not prepared to handle the volume of calls or visits to their website/Facebook page that occurred. For instance, Target's initial notification post garnered over 3,500 comments and 1,600 shares in the first few days from customers concerned about their card security.

The same is true for the financial institutions that have been tracked. While some communicated with customer as early as December 20th (the day after the initial discovery), some organizations have not yet reached out to all customers to explain what has occurred, what precautions can be taken and how the bank is working on their behalf.

According to a Reuters/Ipsos poll conducted from January 2 to January 10, 40 per cent of people who shopped at Target during the period of the data breach had not been notified about the incident. Thirty-one per cent said they had been notified by Target and 28 per cent said they had been notified by their bank or credit card company.

This is an opportunity lost at a time when trust between customers and their financial institution is still fragile from the past financial crisis.

"More than 55 percent of respondents said the notification about a data breach occurred more than one month after the incident, and more than 50 percent of respondents rated the timeliness, clarity and quality of the notification as either fair or poor." - The Consumer's Report on Data Breach Notification

The day after the initial reports surfaced, Target emailed millions of customers it thought were affected, and for whom it had email addresses. It has done the same for the additional customers it's now found to be involved. 

The company also created a dedicated page on its website for the data breach, including resources about identity theft and credit reports. Target has said that it plans to offer a year of free credit monitoring and identity theft protection to anyone who shopped in Target stores in the United States.  

Finally, Target also sent postal letters and posted a series of short YouTube videos to explain details around the security breach, what the company was doing about the situation, and a discount offer to customers. It also provided the first set of steps a customer could take to protect themselves and where they could go for additional information.

Target Letter to Customers

One of a series of YouTube videos from Target CEO to customers

It's Time to Require Email Addresses as Part of Account Opening Process

I have been in banking long enough to remember the roadblocks that stood in the way of collecting birth dates from customers before the government required this information as part of the customer account file. New account representatives complained that collecting the information was intrusive and impacted the privacy of the customer even though the information was already collected as part of other financial institution transactions (insurance and investments). Once the government required collection of this insight, the barriers came down overnight and marketers were immediately armed with an important tool in modeling households and targeting messages.

While it is doubtful that the government will ever mandate the collection of email addresses, now is the time to add this to the information your bank requires as part of the new account opening process. While some people won't have an email address to provide, this communication option is beneficial for both the customer and the bank.