Please enable JavaScript to view the comments powered by Disqus.

We use cookies on our website to give you the best online experience. Please know that if you continue to browse on our site, you agree to this use. You can always block or disable cookies using your browser settings. To find out more, please review our privacy policy.

COVID-19 RESOURCES AND INFORMATION: See the Atlanta Fed's list of publications, information, and resources; listen to our Pandemic Response webinar series.

About


Take On Payments, a blog sponsored by the Retail Payments Risk Forum of the Federal Reserve Bank of Atlanta, is intended to foster dialogue on emerging risks in retail payment systems and enhance collaborative efforts to improve risk detection and mitigation. We encourage your active participation in Take on Payments and look forward to collaborating with you.

Comment Standards:
Comments are moderated and will not appear until the moderator has approved them.

Please submit appropriate comments. Inappropriate comments include content that is abusive, harassing, or threatening; obscene, vulgar, or profane; an attack of a personal nature; or overtly political.

In addition, no off-topic remarks or spam is permitted.

June 14, 2021

Fighting Ransomware

Four years ago, in a May 2017, Take on Payments post, my colleague Doug King echoed the concern of cybersecurity experts, warning that 2017 and 2018 were going to be the “Year(s) of Ransomware.” This warning came as ransomware attacks were increasing in frequency and being carried out against higher-profile targets. In 2018, the City of Atlanta was attacked. Following the recommendations of law enforcement officials, the city refused to pay the $51,000 ransom. Many city services involving utility billing and traffic court were disrupted for as long as a year, and officials estimated the price tag of investigation and remediation at $17 million.

In its latest reportOff-site link, cybersecurity firm Group-iB described the results of its analysis of more than 500 ransomware attacks: not only did the numbers of attacks in 2020 increase by more than 150 percent over the previous year, but also the sophistication of the attacks themselves had substantially increased.

Over the last month, high-profile attacks against an oil pipeline operation, meat processor, and digital services provider have been reported. While attacks against corporate targets often have limited impact on the general public, the Colonial Pipeline attack led to a shutdown of a major supply pipeline servicing the eastern United States, triggering panic buying and complete outages at more than 11,000 gas stations in addition to a spike in retail gasoline prices, according to a Newsweek articleOff-site link.

Ransomware attack strategies have a number of variables, including the type of criminal organization behind the attack, the target industry, or the size and method of infiltration, whether that’s phishing or finding a network or software security vulnerability or something else. One of the largest concerns of law enforcement is the emergence over the last few years of criminal organizations that provide ransomware as a service (RaaS), as was the case in the Colonial Pipeline cyberattack. Under this scheme, the criminal organization sells or leases their ransomware programming code to users who use it to attack their targets. The Group-iB report indicated that RaaS was used in approximately two-thirds of the ransomware attacks in 2020.

The Ransomware Task Force—an international group of cybersecurity experts from industry, government, law enforcement, and the public sector—was formed in early 2019 to address this threat. In early April, it delivered to the U.S. government a reportOff-site link with recommendations for combatting ransomware attacks. The following list includes some of the 48 recommendations:

  • Make proactive diplomatic and law enforcement efforts to reduce and eliminate nation-states from providing protection to ransomware criminals.
  • The United States should take a lead role in implementing a comprehensive anti-ransomware campaign including creating a task force composed of government agencies and private industry.
  • Organizations should be mandated to report ransomware payments and to consider alternatives before making such payments.
  • Since cryptocurrency is predominantly used for ransomware payments, the cryptocurrency operators should be more closely regulated.

On April 21, the U.S. Department of Justice (DOJ) announcedOff-site link the formation of the Ransomware and Digital Extortion Task Force to “bring the full authorities and resources of the Department to bear to confront the many dimensions and root causes of this threat.” An early success of the departments working through the Task Force was detailed on June 7, when the DOJ announced that it had recovered approximately $2.3 million of the $4.4 million ransom paid by Colonial Pipeline.

We will continue to follow the ransomware threat, recognizing that no type of industry or size of business is safe from such an attack.

June 7, 2021

Share of Credit Card Revolvers Drops in the Pandemic Year

How do you view your credit card? As a convenient way to make purchases and earn rewards? As a financing tool to spread out the cost of large purchases? As a way to get over rough patches? About half of U.S. consumers with a credit card use it as a means of payment and pay the full balance due every month. The other half use credit cards as a financing tool.

New data releases from the Survey of Household Economics and DecisionmakingOff-site link (SHED) and the Survey of Consumer Payment Choice (SCPC) show that eight in 10 U.S. adults had a credit card in 2020 and, of those, about half carried an unpaid balance at some point during the prior 12 months.

In addition, both surveys found that credit card debt declined from 2019 to 2020. SHED reports that fewer card holders carried a balance, and card borrowers reduced their outstanding balances. Similarly, the SCPC found that that 51.3 percent of card holders carried a balance sometime in the preceding 12 months—the lowest share since 2015. In addition, 51.8 percent of these revolvers reported their balances to be lower than a year ago.

A paper from the Federal Reserve Board of Governors attributes the decline in balances to a sharp decline in credit card transactions at the start of the COVID-19 pandemic in March and April 2020 and also notes a decline in the origination of new credit card accounts at that time. And a New York Fed surveyOff-site link found that about one-third of the value of the first round of stimulus payments under the CARES Act was used to pay down debt.

The SHED survey report indicates that while many borrowers overall reduced their debt, people who were laid off at some point in the past year increased their credit card debt (39 percent compared to 24 percent of those not laid off). This aligns with other research findings that, as the SHED report puts it, “financial challenges in 2020 were uneven.” The New York Fed survey, for example, found that high-income households saved proportionately more of their stimulus payments: 40.8 percent for household income greater than $75,000 compared to 31.2 percent for household income $40,000 or less.

The drop in revolvers could have implications for the use of credit cards going forward, because credit card revolvers are more likely than convenience usersOff-site link to have and use debit cards instead of credit cards, although many other factors—including general economic conditions—will come into play.

June 1, 2021

The Generational Divide in Online Shopping during the COVID Pandemic

Like me, you probably have seen many headlines citing the impact of the COVID-19 pandemic on people in various demographic segments. Take, for example, age:

  • "COVID-19 hurts working mothers"
  • "Millenials slammed by second financial crisis"
  • "COVID pushes out women and boomers"
  • "Pandemic accelerates retirements"

As you can see from these headlines, no generation is unscathed.

How did people of different ages behave during COVID? Preliminary data from the 2020 Survey of Consumer Payment Choice appear to show that in 2020, millennials increased their uptake of new payments habits while boomers were slower to do so.

  • Millennials increased their share of online purchases as a percentage of all purchases by a greater margin than boomers. Boomers’ share of purchases online went from 4 percent in 2019 to 6 percent in 2020. For millennials, online purchases jumped to 21 percent from 13 percent.
  • Millennials continued to expand their enthusiastic reception of payment apps, including Venmo and Zelle.

Of course, many factors, not just COVID, are in play here. These could be a few:

  • Millennials are moving into their prime earning years. For example, they became more likely to have a credit card in 2020. Two-thirds of millennials had a credit card in 2019, and almost 8 in 10 did in 2020.
  • Boomers may be stuck in their habits. Payments choice, like many other consumer behaviors, is a habit and generally slow to change.

You can examine differences in consumer behavior by age using the interactive charts for the 2020 Survey of Consumer Payment Choice at atlantafed.org.

May 24, 2021

Mindfulness Can Ease Payments Stressors

Making a $26 purchase recently, I was surprised when my debit card was declined. My account had money in it, so I couldn't understand what was wrong. Fortunately, I had cash and prepared to pay with it. Then, the clerk pointed to a notice taped to the terminal: "No cash accepted."

Behind me, people were growing impatient, sighing, and shuffling their feet. I tried a credit card I keep for emergencies, and it went through. Relieved to complete the purchase, I left and called the bank. My account was fine; the problem was with the merchant's terminal.

Back in my car, I breathed a sigh of relief but thought about how uncomfortable I felt standing in line, having two payment methods rejected, needing to scramble to find another way to pay, and sensing the impatience of others behind me. I also thought about the alarm I felt when my debit card was declined. Had my account been attacked and emptied by fraudsters? I realized this transaction had triggered a typical stress response: increased heart rate, anxious feelings, sweaty palms, disrupted breathing patterns, all physical and emotional reactions to a simple payment transaction that almost wasn't completed.

May is Mental Health Awareness Month, and it helps to be more aware of any stress we have while making our daily payment transactions. We are all affected by money and need it to function in our daily lives. We often take payments for granted but it's our primary method for getting what we need and want. Money, and conflicts over money, are significant stressors for people. One way to help with stress reduction is mindfulnessOff-site link, the practice of bringing your attention to the present moment, taking a deep breath, and relaxingOff-site link. In this situation, I used mindfulness techniques to reduce the physical and emotional effects I was feeling. I was grateful I had learned these techniques for staying calm and reducing my stress response.

I think about people who are having payments rejected for whatever their circumstances, whether it's due to bank error, merchant error, a fraud alert, or the merchant not accepting a payment type such as cash or check. This can be particularly stressful if you need groceries, a prescription, gas, or emergency supplies and can't get them because either you or the merchant can't complete your transaction due to each one's payment choices or available options.

This in-person point of sale issue has the power to affect you in ways you may not even recognize, causing feelings of shame, embarrassment, anger, and anxiety. Payments inclusion initiatives can address some of these issues. In addition, by simply acknowledging that any of the monetary transactions we make in a day can cause stress, we can increase our awareness of how we respond to help us remain calm and reduce mistakes. When we take a deep breath and a minute to be mindful, we can reduce our body's automatic stress response, which benefits us in other areas of our lives.