As you probably know from personal experience, most of us are reluctant to act after a data breach, whether by freezing our credit reports or closing accounts. It feels like just too much of a pain.
A recent paper
by two Fed economists affirms that this is the case, with just 2.8 percent of consumers with a credit report having a credit freeze on immediately after the announcement of the 2017 Equifax data breach (up from 0.7 percent before the breach).
Using information in credit reports, Nathan Blascak and Ying Lei Toh examined the likelihood that consumers with different experience would take action:
- Past victims of severe ID theft were identified as those who had previously filed an extended fraud alert.
- Those with prior exposure to breaches were defined as living in states most affected by the Anthem 2015 data breach (that is, states where more than 25 percent of the population had been a victim).
- Other consumers were defined as previously unaffected.
Even consumers who had previously been exposed to ID theft or data breaches did not necessarily react to the Equifax announcement. Although prior ID theft victims were more likely to adopt precautionary measures than were first-time breach victims, the rate of people taking precautions is distressing: 3.5 percent of those with prior exposure to the Anthem breach and 6.4 percent of victims of severe ID theft.
This finding is typical of other research showing that we consumers are just not that likely to react to breach notifications. Maybe we don't know quite what to do. Maybe it feels too complicated to review and manage our credit scores. Maybe we think it will only happen to the person next door. That's where gamification could come in. If we could virtually experience the time and money lost, the hassle, the worry of ID theft or account takeover, we might take more care. If we could earn points or dollars by competing in a quest based around credit protection, we might know how to protect ourselves when it became necessary and urgent.
I see lots of applications of gaming to marketing financial products, to encouraging consumers to save and invest, or to teaching financial concepts. What about incorporating the visceral experience of fraud—the punch to the stomach, the fight-or-flight response, the surprise—into these tools? There are apps for disaster preparedness. Although I've been looking, I haven't found one for data breach preparedness. Can you recommend a tool? And if not, take a look at your institution's marketing to consumers to see how it incorporates this important learning.
By Claire Greene, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed