Banks Face New Threat
Banks have been caught off guard by what experts say is the first major mobile banking security threat to hit the United States.
It is a modification of the mobile Trojan called Svpeng, which has been used to steal money from Russian mobile bank accounts, said Dmitry Bestuzhev, head of the global research and analysis team, Latin America, at Kaspersky Lab, the Woburn, Mass.-based antivirus software company that discovered the malware.
The malware, which emanates from Russia, has been termed “ransomware,” because the hackers demand payment in exchange for not destroying the victim’s reputation, claiming there is child pornography and other prohibited content on the cell phone.
“It takes a picture of the victim and then says it will send it with the child pornography findings to all of the victim’s contacts,” Bestuzhev said.
“Nobody wants to be a victim of such reputation damage.”
This new malware is deeply integrated and is almost impossible to remove from an infected device, he added.
Better software is needed to protect against malware, said Chris Keegan, a managing director at Beecher Carlson in New York.
For now, banks rely on warning their customers against social engineering attempts by fraudsters, and usually that means, “Don’t press the button or answer the email.” Banks must warn their customers not to download any applications not found on verified websites, he said.
Banks Ran Out of Time
Avivah Litan, a Gartner Inc. vice president and analyst in Potomac, Md., said the malware should serve as a wake-up call for many banks, as a fair number of them have not developed security measures for mobile banking that are as robust as those used in online banking.
Ensuring that customers use secured browsers doesn’t apply when they use mobile apps.
Giants like Chase Bank, U.S. Bank and others are developing tougher measures specific to mobile, but the industry as a whole needs to step it up, Litan said.
“They’ve just been slow to put measures in place specific to mobile because there hasn’t been any mobile malware,” she said. “Everybody knew it was coming, but they thought they had more time.”
Matt Krogstad, head of mobile banking at Bank of the West in San Francisco, said the bank’s fraud prevention department works with his department to combat mobile malware and other types of mobile banking fraud.
“It’s an ongoing process since the mobile security space is constantly evolving,” Krogstad said.
Bank of the West diligently educates customers about the latest threats, Krogstad said. In cases like Heartbleed, communications to customers were to reassure them that the bank had done its due diligence to ensure that their accounts were safe.
“With other malware like this randomware, it’s more about reinforcing certain behaviors, such as not downloading apps from unofficial app stores or not clicking on links from people you don’t know,” he said. “Don’t jailbreak your phone or put your banking passwords in your contacts.”
Keeping up with all types of cyber crime continues to challenge the industry. Indeed, computer crime and malicious codes rank as No. 5 as a top risk for banks, according to Aon’s “2014 U.S. Industry Report: Financial Institutions.”
However, there is a disconnect at most banks that hampers risk mitigation, said Michael O’Connell, managing director, financial institutions practice at Aon Risk Solutions.
The disconnect occurs because one group traditionally is responsible for purchasing insurance, while another group is responsible for assessing exposures, including technology that may pose an operational enterprise risk, said O’Connell.
“We strongly recommend linking the two groups together, to assess ‘what-if’ scenarios and develop mitigation strategies that include insurance,” he said.
Kevin Kalinich, Aon’s global practice leader for cyber/network risk, said that recent court decisions have ruled that if fraudsters are able to steal customer identities or money, it is the bank’s obligation to help their customers, even if the fraud is out of the bank’s control.
“So if a customer gets fooled on their mobile devices, then the bank has the responsibility to monitor usage of their bank accounts,” Kalinich said.
What’s Good for Big Oil is Good for the Banks
The New York Federal Reserve Bank president William Dudley is frustrated by the “…deep-seated cultural and ethical failures at many large financial institutions.”
The Financial Times reported July 27 that Fed officials have asked banks to see what they might learn from other sectors “that have gone through crises or reputational issues”…wait for it…”such as the oil industry.”
It is sound advice.
Both the oil and banking industries tend to attract “cowboys” for whom rules are only guidelines and risk is a stimulant. Both industries also have a history of socializing the consequences of risk– massive spills with black goo or financial implosions with black holes.
And some oil companies have emerged from crises learning how to better control their cowboys and manage society’s expectations to become exemplary managers of reputation.
ExxonMobil, commemorating this year the 25th anniversary of the largest oil spill in history (until BP’s disaster in 2010), could be the NY Fed’s poster child.
ExxonMobil’s risk management processes came of age after its oil tanker, the Valdez, ran aground on a reef, puncturing the ship’s hull and spilling oil into Prince William Sound, Alaska. The event garnered broad media attention and led to a long series of lawsuits and legislative changes—what is politely termed in reputation management circles as the pile on of litigators, legislators and bloggers.
A jury in Anchorage, Alaska, topped an award against Exxon of millions of dollars in damages with $5 billion in punitive-damages.
Today, ExxonMobil believes risk management is a direct responsibility of line management. Like other engineering firms, its risk management models were once only quantitative.
Empowered by the post-Valdez culture, line executives expressed concern that computer models were missing local nuances that might lead to negligent or criminal behavior, leaving the company exposed to moral hazards.
The company supplemented its quantitative models with strong, direct workforce and line management experience models involving no statistics on failure rates.
While reputation risk management would be nowhere without the right culture, governance, and operational controls, there’s more to it—stakeholder expectation management.
As Jonathan Salem Baskin described in Forbes, ExxonMobil tells stakeholders “that oil is here to stay, we need to accept how vitally useful it is, and improvements in its use are lots more realistic than any fantasies about alternative energy substitutes.”
In its 10K, the company tells shareholders that its success depends on management’s ability to minimize the “inherent risks” of the industry and “the potential for human error.” Moreover, ExxonMobil actually describes many of the management processes it uses to minimize risk.
According to an analysis published by Consensiv, the reputation controls company, based on reputation value metrics we use at Steel City Re, ExxonMobil’s reputation premium, a measure of additional value arising from favorable stakeholder expectations, is at the 96th percentile within its peer group.
ExxonMobil’s 113 percent 10-year return is more than double that of every other oil major excluding Chevron’s 173 percent.
The object lesson for financial institutions is self-evident.
Read all of Nir Kossovsky’s Risk Insider contributions.
The Re-Invention of American Healthcare
Consolidation among healthcare providers continues at a torrid pace.
A multitude of factors are driving this consolidation, including the Affordable Care Act compliance, growing costs and the ever-greater complexity of health insurance reimbursements. After several years of purchasing individual practices and regional hospital systems, the emergence of the mega-hospital system is now clear.
“Every month, one of our clients is either being bought or buying someone — and the M&A activity shows no signs of slowing down,” said Brenda Osborne, executive vice president at Lexington Insurance Co.
This dramatic change in the landscape of healthcare providers is soon to be matched by equally significant changes in patient behavior. Motivated by growing out-of-pocket costs and empowered with new sources of information, the emergence of a “healthcare consumer” is on the horizon.
Price, service, reputation and, ultimately, value are soon to be important factors for patients making healthcare decisions.
Such significant changes bring with them new and challenging risks.
Although physicians traditionally started their own practices or joined medical groups, the current climate is quite the opposite. Doctors are now seeking out employment by health systems. Wages are guaranteed, hours are more stable, vacations are easier to take, and the burdens of running a business are gone.
“It’s a lot more of a desirable lifestyle, particularly for the younger generation,” said Osborne.
Brenda Osborne discusses the changing healthcare environment and the risks and opportunities to come.
Given the strategic importance of successfully integrating acquired practices into a larger healthcare system, hospitals are rightfully focused on how best to keep doctors happy, motivated and focused on patient safety.
A key issue that many hospitals struggle with is how to provide effective liability insurance for their doctors. Physicians who previously owned their practice are accustomed to a certain type of coverage and they expect that coverage to continue.
Even when operators find comparable liability insurance solutions for their doctors, getting buy-in from their staff is often an additional hurdle to overcome.
“Physicians listen to two things — physician leaders and data,” said Osborne. “That’s why Lexington provides assessments that utilize deep data analysis, combined with providing insights from leading doctors to help explain trends and best practices.
“In addition, utilizing benchmarks against peers helps to identify gaps in best practices. It’s a very powerful approach that speaks to doctors in a way that will help them improve their risk.”
Focusing on the “continuum of care”
There’s been a fundamental shift in how healthcare providers care for patients: Treatment is becoming more focused on a patient’s overall health status and related needs.
A cancer patient, for example, should have doctors in a number of specialties communicating and working together toward a positive patient outcome. But that means a change in thinking: Physicians need to work collaboratively with one another — not easy for individuals or groups that are used to being independent. Healthcare is a team sport.
“If there isn’t strong communication, strong leadership, and the recognition of proper treatment procedures between physicians, healthcare providers can increase the risk of error,” said Osborne. “The provider has got to treat the whole patient rather than each individual condition.”
That coordination must extend from inpatient to outpatient, especially since the ACA has led to a rapid increase in patients being treated at outpatient clinics, or via home health or telehealth to reduce the cost of inpatient care
“Home health is going be a growing area in the future,” Osborne continued. “Telehealth will become an effective and efficient way of managing and treating patients in their home. A patient might have a nurse come in and help the healthcare provider communicate with a physician through an iPad or computer. The nurse can also convey assessment findings to the physician.”
Metrics matter more than ever
Patients have not always thought of themselves as healthcare consumers, but that’s changing dramatically as they pay more out of pocket for their own healthcare. At the same time, there’s an increase in metrics and data available to the public — and healthcare consumers are drawing upon those metrics more and more when making choices that affect their health.
“Consumers are going to start measuring physicians against physicians, healthcare systems against healthcare systems. That competition will force everyone to improve the quality of care.”
– Brenda Osborne, Executive Vice President, Lexington Insurance
Think about all the research a consumer does before buying a car. Which dealership has the best price? Who provides the best service? Who’s offering the best financing deal?
“Do patients do that with physicians? No,” said Osborne. “Patients choose physicians through referrals from friends or health plans with minimal information. Patients may be putting their lives in the physicians’ hands and not know their track record.
That’s all going to change as patients’ use of data becomes more widespread. There are many web based resources to find information on physicians.
“Consumers are going to start measuring physicians against physicians, healthcare systems against healthcare systems,” said Osborne. “That competition will force everyone to improve the quality of care.”
Effective solutions are driven by expertise and vision
The rapidly evolving healthcare space requires all healthcare providers to find ways to cut costs and focus on patient safety. Lexington Insurance, long known as the leading innovative and nimble specialty insurer, is at the forefront in providing clients cutting-edge tools to help reduce costs and healthcare exposures.
These tools include:
- Office Practice Risk Assessment: To support clients as they acquire physician practices, Lexington developed an office practice assessment tool which provides a broad, comprehensive evaluation of operational practices that may impact risk. The resulting report, complete with charts, graphs and insights, includes recommendations that can help physicians reduce risk related to such issues as telephone triage, lab results follow-up and medication management. .
- Best Practice Assessments: High risk clinical areas such as emergency departments (ED) and obstetrics (OB) can benefit significantly from external, objective, evidence-based assessments to identify gaps and assure compliance with best practices. In addition to ED and OB, Lexington can provide a BPA for peri-operative care, prevention of healthcare-acquired infections, and nursing homes. All assessments result in a comprehensive report with recommendations for improvement and resources along with consultative assistance and support. .
- Continuing Education: In an effort to improve knowledge, decrease potential risk and support healthcare providers in the use the most current tools and techniques, Lexington provides Continuing Medical Education credits at no cost to hospitals or their physicians.
- Targeting the Healthcare Consumer: With Medicare reimbursement impacted by patient-satisfaction surveys, assuring a positive patient experience is more critical than ever. Lexington helps hospitals understand and improve the patient experience so they can continue to earn the trust of healthcare consumers while preserving their good reputation. .
To learn more about Lexington Insurance’s scope and depth of the patient safety consulting products and services healthcare solutions, interested brokers may visit their website.
This article was produced by the R&I Brand Studio, a unit of the advertising department of Risk & Insurance, in collaboration with Lexington Insurance. The editorial staff of Risk & Insurance had no role in its preparation.