Magazine menu Close Magazine menu

Data and privacy

Latest stories

lighting up dark web, fraud, low enforcement

How police identify criminals selling data on the dark web

  • min read
    • In the north of England, a team of officers are getting creative. They're finding ways to identify criminals selling personal data, fake COVID-19 vaccines and child sexual abuse images on the dark web. Tomorrow Unlocked's film Lighting up the Dark Web follows the UK's Yorkshire and Humber Regional Cybercrime Unit (RCCU) in their quest to unmask a crime ring selling personal data for fraud. What is the dark web? The dark web is a network of computers where web traffic is anonymized. Many use it to access marketplaces and other sites to commit crime. The dark web can also be used for good. Dissidents, whistleblowers and investigative journalists use it to communicate anonymously online, and others use it to avoid online data collection. The sale of personal data is big business on the dark web. The US's Federal Trade Commission reported consumers lost nearly $8.8 billion US dollars to scams in 2022. Linking dark web identities and real-world people In 2014, a trader called Data Pro was selling National Insurance numbers, dates of birth, credit card numbers and more on the dark web marketplace Evolution. RCCU suspected the source was a UK-based business. RCCU used 'slips' – when Data Pro occasionally used identifiable information – to link his clear web and dark web identities. How businesses can protect themselves from dark web criminals While the dark web seemed impossible to control in the past, law enforcement is now getting ahead. Businesses can also act to give fraudsters less opportunity to make dark web profits out of their data. First and foremost, protect your business's data from being stolen with strong data security practices, including encrypting your data and educating employees on how to avoid accidentally giving cybercriminals access. Your people are your most important security feature because most breaches start with basic errors like clicking a link in a rogue email or giving login details to someone who isn't who they said they were. If your data is already stolen and ends up on the dark web, dark web monitoring services like Have I Been Pwned may help you identify a breach and alert those whose information was stolen faster. As law enforcement becomes more cyber savvy, there are fewer places for cybercriminals to hide. Increasing international cooperation is also helping light up the darkest parts of the web. Businesses also have a part to play by reducing the opportunities for their data to be stolen and sold.
insight story, employer uses generative ai

How businesses can use generative AI to empower employees

  • min read
    • Headlines about the power of generative artificial intelligence (gen AI) are everywhere. But business leaders are asking, is it really that game-changing, or just a fad? And if it is a game-changer, how can you make the most of it? In the first episode of our second season of Kaspersky's podcast Insight Story, I speak with experts Shagun Sachdeva (India,) Project Manager for Disruptive Tech at business intelligence service GlobalData Plc and Karen Quinn (UK,) Senior Director, Brand and Corporate Communications at financial software providers, Finastra. What is generative AI? TechTarget defines gen AI as any "artificial intelligence technology that can produce various types of content, including text, imagery, audio and synthetic data." Some applications rely on Natural Language Processing so users can ask for outputs using everyday speech. Well-known examples of gen AI include OpenAI's chatbot ChatGPT and Google Bard, but current and potential business uses are near endless. Shagun thinks many businesses already understand its importance. "A recent GlobalData Plc survey found more than 50 percent of businesses expect gen AI will tangibly disrupt their industry in the next five years. 30 percent are already using gen AI tools." How are businesses using gen AI? "Business leaders are having more sophisticated conversations about how gen AI can go from an experiment to giving strong returns on investment," says Shagun. "Whether it's chatbots engaging with customers, sharing financial tips and customizing financial plans based on individual spending habits. It's also generating loan options based on a user's credit profile." Finastra plans to develop gen AI tools for customers in future, but they've started in-house with GENAI (X,) a gen AI-based system now rolled out to their 8,000 employees. "We use it for things like understanding and reviewing contracts, predicting behaviors and optimizing workflows," says Karen. She believes that although only being used internally so far, their gen AI tools are benefiting customers. "We can only work with the data we have to make financial decisions. Anything that can generate new scenarios, pull in more data sources or enable federated learning can only benefit." Is gen AI a threat to jobs? Shagun acknowledges employees worry AI might replace them. "Some of that anxiety may be justified – a Goldman Sachs report in March 2023 said AI could replace 300 million full-time jobs." But getting to know gen AI better may help overcome that concern. "Lean in to the technology. Education and training is key. Start with courses like prompt engineering." Karen refers to a quote from economist and professor Richard Baldwin, "AI won't take your job. It's somebody using AI that will take your job." In other words, it's not the technology itself that's a threat to jobs but failing to explore it and take full advantage of it. She advises looking at the benefits of gen AI broadly. "This is not an efficiency play. People will become more productive, but hopefully that means work is more rewarding." Getting gen AI right While generative AI offers much possibility, it also raises concerns around ethics, bias and data privacy. It is largely unregulated today and developing AI models can be resource-intensive. Karen highlights Finastra's caution. "We rigorously tested the products, then launched a full-scale training program and disabled other tools. They're still going through testing, like panels to try and break them and make sure no sensitive data gets shared with the wrong audiences." She continues, "In brand and communications, there are copyright issues. If you're using text-to-image prompts, where is it drawing data from? We need to be very careful." Materials used to train AI are often copyrighted, and whether people or businesses can copyright outputs of gen AI is subject to legal challenges in many countries, with some courts – including in the US and Italy – ruling no, at least in the case of visual arts. Balancing gen AI optimism with realism Shagun feels misinformation is the biggest business risk from gen AI. "It can fabricate 'facts' – what Google researchers call hallucinations." She also recommends businesses pay attention to copyright. "Disputes have arisen between artists and AI companies over the value of human creativity." Data privacy and security also rate highly for Shagun. "Large language models are trained on vast swathes of internet data. There's no data protection embedded in these systems by design or default. Training data can fail to include women, older people or marginalized groups – that's an ethical challenge." Security and generative AI Amin Hasbini is Kaspersky's Head of Research Center for its Global Research and Analysis Team (GReAT,) Middle East, Turkey and Africa. He says many employees are already using freely available AI tools, potentially without their employers knowing. "In a 2023 Kaspersky study, we found 57 percent of workers are using generative AI to save time. This raises many security questions. What kind of data are they putting into it? Is it intellectual property, code or documents to summarize? That's a major concern." Cybercriminals are also using generative AI to help them fool people with more realistic fake websites. In 2022, Kaspersky's anti-phishing system blocked more than 500 million attempts to access fraudulent websites – a doubling of attempts in the previous year. It's likely cybercriminals are already using generative AI chatbot ChatGPT's ability to produce convincing texts to create automated spearphishing attacks – phishing targeted at specific people. To protect against generative AI-based threats, Amin advises, "It starts with awareness. Employees need to know their organization's boundaries around putting data into AI websites. Businesses need enterprise cybersecurity solutions that allow monitoring and control of devices, systems and data used within the organization." Leading employee cybersecurity awareness approaches include implementing a cyber champions program or targeted education as used by Heathrow Airport. Gen AI's future potential What kinds of applications for gen AI will we see businesses pursuing in the near future? Shagun believes what businesses do today will decide the future of gen AI. "The world will look completely different by 2030. Global Data Plc estimates the AI market will be worth around 900 billion by 2030. But that doesn't mean carelessly diving in. "Gen AI is no magic bullet. While the enthusiasm around it is justified, prudence is imperative. We need responsible innovation," says Shagun. Karen imagines gen AI helping to make markets fairer. "Gen AI has incredible potential to overcome inefficiencies, like small-to-medium business (SMB) access to trade finance. Gen AI might be able to generate or automate some of the processes for onboarding smaller companies into global trade, opening them up to a wider audience." She also thinks gen AI could help solve some of the problems it's been known to introduce. "It can help identify bias through explainability and ensure we close feedback loops that cause biases. It could also look at efficiencies in supply chains, contracts and communications and marketing. It can take out some of the drudgery and enrich the processes." "We're on the cusp of understanding what gen AI can do," Karen says. "Who knows what the future brings? This could be game-changing in ways we can't even imagine." Like Karen and Shagun, as a creative marketer, I'm drawn between mostly optimism and a little fear about what gen AI will bring. As I wrote following a gen AI talk for marketers where I heard about Karen's exceptional AI program at Finastra, I'm optimistic we can do it right. Having the training, technologies and policies to bring the whole organization on the journey, we can use this tech to free us by shifting mundane tasks down to these somewhat smart bots. But in that shift, we may narrow opportunities – particularly for talent entering our industries – to refine their craft and learn the difference between average and distinctive output. Refined talent that generative AI lacks. For now, anyway.
unexpected data collection, GDPR, regulations

The one data privacy principle no one talks about

  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. In 2017 Uber settled a complaint from the Federal Trade Commission out of court. Part of the complaint included that some employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
insight story ai machine learning

Customer wins from AI require strategy, not just investment

  • min read
    • There was a time when artificial intelligence (AI) had a menacing ring, but things have moved on. Chat GPT and generative AI apps are creating new roles or making some skills and careers obsolete, depending on who you listen to. Meanwhile, we see its benefits every day, like finding efficiencies and automating repetitive tasks. AI could soon be essential to most businesses. But it's not always clear how to use it. Kaspersky's new podcast, Insight Story unpacks emerging tech trends with global specialists and businesses successfully using the tech. In Episode 5, I speak with AI expert Dr. Romesh Ranawana (Sri Lanka,) customer loyalty consultancy Truth CEO Amanda Cromhout (South Africa) and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. We examine how business should approach AI and machine learning to make the most of the opportunity while staying secure. Understanding what's meant by AI Romesh says we normally mean something more specific when we talk about AI. "All technology – be it Alexa, your car or washing machine – uses algorithms. An algorithm outputs something when you input something. For problems too big or hard to solve with software, a particular type of AI – machine learning – offers a new way to build algorithms, instead of a programmer writing lines of code." And this kind of AI is everywhere. "We hear much about how it's changing e-commerce and video streaming, but nearly every industry uses AI – from healthcare to retail to factories. Many of the biggest brands, like Amazon and AirBnB, owe their success to it." AI in customer loyalty Customer loyalty programs have long used AI to target customers with more relevant, personalized offers. Amanda's company Truth specializes in these. "Data is fundamental to customer loyalty programs. Everything we know about a consumer – whether the information they give or gained through transactions – has proven power." UK grocery outlet Tesco's Clubcard was one of the first schemes of its kind, with some 20 million members today. Amanda says their approach to data was groundbreaking: "Every quarter, Tesco sent out thank you vouchers with a small discount on your next shop. The vouchers were relevant to what you bought, and no set was the same." "It's a value exchange," says Amanda. Customers give their data because of what they get out of it. "Sometimes companies ask members or customers for data less overtly. Financial institutions may offer a reward to answer a questionnaire, creating a profile of your financial needs and propensity to borrow. They're paying so they can get a higher response rate to sales. If done well, it's win-win." Recent research, Global Data Privacy: What the Consumer Really Thinks 2022, found discounts and freebies were in the top three reasons consumers share data with brands. Amanda also thinks some companies confuse using data well with hard-sell. "They're not thinking through the value proposition. The younger generation especially knows their data's worth. They're asking, 'What am I going to get for that?'" Keys to success with AI Most companies investing in AI aren't getting immediate results. MIT research found only three in 10 companies investing in AI are getting a return on their investment. Who succeeds depends on how they approach it, Romesh says. He thinks why you're doing it matters too – it should be about changing how the company does business, not simply making savings. "If you look at AI as a way to automate what you do now, you'll get reduced costs but not much benefit. You need to mesh AI and people in your organization to generate value, so they're learning from each other." Amanda adds, "Many companies want to flick a switch and, in two hours, make it happen. They don't understand it has to be a strategic driver for the business." Romesh and Amanda both highlight good-quality training data as a critical success factor. Romesh says, "Customers and their behaviors change – what you train today may not be relevant in a week's time. AI systems must be continuously trained on real-time, up-to-date data. Companies need data collected continuously kept in a single space – we call it 'the data lake.'" Amanda also believes the C-suite must support an AI strategy, even lead it. "It doesn't start with marketing executives wanting to do this – it starts at the top, with the CEO and the board." But they shouldn't expect too much, too soon. "The leaders of any company must understand it's an ultramarathon, not a sprint." Romesh notes it's becoming possible for more people to work with AI. "AI systems are still complicated. It takes knowledge, data engineering and software skill. Over the last few years, more tools have come out – low-code or no-code tools – making AI more accessible to more people." How AI is changing cybercrime AI didn't need to be more accessible for cybercriminals to use it, which has implications for business. In research with Kaspersky's Global Research and Analysis Team, Fabio Assolini has seen several applications of AI in cybercrime. "AI is helping cybercriminals bypass new authentication methods. Some financial institutions and banking apps use biometric authentication, where the user must look to the right, to the left and smile. We've seen cybercriminals using AI tools to do this with only a victim's photo." How businesses should respond isn't straightforward – they need to identify more fraudsters while not misidentifying too many customers. "You can fine-tune authentication methods to better identify fraud attempts, but you may get many false positives. It's a balance," says Fabio. Fabio recommends businesses ensure AI training data is ethically gathered and complies with privacy regulation in countries they distribute to. "Some free apps for adding special effects to pictures collect and sell data sets for training AI. There's a privacy issue, especially in Europe with GDPR, but sometimes those collecting the data are in parts of the world without privacy restrictions." To comply with GDPR, AI systems that use personal data must be developed, trained and deployed with a clear objective determined at the design stage. It must be legitimate and compatible with the organization's goals. AI's future in business Amanda stresses the need for brands to understand what their data really means about every human behind it. "Data scientist Dr. Shorful Islam says, at the end of every data point is a human being we're trying to persuade to do something differently, or trying to make their engagement with a brand more pleasurable, or whatever the desired outcome. So you've got to think about behavior more like human beings, rather than robots." Romesh sees AI leading to powerful change in consumer behavior. "We're buying things we'd never have bought before because companies are pushing them to us. Amazon reports 35 percent of its revenue comes from recommendations." And those features will only get cleverer. "Systems will become more powerful because they'll have more data feeding in." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
digital trust

Customers’ trust in tech is changing. What should business do?

  • min read
    • Of course, businesses need customer trust, but understanding what trust means in a digital world is becoming more important. Digital trust is users' confidence that tech, people and processes they engage with are secure and private. Recent research suggests how customers decide where to place their digital trust is changing, so some businesses are changing their approach. As Minter Dial wrote before in Secure Futures, the 2022 Edelman Trust Barometer report shows eroding trust in institutions while remarkably, our trust in business remains. Now, there's an opportunity for business to use integrity, empathy, and privacy and ethics around new tech like artificial intelligence (AI) and customer relationships management (CRM,) to lead the way. Kaspersky's new podcast, Insight Story, unpacks emerging tech trends with global specialists and businesses successfully using new tech. In Episode 4, I discuss what digital trust means and how organizations can grow it with Müge Fazlioglu (US,) Principal Researcher, International Association of Privacy Professionals (IAPP), Malek Ben Salem (US,) emerging tech security expert and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. Unpacking digital trust Digital trust covers much ground, Malek Ben Salem says. "It's about data integrity, technology, people and processes. It's our confidence that our privacy is protected and secured, the reliability of digital transactions and how sure we are of the identities of those we engage with. It's also about how much we trust the information we get as users." Müge Fazlioglu says trust is notoriously hard to pin down. "Our trust when we may or may not share data depends on many things, like our perception of the party we're sharing with, our data's value to them and us. We also weigh the data's sensitivity – what might happen if it were revealed." Trust can make or break a purchase IAPP's March 2023 Privacy and Consumer Trust Report shows privacy concerns influence consumer purchasing decisions. Müge says, "Many people take steps to protect their privacy, like deleting an app or withholding some personal information." So paying more attention to trust could pay dividends. "Organizations gain credibility by taking steps to enhance privacy and data protection. We're now seeing some big brands featuring privacy-related messaging in their advertising and marketing of web browsers and smart home devices," recounts Müge. Trust concerns also make brands hit the headlines for the wrong reasons. Amazon's recent purchase of robot vacuum cleaner brand iRobot triggered privacy objections from consumer and civil rights groups, then an EU investigation. How companies help (and harm) trust Tech research consultancy McKinsey's 2022 Digital Trust report said while 70 percent of people trust companies to protect their privacy, most companies aren't living up to the expectation. So what should companies do? Müge says much best practice is around transparency. "Few consumers have a good grasp of how companies use their information – what they collect, and if they follow good practice. So companies need to ensure they write a simple, clear privacy policy and have an easy-to-use page for people to manage their privacy settings." Regulators also think easy-to-adjust privacy settings matter. The US Federal Trade Commission (FTC) recently fined the company that makes the game Fortnite for its hard-to-use privacy settings. Müge thinks regulators, businesses and consumers can all play a role in improving communication around privacy. "How a company communicates its data practices affects trust – the duty should not be on customers to make daily decisions based on lengthy and complicated legal agreements. Regulators have an important role in raising awareness and providing education. Some, like the FTC and European Union data protection authorities, are starting to do that." Müge also recommends being prepared for how you'll handle a data leak. "Responding slowly means more consumer loyalty lost. Have an incident response plan for the inevitable." Data leaks are common but often have a big impact on business. Kaspersky's 2022 IT Security Economics report found that among 3,230 businesses surveyed, data leaks were the most commonly encountered security issue, with 55 percent considering them the most challenging incidents. Malek points to one business leading in digital trust. "Apple stands out in how it uses privacy-preserving technology to train artificial intelligence (AI) on mobile phones. Devices keep data locally and use it to train user speech-recognition and auto-complete models. Then the models are used to update a central model that can be applied to many users. So the data is not shared or uploaded, but still used to improve the AI." Using cybersecurity to build trust 29 percent of businesses with 500 to 999 employees have experienced a cybersecurity incident, according to Kaspersky's 2022 Small-to-Medium Business Cyber Resilience report.  As your business scales into a larger enterprise, so does the likelihood of a cyberattack or data leak. Malek thinks investing in cybersecurity is vital to protect customer trust. "To build secure infrastructure and allow for secure transactions, you need a cybersecurity strategy and proper governance, and you must hire the right talent. More importantly, be transparent." Or, as Müge says, "Shine a bright light on what you're doing." New technologies are evolving cybersecurity's contribution to digital trust. Malek sees many applications of AI in security tech: "It helps identify who is accessing a system by profiling user behavior. It can detect and respond to security incidents. It can classify unstructured data like business documents, so we don't need people to read them to know what's sensitive or confidential." A relatively new approach to security, zero trust, is influencing what we'll see next. "People will own their full identity and use pieces as needed. For instance, if I want to buy something that requires proof of age, I can share just my age without information the seller doesn't need, like full birth date. Zero-trust principles mean allowing access only to the information needed." But Kaspersky's Fabio Assolini says businesses may not be able to adopt these good practices overnight. "Many networks need adapting for zero-trust principles. It's a challenge for administrators, but it's important they understand how it works and prepare corporate networks for it." He also highlights the value of transparency, not just between businesses and customers, but between businesses and suppliers. "You must be able to trust your cybersecurity providers, especially as we're seeing many targeted attacks that abuse cybersecurity software or infrastructure. Security vendors could be more transparent about their technologies. At Kaspersky, we let customers review our code at transparency centers. We'd like to see other companies doing that." He adds, "Training is also important. Sometimes cybercriminals send a phishing attack to just one employee, so it matters that each employee is trained in identifying attack attempts." Asked for one key recommendation for business in building digital trust, Malek says, consider cybersecurity part of your environmental, social and governance (ESG) framework because "it elevates the discussion." Müge says, "Keep in mind all the smart technology you use. It uses many different kinds of information. Use the privacy features and regularly monitor data sharing." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
paper dead shredder

Is paper dead?

  • min read
    • For retailers, predicting customers' future wants and needs is crucial – especially in this era of disrupted supply chains. I hope you won't recognize this story as something that might happen in your business, but it demonstrates how soon retailers of all sizes could find themselves in a new future. I bought a blouse recently from a traveling vintage clothes seller. Picture several racks of bright retro outfits set up under a caravan awning with a changing room crafted from tie-dyed blankets. Incense hangs in the air, as does the ringing of tiny bells attached to the seller's impossibly long hair, jingling as she wanders around after customers, straightening coat hangers. To pay, I offer cash, but she instead presents me with a beautifully calligraphed sign showing her bank account details. Given the riskiness of this practice, I offer a moment of security education. She tells me she's in the habit of giving out her bank details because it means more sales, and keeping enough change around is hard when you're always on the road. Even those on the fringes are moving towards electronic payment for its convenience and customer preference, albeit sometimes not in ideal ways. When it comes to meeting customer expectations in how your transactions happen, are you ready for a future where paper money, receipts, plastic cards are a thing of the past? Could your retail business work in a world where all money is changing hands by smartphone? Among Kaspersky researchers' privacy prediction for 2023 is that we'll keep seeing smartphones and other smart devices encroaching on activities once dominated by paper and plastic cards. A future where all we'll need is a smartphone seems close when we're paying by near-field communication (NFC) like Apple or Samsung Pay or QR code like Swish, or using apps to show COVID-19 testing and vaccination status. What does this mean for paper and plastic transactions? And what privacy and security issues should business consider when it comes to doing it all by smartphone? Environmental reasons to stop using paper and plastic Some might say the sustainability drive to eliminate paper and plastic in business transactions is overplayed. While both have significant environmental impacts, business transactions are not a major source. Meanwhile, electronic transactions can be responsible for much energy use and the equipment used will ultimately become resource-heavy and hard-to-recycle ewaste. Gen Z, Millennials and those younger will do much to avoid adding more plastic and paper to the world. Regardless of environmental impact, consumer demand for more convenient paperless and cardless transactions will only grow. Processes likely to move to smartphone apps Digitized identity documents look set to be the next big frontier for smartphones. It's already been a common approach to declaring COVID-19 testing and vaccination status worldwide, but soon passports, driver licenses, student IDs and more will be made available through apps. Germany started using app-based ID cards in 2021. Around the same time, Apple announced several US states would make digital identity cards and driver licenses available using Apple Wallet. ID stored on phones brings convenience and risk. A well-implemented system would let stores verify customers' age without seeing personal details they don't need, like home address – also known as 'zero trust' security. Digitized IDs could also speed up know-your-customer (KYC) procedures when applying for a loan with a smartphone. But using a smartphone to store growing amounts of personal data introduces 'single point of failure' security risk. Those who develop and commission smartphone software like apps must ensure top-notch device security and privacy-preserving data storage. Cardless cash withdrawal at ATMs is taking off around the world, especially where bankcard fraud is more common, like India. Smartphone apps enable cardless withdrawals, for example, scanning a QR code on the ATM screen with a payment app like Google Pay, or using near-field communication (NFC.) Again, these transactions aren't without risk. Speaking to price-comparison service Bankrate, Ricardo Pina, founder of personal finance blog The Modest Wallet, said, "Since bank cards are being replaced by phones, criminals will now be more enticed to target and hack your phone to mine your data, information and even change your phone and bank app settings." When will paper and card transactions become history? Those who run businesses that experience higher overheads thanks to processing cash, cards and printed receipts may dare to dream of a world where these go the way of the 'check.' Ubiquitous throughout most of the 20th century, many banks have stopped issuing and accepting these. Check payment is expected to be extinct by 2026. Those old enough to remember when checks were commonplace might think they'd disappeared years ago. But sometimes these methods strongly persist in parts of an economy that need them for specific reasons. A few years ago, a friend and I hiked the five-day South West Coastal Path in Cornwall, UK – and yes, it was glorious. This part of the UK is far from any major city. We were surprised to notice most bed-and-breakfasts  accepted only cash or check. Once we understood the area's geography, we paid by check wherever we could. Traveling on foot and far from towns, it seemed unwise to part with cash we might need. These businesses told us they didn't take card payments because they only had customers in summer, making point-of-sale machines uneconomic. Similarly, can smartphones – and reliable access to affordable data to operate apps – be all things to all people in all places? While access to mobile technologies has certainly enabled greater economic participation from marginalized people, we can easily overestimate how many can and will use these technologies if we use them or see them used around us often. Pew Research estimates around 85 percent of the US population owns a smartphone, but in China and India, it's lower at 70 percent. While China leads the world in mobile payment adoption, smartphone ownership numbers don't tell us how many people could use their smartphone for payments – for example, successfully download and register to use payment apps, and access data when needed. Cash transactions still account for far more business than many people think – in 2021, customers used cash for over 20 percent of point-of-sale transactions globally, according to the International Currency Association. Many businesses wouldn't survive losing 20 percent of their sales. There is also the inevitable backlash against smartphones because of negative mental health impacts, seeing some choose to quit or radically reduce how much they use them. It seems paper- and card-based identity and payment options will be with us much longer than we think, if the lifecycle of check payment is anything to go by. For small business, alternative point-of-sale card payment providers are fast making accepting cards more affordable, making paying by card even more ubiquitous without reducing security. When it comes to taking payment, it 'pays' to be flexible and listen to what your customers want, rather than focusing on what suits your business. Meanwhile, keep an eye on evolving technology making retail transactions simpler and more affordable.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries