American Express Data Breach: Cybersecurity Strategy Analysis

Introduction: The 2013 Data Breach and Its Implications

In March 2016, American Express admitted that customer data had been stolen from the company in 2013, in a letter to the California Attorney General (Condliffe, 2016). As a credit card company, Amex works with a large number of merchants, and the data breach originated on the merchant end; affected customers were notified as soon as possible. This incident provides an important learning experience. The key question going forward is how Amex can improve its handling of such third-party data breaches in the future.

This one particular incident is not the core problem, but it highlights a broad category of problems — credit card fraud and cybercrime — that cost the industry billions of dollars every year. Managing these risks better than competitors would boost consumer confidence in the American Express brand and could serve as a source of both financial and marketplace competitive advantage going forward.

Competitive Position and Vulnerability Analysis

American Express competes in the credit card business, providing consumer credit and working with retailers who accept its cards to facilitate purchases. Amex saw its total revenue decline in 2015 in the face of a competitive industry, which in turn reduced the company's profits (American Express Form 10K). Despite these challenges, the company cited several strengths in its annual report: higher transaction volumes, industry-leading credit quality, a growing loan portfolio, and strong operating expense controls. Another notable strength is that Amex recently surpassed MasterCard for the number-two position in the credit card industry, according to SEC filing data (Papadimitrou, 2016).

Working against these strengths are a number of significant weaknesses. First, Amex is highly dependent on the U.S. dollar; a stronger dollar suppresses revenues from overseas customers, whose transactions are worth less when translated back to USD for financial reporting purposes, creating substantial translation risk. The company is also vulnerable to data breaches, as this case illustrates — particularly where vendors, merchants, and other third-party partners are concerned. While Amex can manage its own cybercrime risk, it has very limited ability to control cybercrime risk at third parties that also have access to Amex customer data. Additionally, Amex remains a distant second behind Visa in market share and ranks third in global acceptance behind Visa and MasterCard, both of which maintain much broader global networks (Papadimitrou, 2016).

Opportunities and Threats in Cybersecurity

Working from a reasonably strong financial base and market position, Amex can improve its reputation among consumers by strengthening its credit card fraud prevention. This opportunity represents an improved way of handling data theft and other fraud. Credit card cybercrime costs the industry billions annually, but if American Express can develop superior security techniques, it can avoid attracting the attention of thieves who typically exploit weaknesses wherever they find them. It is worth noting, however, that while there is significant opportunity to improve fraud prevention, fraud remains a persistent threat because the rapid pace of technological development often allows criminals to stay one step ahead of those engaged in cybersecurity (Barker, D'Amato, & Sheridon, 2008).

Research shows that reducing opportunities to commit cybercrime is critical to achieving a meaningful reduction in such crime. Large-scale credit card frauds in particular tend to be sophisticated operations with organized crime links. Criminals who steal data must then sell it to monetize their theft; the organizations that purchase stolen data are typically those that actually execute the frauds. Defending against these crimes therefore requires denying hackers access to data in the first place. Cybersecurity experts generally recommend proactive approaches to achieve this goal (Prabowo, 2011).

Conclusion and Implementation

The first step in implementing this recommendation will be assembling a task force comprised of cybersecurity experts and representatives from the four major credit card companies. Clear objectives will need to be developed for the initiative, and an agreement will need to be reached on what resources each company will contribute. Once these foundational elements are in place, substantive work can begin. Timelines, chains of command, and other standard project management structures will also need to be established.

Ultimately, this recommendation derives from basic principles of collaboration for mutual gain. The California data leak could have happened to any credit card company — and similar leaks do occur across the industry. The industry loses billions every year to this problem, making cybercrime an issue larger than any one company. The best approach to a systemic problem is interfirm collaboration. While most examples of such collaboration are found in product development, marketing, and supply chain management, the concept applies equally well here. The diffusion of knowledge within an industry follows predictable patterns based on knowledge distribution networks (Singh, 2005), and given the rapid pace of change in cybercrime, the credit card industry needs a very rapid knowledge diffusion cycle to remain ahead of cybercriminals.

There are trade-offs involved in interfirm collaboration, of course (Richey & Autry, 2009). In this case, Amex would be surrendering some opportunity for competitive advantage. However, this is one of those situations where the billions that could be saved by getting ahead of cybercrime on an industry-wide level outweigh the value of proprietary security gains. The collective benefit justifies the cooperative approach.

References

American Express Form 10K for 2015. Retrieved March 19, 2016 from http://ir.americanexpress.com.

Barker, K., D'Amato, J., & Sheridon, P. (2008). Credit card fraud: Awareness and prevention. Journal of Financial Crime, 15(4), 398–410.

Condliffe, J. (2016). American Express admits to theft of customer data three years late. Gizmodo. Retrieved March 19, 2016.

Papadimitrou, O. (2016). Market share by credit card network. CardHub. Retrieved March 19, 2016.

Prabowo, H. (2011). Building our defense against credit card fraud: A strategic view. Journal of Money Laundering Control, 14(4), 371–386.

Richey, R., & Autry, C. (2009). Assessing interfirm collaboration/technology investment tradeoffs: The effects of technological readiness and organizational learning. International Journal of Logistics Management, 20(1), 30–56.

Riffkin, R. (2014). Hacking tops list of crimes Americans worry about most. Gallup. Retrieved March 19, 2016 from http://www.gallup.com/poll/178856/hacking-tops-list-crimes-americans-worry.aspx.

Singh, J. (2005). Collaborative networks as determinants of knowledge diffusion patterns. Management Science, 51(5), 756–770.