Archives for June 2022

CFPB Says Convenience and Pay-to-Pay Fees are Prohibited Junk Fees

Continuing its 2022 cadence of issuing press releases nearly every day, on June 29, 2022, the CFPB announced it issued an advisory opinion regarding  “pay-to-pay” or “convenience fees.” The opinion, which explicitly references fees for online and phone payments, confirms that the Fair Debt Collection Practices Act (FDCPA) prohibits debt collectors from charging these types of fees to consumers unless they are expressly authorized by agreement or permitted by law.

The opinion includes the following additional guidance

  • Silence in the law is not the same as “permitted by law.” Therefore “permitted by law” in the CFPB’s view means language which would explicitly allow the fee to be charged.
  • Section 808(1) of the FDCPA applies even if the fees are part of a separate agreement that might be otherwise valid under state law. Therefore, even if the debt collector and consumer enter into a separate agreement to pay the fees, these types of fees still violate the FDCPA.
  • “Any amount” as defined in the FDCPA applies to any sum collected in connection with the debt. It is not limited to interest, fees, charges, or expenses. Therefore, “any amount” applies to these types of fees.
  • Collecting convenience fees through a third-party payment processor violates the FDCPA if the debt collector receives a kickback. 

[article_ad]

In the section relevant to payment processors, the CFPB cautioned that “[d]ebt collectors violate the FDCPA when using payment processors who charge unauthorized fees at a minimum if the debt collector receives a kickback from the payment processor.” (emphasis added). This language implies that other conduct between a payment processor and a debt collector might violate the FDCPA, but no additional details were provided. 

The full advisory opinion can be found here

insideARM Perspective:

This CFPB has developed a pattern of finding the nuance in the FDCPA and contorting it to achieve its objectives. See, for example, this announcement where the CFPB claimed oversight of additional entities or its announcement that the Equal Credit Opportunity Act applies to debt collection.

The starting point of this advisory opinion is nothing new: debt collectors have (or should have) known for a long while that they cannot charge fees that are not authorized by contract or allowed under the law. So what is the ultimate objective here? What new guidance is the CFPB really trying to convey? Why did they spend time on this advisory opinion rather than one related to the Hunstein debacle?

Is the CFPB trying to shut down all fees associated with payments, even pass-through fees (i.e., the debt collector does not profit)? Is this what was hinted at in the bizarrely phrased reference to kickbacks? If kickbacks indicate the fees violate the FDCPA, why didn’t the CFPB just say that? Why include the “at a minimum” language? 

Here again is the sentence regarding payment processors in its entirety: “Debt collectors violate the FDCPA when using payment processors who charge unauthorized fees at a minimum if the debt collector receives a kickback from the payment processor.” (emphasis added)  Is this just a poorly worded, grammatically bizarre sentence? Or is the CFPB trying to say that some other aspect of the payment processor/debt collection relationship might violate the FDCPA?

I don’t know the answers to the above, but since the CFPB does nothing by mistake, this advisory opinion seems to be the beginning of something rather than the end. As such, ARM entities should watch for future guidance, or more likely future action, from the CFPB. That said, something tangible ARM entities can do now is review their payment processing contracts to ensure nothing can be construed as a kickback. Even if you and your vendor know something isn’t a kickback, it may be worth a review to make sure none of your agreements have any language the CFPB can misinterpret. 

CFPB Says Convenience and Pay-to-Pay Fees are Prohibited Junk Fees
http://www.insidearm.com/news/00048358-cfpb-says-pay-pay-fees-violate-fdcpa/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Credit Card Issuer Wins Big ATDS Ruling in TCPA Suit Arising out of Debt Collection Calls

Hello everyone, Baroness here 🙂

A good ruling in the Kentucky District Court recently.

Here are the facts you need to know:

  • On or about March 7, 2014, Plaintiff David Barnett applied for and received a FNBO credit card account.
  • When applying for the account, Barnett provided his cellular number as way for FNBO to contact him.
  • At some point, Barnett stopped making his minimum monthly payments.

As a result, FNBO began to contact him via telephone to discuss his missed payments.

Over a 7-month period, FNBO contacted Barnett via phone call, text message or prerecorded message 574 times—an average of 3.2 times a day (excluding Sundays)

Barnett alleged he instructed them to stop calling him.

[article_ad]

Of course, and as expected, Barnett filed a Complaint, alleging, amongst others, violation of the TCPA. FNBO moved for summary judgment arguing it did not use an Automatic Telephone Dialing System (ATDS) to make the calls.

The Court granted in part and denied in part. The Court granted FNBO’s motion as to all calls, except the 111 prerecorded calls and text messages, because…the court says they were not made using an ATDS as required under the TCPA and pursuant Facebook. Barnett filed a Motion for Reconsideration.

As a refresh, motions to reconsider may be treated as motions to alter/amend judgment under Federal Rule of Civil Procedure 59(e), which allows a party to file a motion to alter or amend a judgment within 28 days of its entry.

Specifically, in the Sixth Circuit, a district court has discretion to set aside a judgment under Rule 59(e) based on at least one of the following: (1) a clear error of law, (2) newly discovered evidence, (3) an intervening change in controlling law, or (4) a need to prevent manifest injustice.

The clear error of law standard is apparently really high. To show a clear error of law, a party must “establish not only that errors were made, but that these errors were so egregious that an appellate court would not affirm the judgment.”

Here, Barnett alleges the court failed to consider FNBO’s use of the TWX system in conjunction with the LiveVox system. Barnett contends that TWX AND LiveVox together make up an ATDS because LiveVox can and does store numbers randomly or sequentially generated by TWX daily. Does this argument look familiar?

The Court rejected this argument for two reasons. First, LiveVox is NOT an ATDS simply because it stores a randomly or sequentially generated listed of numbers from TWX on a daily basis. LiveVox, itself cannot store or produce numbers to be called using a random or sequential number generator.

Second, LiveVox is NOT an ATDS simply because it has a cooperative link to TWX. TWX and LiveVox are two separate systems that perform distinct tasks.

“To hold that LiveVox is an ATDS due to its tie with TWX would virtually subject a non-ATDS system/program to the TCPA because of its mere association with another separate system/program.”

Accordingly, the Court held Barnett failed to meet the clear error rule and denied its Motion for reconsideration.

Notice how the Court in Barnett did not include both LiveVox and TWX within the definition of “equipment”—but under Panzarella, decided just a few days later–both systems would be looked at together to determine if an ATDS was in use. Of course, under Panzarella merely using an ATDS is not enough—the Defendant would also have to be using the core functionalities of an ATDS to be liable under the TCPA. Its a distinction that potentially makes a big difference—and we’ll be talking all about it in our new Deserve to Win podcast episode out June 28, 2022.

Credit Card Issuer Wins Big ATDS Ruling in TCPA Suit Arising out of Debt Collection Calls
http://www.insidearm.com/news/00048354-credit-card-issuer-wins-big-atds-ruling-t/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

How Accurate is Your Metro 2® Furnishing? (Do you even know?)

The CFPB expects that you, as furnishers, have written documentation to explain how you’ve populated various Metro 2® fields from your systems of record. Here are a few areas to tackle as part of your journey to data furnishing accuracy and control.

[article_ad]

Three Things You Should Be Doing for Accuracy and Control

  1. Conduct a deep review of the Metro 2® furnishing file that is submitted to the Nationwide Credit Reporting Agencies (NCRAs)
  2. Develop a detailed Metro 2® data mapping and conversion document to examine system of record code that produces the Metro 2® file

  3. Review upstream operational processes to identify trigger events and data that impact contents of the Metro 2® file

As part of #1 and #2 above, we have uncovered four important areas that would likely be flagged by regulators. While these steps can be time-consuming and highly detailed, what they reveal can help you ensure data accuracy prior to submission to NCRAs.

Do You Understand How Your Metro 2® File Is Created?

Do you have clear knowledge—or documentation—of how your systems of record map to your Metro 2® files prior to sending them to NCRAs, including those generated by your third-party processors? If you don’t, you can wind up with inaccurate furnishing, an increase in complaints and disputes, and ultimately regulators knocking on your door.

Recording how your Metro 2® file is created with a detailed, audit-ready data mapping and conversion document is a key component to meeting the evolving regulatory expectations for consumer reporting accuracy.

Top 4 Areas You Can Fix to Improve Accuracy

The following examples are typical opportunities for system and/or operational enhancements that you can make to ensure the data going to the CRAs is accurate.

1. System Limitations for Compliant Reporting

  • Inability to generate certain Metro 2® file segments
  • Limited capture / storage of information (6 months vs. 7 years)
  • Reporting of delinquent accounts for greater than 7 years
  • Consolidation of data elements into one field requiring manual parsing (Surname, First Name, Middle Name)
  • Missing logic required to report Metro 2® fields (e.g., reporting spaces instead of the Generation Code)
  • Not flagging required Metro 2® fields as mandatory (e.g., Social Security Number)

2. Logic Potentially Results in Inaccurate Reporting

  • Inaccurately counting days past due for account status assignment
  • Lacking logic to report “Last Good Payment” date after a payment reversal due to NSF
  • Mass overwriting of dates (e.g., Date of Account Information)
  • Missing best practice controls (e.g., if account is current and in bankruptcy, Date of First Delinquency should not be blank)
  • Reporting the most recent Actual Payment Amount value rather than totaling all payments receiving during the reporting period

3. Inconsistency Among Correlated Fields

  • Failure to update all relevant downstream data elements when manually overriding Metro 2® fields (e.g., Account Status)
  • Inaccurate or incomplete reporting when an account is closed (e.g., Date Closed is not populated, Current Balance is greater than $0)
  • Inconsistent date progression (e.g., Date of Account Information is a date later than the timestamp of the file)
  • Inappropriate representation of Metro 2® fields related to Account Status (e.g., Payment Rating is not populated when required, Payment History profile does not reflect the prior month’s Account Status)

4. Missing and Inaccurate Field Values

  • Invalid assignment of Portfolio Type and/or Account Type values
  • Inaccurate values furnished for Special Comment Code, ECOA, Consumer Information Indicator, and Compliance Condition Code fields

How Accurate is Your Metro 2® Furnishing? (Do you even know?)
http://www.insidearm.com/news/00048348-how-accurate-your-metro-2-furnishing-do-y/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Universal Fidelity Contributes to Ballard House

KATY, TX — Universal Fidelity LP (UFLP) located in Katy, Texas, raised donations for the Ballard House. 
The Ballard House provides temporary housing for individuals and
families who are hospitalized and receiving treatments.  The team at UFLP generously donated tons of
items from the charity’s need list.  UFLP
and the team members pick local charities quarterly to donate items that are
needed.   I am so thankful for the
participation I see from everyone to do their part in the community,” said
Jessica Hearn/CEO at UFLP.  The next
charity has been picked and donations are coming in already. 

About Ballard House:

The dream started in 2006 when the CEO of Keller Williams
Realty issued a challenge to Keller Williams market centers around the country
to “leave a legacy” in the communities in which they live and work. The
associates of Keller Williams Premier Realty in Katy took that challenge to
heart. Construction of The West Houston Medical Center had just started and it
was evident that people would be traveling to the area for their treatments and
would need housing. Cinco Charities, Inc. was birthed with the mission to
provide temporary housing for patients and their caregivers coming to the
Katy/West Houston area.

About Universal Fidelity LP:

UFLP is a certified professional receivables company
located in Katy, Texas.  The company is
certified women owned company and is nationally licensed.  www.uflp.com  

Universal Fidelity Contributes to Ballard House
http://www.insidearm.com/news/00048351-universal-fidelity-contributes-ballard-ho/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

CFPB Deputy Director Takes Aim at “Rent-a-Bank Schemes”

In a keynote address at the Consumer Federation of America’s 2022 Consumer Assembly, CFPB Deputy Director Zixta Martinez squarely took aim at “rent-a-bank schemes” in some of the first (if not the first) such comments by a senior CFPB official. Historically, the CFPB has confined itself to “true lender” litigation against participants in high-rate programs involving Native American tribal parties (and not banks) already challenged by state enforcement authorities. We view Deputy Director Martinez’s comments as potentially signaling more widespread pursuit of this theory by the CFPB.

In her remarks, Ms. Martinez referenced a rise in installment loans and lines of credit with lenders that supposedly “attempt to use [relationships with banks] to evade state interest rate caps and licensing laws by making claims that the bank, rather than the non-bank, is the lender.” Notably, Ms. Martinez seems to have accepted the premise that the nonbank participant in these programs is the “true lender.”

Additionally, Ms. Martinez went on to criticize “unusually high default rates” on these loans, “which raise questions about whether their products set borrowers up for failure.” This comment echoes the philosophy of the “mandatory underwriting provisions” of the CFPB Rule on Payday, Vehicle Title, and Certain High-Rate Installment Loans (provisions revoked by the Trump-era CFPB) and UDAAP claims the CFPB previously asserted in cases involving ITT and Corinthian Colleges, which state attorneys general began making shortly after the subprime mortgage crisis.

Finally, Ms. Martinez added, without specification of the nature or frequency of the complaints, that the CFPB’s database reveals “a range of other significant consumer protection concerns with certain loans associated with bank partnerships.” She promised the CFA that “we are taking a close look” at these partnerships.

We take Deputy Director Martinez’ speech to the CFA as an important indicator of CFPB priorities, and in particular, the shift in emphasis on criticizing “rent-a-bank” arrangements. These comments may suggest that the CFPB is poised to follow in the footsteps of state attorneys general and state financial services regulators in asserting “true lender” claims against the nonbank parties in these relationships.

We will continue to closely monitor these developments and their implications for those in the consumer financial services space, including lenders, servicers, and banks.

CFPB Deputy Director Takes Aim at “Rent-a-Bank Schemes”
http://www.insidearm.com/news/00048341-cfpb-deputy-director-takes-aim-rent-bank-/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Recovery Decision Science Acquires the Assets of Geist Holdings

CINCINNATI, OH- Recovery Decision Science, LLC (RDS) has acquired the assets and technology of Geist Holdings, Inc. (Geist), a skip trace processing organization that applied proprietary data mining and quantitative analytics to provide unparalleled service finding account holder places of employment. 

This acquisition improves and complements the services that RDS already offered by providing additional options for identifying employment on consumer accounts. RDS, an affiliate of Unifund that leverages data science, servicing transparency, and compliance to optimize recovery results of consumer credit accounts, will continue to offer their improved services through Lexis Nexis while expanding RDS’s capabilities, services, and data processing. 

“Recovery Decision Science is excited to work more closely with the team behind Geist and enhance our state-of-the-art data verification services capabilities,” says Andrew Hagerman, Vice President of Acquisitions for Unifund. “Unifund and Geist began their relationship in 2007 and RDS has worked with Geist since 2010. Together, Unifund and RDS were Geist’s largest client. This acquisition allows our team to leverage their technology, people, and resources to expand our unique automated searching processes.”

History Built on Partnership

Geist, formerly headquartered in Evansville, IN, built its company on locating place of employment information when all other companies were unsuccessful. Geist leveraged automation, broad data sources, right party information, verified active employment, and continuous monitoring services to form the “GHI Advantage.” 

A New Chapter

The team behind Geist has been integrated into RDS. RDS’s cutting-edge IT department and expansive resources will amplify Geist’s services. RDS will incorporate Geist’s established proprietary automation processes, which utilize online data collection techniques to give a much deeper search than manual skip tracers and will perform exponentially more search variations with increased speed and accuracy. Leveraging the acquired talent and technology and RDS’s resources, RDS will now offer expanded services and data processing.  

The new RDS team members will work first on exploring additional verified asset solutions. RDS will combine both companies’ data sets to form an unmatched database for the team to operate.

Amplified Legal Servicing

The acquisition also helps improve all facets of RDS’s services. RDS was born out of a love for data. RDS applies machine learning to its account analytics models to pinpoint consumers with the highest probability to pay and to determine if they pay, how much they will pay. With the new skill set, knowledge base, and processes acquired in this transaction, RDS will improve and expand its master servicing options for clients. 

RDS offers a customizable full-service solution for creditors to manage their receivables—including account decisioning, contact collection, collections portal, legal account scoring, pre-legal recovery strategies, litigation, judgment execution and RDS’s best-in-class asset location. RDS uses its transparent, client-accessible reporting platform and valuable insights gained through years of analyzing the performance of its affiliates’ debt portfolios to become the perfect partner. 

The enhanced RDS team believes in delivering only reliable, current, and actionable data that provides clients the highest revenue possible. To purchase RDS’s expanded services or to learn more about Recovery Decision Science, visit the company’s website at recoverydecisionscience.com.

About Geist 

Geist served the collection industry with a commitment to data quality, innovation, and regulatory compliance. Geist automated the internet skip tracing process and leveraged automation to perform a much deeper search, across a wider range of data sources. It provided additional sources of place of employment information that was not available with any other company.

About Recovery Decision Science

Recovery Decision Science (RDS) is built on the idea of offering proven data analytics and scoring science to consumer receivables portfolio owners and servicers to improve collections and recovery success. Its proprietary mix of analytic tools pinpoints accounts with the highest propensity to pay. RDS has been refining its approach to data science through 30 years of experience in recovering thousands of account portfolios with affiliate, Unifund. RDS is headquartered in Cincinnati.

Recovery Decision Science Acquires the Assets of Geist Holdings
http://www.insidearm.com/news/00048344-recovery-decision-science-acquires-assets/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

ConServe Helps Animals and the People that Love Them

Rochester, N.Y. — The employees of Continental Service Group, Inc., d/b/a ConServe, in conjunction with the company’s “Matching Gift Program”, donated its May ConServe Cares proceeds to The Humane Society of Greater Rochester/Lollypop Farm.  Through their ongoing philanthropic program, ConServe employees can elect to participate in monthly charitable donations, thereby reinforcing ConServe’s outstanding corporate citizenship. Employees not only embrace ConServe’s mission of fostering relationships within our community, but also take pride in doing the right thing, at the right time, the right way.

“We are grateful to be the recipient of the ConServe Cares Program,” says Alice Calabrese, President and CEO for Lollypop Farm. “It is only through working together with community partners like ConServe that we are able to provide life-saving veterinary services and compassionate care for all the pets who need us.”  “ConServe proudly supports Lollypop Farm in their efforts to enhance and promote the lives of these very special members of our communities,” said George Huyler, Vice President of Human Resources at ConServe.  

About ConServe

ConServe is a top-performing accounts receivable management service provider specializing in customized recovery solutions for their Clients. Anchored in ethics and compliance, and steadfast in their pursuit of excellence, they are a consumer-centric organization that operates as an extension of their Clients’ valued brands.  For over 36 years, they have partnered with their Clients to provide unmatched customer service while simultaneously helping them achieve their accounts receivable management goals.  Visit us online at: www.conserve-arm.com  kitten

About The Humane Society of Greater Rochester/Lollypop Farm:   dog

Established in 1873, Lollypop Farm is the largest animal welfare organization helping pets and people in the Greater Rochester area. Lollypop Farm is committed to creating a just and compassionate world for all animals, together with our community, through justice, prevention, and life-saving care. With a main campus located on 136 picturesque acres in Fairport and four other adoption centers throughout the community, the organization provides shelter, care, and adoption for dogs, cats, small animals, birds, reptiles, horses, and other farm animals. Lollypop Farm is an independent nonprofit organization supported solely through contributions, grants, investments, proceeds from retail sales, and fees for programs and services. For more information and to meet current animals available for adoption, please visit www.lollypop.org.

ConServe Helps Animals and the People that Love Them
http://www.insidearm.com/news/00048342-conserve-helps-animals-and-people-love-th/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

You Can’t Avoid a Data Breach – Three Ways to Prepare for the Inevitable

An ounce of prevention is worth a pound of a cure is a phrase often applied to data security at creditor firms and debt collection companies. Every organization in recovery and collections says they have robust data and cybersecurity policies and procedures in place to mitigate risks. Some of them actually do. But those safeguards cannot prevent a data breach. Businesses should be asking themselves not if, but when.

Don’t get hung up on prevention! No one in recovery and collections can assume that strong cybersecurity can prevent a data breach. Companies need to plan for response, too, says Michael Orefice, Business Practice & IT Leader at Bridgeforce.

“I’d like to get rid of the word ‘if,’ and accept the fact that when it happens, I am adequately prepared to deal with [a data breach],” Orefice adds.

Is your organization prepared to handle a data breach? Here are three ways to prepare for the increasingly inevitable.

1. Monitor for Breaches

The first step to an effective response to a data breach is detection, and early detection is critical. Building out an internal security team is one option, and it’s the approach Drew Marston and the team at Resurgent Capital Services took to data security. The team includes an ethical certified hacker, who is always looking for vulnerabilities at Resurgent and their partners.

[article_ad]

If your organization is using AWS or another cloud-based solution, that’s good news, too, argues Marston. “Those guys [at AWS, Azure etc.] are even better [than an internal team] because they never sleep…no one is going to beat the cloud services when it comes to monitoring.” That’s key for smaller teams who can’t afford an internal security team.

Automating the security processes will give you the best opportunity to get ahead of a breach, which will allow you to quickly move to the next step in the process…

2. Make the Necessary Fixes

“If you can isolate the scope of an attack, you can recover quickly,” says Paul Hurlocker, CTO at Spring Oaks Capital.

Taking all equipment offline immediately may be required, and you will need to closely monitor the entry and exit points of data, especially where the breach occurred. The FTC’s guide to data breach responses also notes that until affected credentials are updated, your system will remain vulnerable.

If your breach involves a service provider, make sure that service provider is taking steps to remedy vulnerabilities, and then verify that they’ve actually executed on those steps. If your breach was internal in nature, interview the person or people who discovered the breach, engage with a forensic expert, and don’t destroy any evidence.

Once you’ve contained and isolated the beach, the next step is to notify the necessary parties.

3. Effective Breach Disclosures

It’s critical to have an effective breach disclosure policy in order to avoid potential legal and reputational risk. Breaches should also be reported to law enforcement immediately, regardless of the type of breach. Affected consumers should also be notified, even in instances where it is not obvious that a disclosure is required by law, for instance, where personal information is not involved, in order to avoid violating Section 5 of the FTC Act.

The FTC advises organizations to create breach disclosures that are straightforward, helpful, and that are effective for all audiences, including employees, customers, investors, etc. Disclosures should also involve key details that may help affected parties protect their information.

Organizations affected by a breach should also anticipate questions people may have about the breach, and attempt to answer them in a public format, such as on their website.

As the FTC notes, “good communication up front can limit customers’ concern and frustration, saving your company time and money later.”

So, given the likelihood that your company is at-risk for a data breach, it’s time to get prepared so that when it happens, you can detect, contain, and respond quickly.

—————

Ready for a deep dive into data stewardship and security? Jump into the 3-part iA Strategy & Tech data stewardship on-demand webinar series here:

Data Matters: How to Build the Foundation for Your Data Program – Session 1

Data Matters: How to Build the Foundation for Your Data Program – Session 2

Data Matters: How to Build the Foundation for Your Data Program – Session 3

—————

Bonus reading:

Security Beyond Prevention: The Importance of Effective Breach Disclosures

Ransomware Statistics in 2022: From Random Barrages to Targeted Hits

Data Breach Response: A Guide for Business

You Can’t Avoid a Data Breach – Three Ways to Prepare for the Inevitable

http://www.insidearm.com/news/00048339-you-cant-avoid-data-breach-three-ways-pre/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

You Can’t Avoid a Data Breach – Three Ways to Prepare for the Inevitable

An ounce of prevention is worth a pound of a cure is a phrase often applied to data security at creditor firms and debt collection companies. Every organization in recovery and collections says they have robust data and cybersecurity policies and procedures in place to mitigate risks. Some of them actually do. But those safeguards cannot prevent a data breach. Businesses should be asking themselves not if, but when.

Don’t get hung up on prevention! No one in recovery and collections can assume that strong cybersecurity can prevent a data breach. Companies need to plan for response, too, says Michael Orefice, Business Practice & IT Leader at Bridgeforce.

“I’d like to get rid of the word ‘if,’ and accept the fact that when it happens, I am adequately prepared to deal with [a data breach],” Orefice adds.

Is your organization prepared to handle a data breach? Here are three ways to prepare for the increasingly inevitable.

1. Monitor for Breaches

The first step to an effective response to a data breach is detection, and early detection is critical. Building out an internal security team is one option, and it’s the approach Drew Marston and the team at Resurgent Capital Services took to data security. The team includes an ethical certified hacker, who is always looking for vulnerabilities at Resurgent and their partners.

[article_ad]

If your organization is using AWS or another cloud-based solution, that’s good news, too, argues Marston. “Those guys [at AWS, Azure etc.] are even better [than an internal team] because they never sleep…no one is going to beat the cloud services when it comes to monitoring.” That’s key for smaller teams who can’t afford an internal security team.

Automating the security processes will give you the best opportunity to get ahead of a breach, which will allow you to quickly move to the next step in the process…

2. Make the Necessary Fixes

“If you can isolate the scope of an attack, you can recover quickly,” says Paul Hurlocker, CTO at Spring Oaks Capital.

Taking all equipment offline immediately may be required, and you will need to closely monitor the entry and exit points of data, especially where the breach occurred. The FTC’s guide to data breach responses also notes that until affected credentials are updated, your system will remain vulnerable.

If your breach involves a service provider, make sure that service provider is taking steps to remedy vulnerabilities, and then verify that they’ve actually executed on those steps. If your breach was internal in nature, interview the person or people who discovered the breach, engage with a forensic expert, and don’t destroy any evidence.

Once you’ve contained and isolated the beach, the next step is to notify the necessary parties.

3. Effective Breach Disclosures

It’s critical to have an effective breach disclosure policy in order to avoid potential legal and reputational risk. Breaches should also be reported to law enforcement immediately, regardless of the type of breach. Affected consumers should also be notified, even in instances where it is not obvious that a disclosure is required by law, for instance, where personal information is not involved, in order to avoid violating Section 5 of the FTC Act.

The FTC advises organizations to create breach disclosures that are straightforward, helpful, and that are effective for all audiences, including employees, customers, investors, etc. Disclosures should also involve key details that may help affected parties protect their information.

Organizations affected by a breach should also anticipate questions people may have about the breach, and attempt to answer them in a public format, such as on their website.

As the FTC notes, “good communication up front can limit customers’ concern and frustration, saving your company time and money later.”

So, given the likelihood that your company is at-risk for a data breach, it’s time to get prepared so that when it happens, you can detect, contain, and respond quickly.

—————

Ready for a deep dive into data stewardship and security? Jump into the 3-part iA Strategy & Tech data stewardship on-demand webinar series here:

Data Matters: How to Build the Foundation for Your Data Program – Session 1

Data Matters: How to Build the Foundation for Your Data Program – Session 2

Data Matters: How to Build the Foundation for Your Data Program – Session 3

—————

Bonus reading:

Security Beyond Prevention: The Importance of Effective Breach Disclosures

Ransomware Statistics in 2022: From Random Barrages to Targeted Hits

Data Breach Response: A Guide for Business

You Can’t Avoid a Data Breach – Three Ways to Prepare for the Inevitable

http://www.insidearm.com/news/00048339-you-cant-avoid-data-breach-three-ways-pre/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance

Macy’s Credit Sued For Prerecorded Calls: Retailers Back in the TCPA Crosshairs?

Retailers have had a rough few years as Amazon and COVID have more or less crushed the idea that people want to go to the store for stuff.

One of the few bright sides is that there have been relatively few TCPA suits targeting our favorite retail brands recently.

But that may be about to change.

On June 16, 2022, Macy’s Credit was sued in a new TCPA class action in California. The allegations are that Macy’s used prerecorded calls in an attempt to collect a debt from consumers who had never consented to those calls. (The allegations are unclear whether this is a skip trace situation.)

[article_ad]

The TCPA, of course, caries a $500.00 per call violation and the Complaint alleges there are thousands of class members–if not more.

The class is defined as:

All persons within the United States who received any collection telephone calls from Defendant to said person’s cellular telephone made through the use of any automatic telephone dialing system or an artificial or prerecorded voice and such person had not previously consented to receiving such calls within the four years prior to the filing of this Complaint.

This filing is a good reminder to those in the retail sector and those collecting consumer credit debt that the TCPA is still out there, looming. Even if it hasn’t knocked on your door for a while.

Remember–prerecorded calls (including outbound IVR and ringless voicemail) are big trouble these days. Move toward texts–particularly human selection, triggered or AI enabled texting–to assure greater TCPA flexibility.

One last note–the calls at issue are from 2020. So violating the TCPA today can spell trouble well into the future.

Complaint here: Macy’s Complaint

Macy’s Credit Sued For Prerecorded Calls: Retailers Back in the TCPA Crosshairs?
http://www.insidearm.com/news/00048336-macys-credit-sued-prerecorded-calls-retai/
http://www.insidearm.com/news/rss/
News

All the latest in collections news updates, analysis, and guidance