Bank Breach – Debit Card – Update

In August I put out a post on my take of the VA bank $2.4m debit-card/hack event.  (See that post here.)

Over the past three months, I have more information and have changed my thinking slightly.

First, I have no more info on the actual event or the claim with ABA/Everest. As I said before, the bank is not a client and ABAIS is obviously not sharing claim details.

I have gone over the policies in great detail and had countless conversations with insurers, bankers, and IT people.

This was truly a disastrous attack.  All the wrong things, at all the wrong times.

I continue to think most insurers would respond in the same way that ABA/Everest apparently have – limiting coverage because the actual loss involved debit cards.

Everest has low limits of coverage for such events – often $50,000.  No other insurer that I know of had issued coverage over $1,000,000 prior to this event.  Only one insurer seems willing to issue coverage over $1,000,000 now – Berkley FinSecure.  Several will issue $500,000 or $1,000,000 on a case by case basis. (If you are an insurer and want to correct me on this info please email me.)

Prior to this event nobody has been able to come up with a claim of over $500,000.  Several underwriters told me they had never heard of a claim over $250,000.

I have pulled back from my comments in August about getting quotes for $1,000,000 and more.  Awareness of the VA attack has made banks more vigilant and IT people more aware of what to look for.  I’m now looking at this event as a “Black Swan.”  Exceedingly rare, an almost unpredictable event.

It also comes down to economics.  Should a $750m bank spend $10,000 a year for $1,000,000 of debit card coverage?  In most cases, there are better places to spend premium dollars.

Insurers do not like to insure this type of event – high frequency (most banks experience debit card fraud regularly), low severity (most losses are $500 or less). Several insurers told me that they don’t want to provide coverage where the bank can prevent big losses with technology/diligence.

The Chartis Bank Card Protector program is the broadest coverage that I have seen. If your bank is concerned with debit card losses that is the best place, I think, to get coverage. Most banks in my experience walk away when they see the premiums though.