individual is authorized to initiate a payment. new approaches to authentication increasingly offer greater assurance and protection. given the current technologies that we have at our disposal, we should assess the continued use of signatures as a means of authenticating card transactions. it is important to layer security tools and procedures. methods to devalue payment data, like tokenization and encryption for data at rest, in use, and in transit, mitigate the effect of a data breach. analytics can identify and prevent fraudulent transactions. firewalls and segmentation of technology supporting critical functions can protect networks from outside attacks. also, remember that people inside your organization and organizations that you work with can pose a significant risk. one study found that more than 20 percent of security incidents could be attributed to insiders. 4 segregation of duties, background checks, and monitoring for anomalies help reduce the risk of insider threats. strong vendor - management programs can reduce risks from an institution ’ s partners and service providers. 3. planning as crucial as they are, we should keep in mind that these prevention tools cannot stand alone. even with stronger authentication methods, robust network security, and other approaches in place, preventive measures aren ’ t sufficient to manage security risks. such measures are designed to protect against known risks. but those looking to exploit the system will continue to devise new methods of attack. in some of the recent high - profile data breaches, companies have scrambled to deal with the aftermath. this brings me to my third point. we need a comprehensive way to think about planning. the national institute of standards and technology ’ s cybersecurity framework is one of many voluntary cybersecurity frameworks that provide a holistic, risk - based approach to planning. 5 in addition to preventive measures, the framework identifies four additional core functions : identify, detect, respond, and recover. we can apply these four functions to securing the payment system. an important first step is to identify internal business processes and assets, as well as external threats. you can ’ t protect yourself unless you understand how your business is structured. this sounds simple enough, but an organization ’ s computer systems are often unexpectedly interconnected. some of the largest point - of - sale data breaches, for example, originate outside payment card systems. 6 you should also keep up to date on cyber developments and gather information about threats from information sharing forums, including fs - isac, us - cert, and the fbi ’ s infra

##s. these well - known payment fraud schemes were perpetrated in different eras, and juxtaposing them highlights how the payment security landscape has changed. frank abagnale relied on the slow speed of the paper check - clearing system and in - person social engineering. in contrast, the atm thieves relied on rapid transmission of data to remotely steal account information and alter withdrawal limits, all without interacting with bank employees. today, fraud can be executed quickly, perpetrated on a massive scale, and carried out remotely. bis central bankers ’ speeches in light of this new environment, i will suggest four things that all of us ought to be doing with respect to payment security. some are already being done. too often, though, such efforts are overlooked or inconsistently applied. 1. safe innovation this is an exciting time for the payment system. technology companies are creating new methods to pay with mobile phones and even wearable devices. banks are building faster payment capabilities into their deposit account systems. banks, payment card networks, and merchants are rolling out europay, mastercard, and visa ( emv ) chip cards and using compatible point - of - sale terminals. many of the newest products in the market are impressive, incorporating new technologies like biometrics and tokenization. end users and the media have taken notice. history shows that we should embrace innovation. technological innovation has continually pushed the payment system forward. payment cards, both credit and debit, are an example. thirty years ago, everyone carried cash. today, young adults increasingly prefer to rely on cards and mobile phones. payment cards have improved convenience and security in certain ways, like reducing the impact of a stolen wallet. but history has also shown that new technologies must be adopted in a prudent fashion. technological innovations can provide substantial benefits to payment system efficiency and security in the long run, but they often introduce new, unanticipated risks. for example, although payments cards reduced the impact of a stolen wallet, they ’ ve also introduced new risks, like counterfeit card fraud. it is important that we identify and address the unanticipated risks that inevitably result when we try new things. these risks may be tolerable in the short run, so long as we work to identify, prevent, and mitigate them early on in the design and implementation process. in the case of payment cards, over time, technologies have been broadly implemented to mitigate many of the risks. for instance, computer