Stepping between Hoff and Curphey.
Consumers always lie in surveys and claim that if a company loses their credit card or other personal info, they’ll go someplace else. In reality, they almost never do.
Why? The pain of switching to a different vendor/store/service/whatever is almost always greater than that of the fraud, even when there is fraud. When it comes to credit cards the only pain is that of reversing a charge. Real ID theft is a lot rarer. We also tend to assume someone tightens the ship after a big breach, making them more secure. We’re nice people, and tend to give someone a pass on the first mistake.
If TJX customers started suffering fraud on a regular basis due to negligence on the part of TJX, I bet sales would drop.
Your security only needs to be good enough to avoid giving your customers more pain than that of buying from someone else.
Reader interactions
2 Replies to “A Short Take On Why Good Security Isn’t A Competitive Advantage”
a day after I talked about how it takes sustained failures for consumers to leave a company and go to a competitor, we have an example where switching isn’t really an
As a consumer, I have no way of knowing anyone I “switch to” will be any more secure, or any more lucky. Obviously many of these breaches are not direct results of corporate character flaws—sometimes you have a good policy, and an employee follows it, or bad luck (of the lightning strike level) hits.
On the other hand, encrypting all data (almost) all the time can protect a lot. Why haven’‘t we heard an announcement that someone lost a truck full of tapes, so there is a risk, and they are notifying customers, but the odds are overwhelmingly against this being a problem? I suspect the answer is if the data is definitely encrypted, the incident is deemed a non-risk, and companies decide not to report anything.
But anyway, if you show me that JP Morgan Chase has substantially better security than Citibank, I will switch my account. Not just a little better, but enough to make it worth learning the locations of a dozen new ATMs, and giving up the one that’s on my way to lunch, and the one that’s on my way to the subway, and the one next to the bagel shop.
I use MasterCard instead of Visa because last time I had to decide, MasterCard used 16-digit numbers and Visa used 13 digits; since there was no functional difference, I went with the company that had marginally better security.