Best Practices for Notifying Consumers of a Third-Party Breach
It’s no longer a question of ‘if,’ but ‘when.’
Your consumers will reuse passwords, and those passwords will be exposed in a third-party data breach.
As soon as reused passwords become available to cybercriminals, your consumers are at high risk of account takeover fraud, which can result in substantial losses for you and for your consumers.
By monitoring your consumers’ credentials and resetting exposed passwords, you can help prevent account takeover and reduce online fraud. However, the language you use to notify them that their passwords must be reset requires careful consideration. Informing affected users that their credentials have been exposed on the criminal underground can encourage them to choose strong, unique passwords and protect any other accounts that share the same login information. On the other hand, some consumers may wonder how you located their information on the ‘dark web’ in the first place and where it was exposed.
Download our best practices guide to learn:
How to prompt users to change compromised passwords without introducing friction
Why you should take care to consider the right level of transparency for your organization
What an effective consumer notification looks like
Solution: Account Takeover Prevention
Reset stolen passwords before criminals can use them to defraud your users or access sensitive corporate data.
Preventing account takeover begins with monitoring the dark web, but without the ability to match user accounts with a database of exposed credentials, a top 10 travel booking site was vulnerable to attack.
The activity we saw on criminal marketplaces during the 2020 holiday shopping season surprised us – huge spikes in the sales of crimeware tools and stolen credentials for particular restaurants, airlines and other consumer services accounts. Get the details in this on-demand webinar.
SpyCloud’s account takeover prevention and fraud investigation solutions are backed by the world’s most current and comprehensive repository of recovered stolen credentials and PII. More data, particularly plaintext passwords, means more matches and stronger account protection.
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.