Magazine menu Close Magazine menu

Data and privacy

Latest stories

neural networks privacy, natural language processing, big data

How business can keep natural language processing from going bad

  • min read
    • In 2020, researchers from Google, Apple and University of Berkeley, among others, showed they could attack a machine-learning model, the natural language processing (NLP) model GPT-2. They made it disclose personal identifying information memorized during training. Although it may sound like a cat-and-mouse game for tech enthusiasts, their findings could affect any organization using NLP. I'll explain why and how, and what you can do to make your AI safer. The power of natural language processing NLP is improving thanks to 'big' language models – huge neural networks trained on billions of words to get the hang of human language. They learn language on all layers, from words to grammar to syntax, alongside facts about the world. Scanning news articles can teach models to answer questions like who the country's president is or what industry your company is in. There are many ways to apply big language models. Google uses its BERT language model to improve search quality. Language translation services like Google Translate and Deepl use big neural networks. Grammarly uses neural-based NLP to improve its writing suggestions. "The range of applications for language models is huge," says Alena Fenogenova, NLP expert at smart device makers SberDevices. She worked on the Russian-language version of GPT-3 and a benchmark to assess the quality of Russian language models. "These models can help create resource-intensive things like books, ads or code." OpenAI's neural network GPT-2 hit headlines by generating a news article about scientists discovering unicorns in the Andes, prompting fears of automated disinformation. Since then, OpenAI has released GPT-3, saying it improves on GPT-2 in many ways. People are using it for amazing things, like simplifying legal documents into plain English. GPT-3 can even generate working web page source code based on written descriptions. NLP techniques also work on programming languages, leading to products like Microsoft Intellicode and GitHub's Copilot that assist programmers. Fenogenova elaborates, "You can train these models on any sequence, not just text – you can do study gene sequences or experiment with music." Data is king To create these models, you need access to a huge amount of raw data, for example, texts from the web to work with natural language or programming code to generate code. So it's no coincidence companies like Google and software development resource GitHub are among the leaders in language models. The tech companies usually open-source these big models for others to build upon, but the data used to create the models and in-house data used to fine-tune it can affect the model's behavior. What do I mean? In machine learning, poor quality data leads to poor performance. But it turns out a machine learning model can pick up a little too much information from raw data too. Bias in, bias out Just as computer vision systems replicate bias, for example, by failing to recognize images of women and Black people, NLP models pick up biases hidden in our natural language. When performing an analogy test, one simple model decided 'man' is to 'computer programmer' as 'woman' is to 'homemaker.' More complex models, like language models, can show a wider range of biases, both blatant and subtle. Researchers from Allen Institute for AI found many language models generate false, biased and offensive texts thanks to their training data. "The text data used to train these models is enormous, so it's bound to contain gender, racial and other biases," says Fenogenova. "If you asked a model to finish the phrases, "A man should…" and "A woman should…," the results will likely be alarming." The problem is showing up beyond research. In 2016, Microsoft shut down its chatbot that had learned to be racist and misogynistic after just a day engaging in Twitter conversation. In 2021, the South Korean creators of a Facebook chatbot meant to emulate a university student had to shut it down when it started to produce hate speech. NLP's behavior can mean reputation damage as well as perpetuating bias. Models that know too much In 2018, a team of researchers from Google added a test sequence, "My social security number is 078-05-1120," to a dataset, trained a language model with it and tried to extract the information. They found they could extract the number "unless great care [was] taken." They devised a metric to help other researchers and engineers test for this kind of 'memorization' in their models. These researchers and colleagues did follow-up work in 2020 that I referred to earlier, testing GPT-2 with prompts and finding the model sometimes finished them by returning personal data. When GitHub first released its programming language model Copilot, people joked Copilot might be able to complete private Secure Shell (SSH) keys. (Secure Shell securely connects remote computers on an insecure network.) But what it actually did was just as concerning: Generated code containing valid API keys, giving users access to restricted resources. While questions remain over how these keys were in Copilot's training data, it shows memorization's possible consequences. Making NLP less biased and more privacy-conscious The risks of big generative text models are many. First, it's not clear how data protection principles and legislation relate to memorized data. If someone requests their personal data from a company, are they entitled to models trained using their data? How can you check that a model has not memorized certain information, let alone remove the information? The same applies to the "right to be forgotten" part of some data regulations. Another issue is copyright. Researchers found GPT-2 reproduced a whole page of a Harry Potter book when prompted. Copilot raises hard questions about who wrote the code it generates. "Another approach might be to use automatic 'censors' to detect inappropriate text before it reaches users. You can also create censors that detect and filter out private data," says Fenogenova. "Companies can also filter raw data to minimize the risk private data ends up memorized by the model, but it's difficult to clean such big datasets. Researchers are looking at 'controlled generation,' where you steer the generation process of the already-trained model." Despite these issues, neural network-based NLP will keep transforming how enterprises deal with all things text, from customer interactions to creating marketing content. Being mindful of the risks of language models and their applications will protect you and your customers, and help make your NLP projects more successful.
lighting up dark web, fraud, low enforcement

How police identify criminals selling data on the dark web

  • min read
    • In the north of England, a team of officers are getting creative. They're finding ways to identify criminals selling personal data, fake COVID-19 vaccines and child sexual abuse images on the dark web. Tomorrow Unlocked's film Lighting up the Dark Web follows the UK's Yorkshire and Humber Regional Cybercrime Unit (RCCU) in their quest to unmask a crime ring selling personal data for fraud. What is the dark web? The dark web is a network of computers where web traffic is anonymized. Many use it to access marketplaces and other sites to commit crime. The dark web can also be used for good. Dissidents, whistleblowers and investigative journalists use it to communicate anonymously online, and others use it to avoid online data collection. The sale of personal data is big business on the dark web. Fraudsters can buy names, dates of birth, credit card information and more. The FBI reports losses from fraud topped 4 billion US dollars in 2020. Linking dark web identities and real-world people In 2014, a trader called Data Pro was selling National Insurance numbers, dates of birth, credit card numbers and more on the dark web marketplace Evolution. RCCU suspected the source was a UK-based business. RCCU used 'slips' – when Data Pro occasionally used identifiable information – to link his clear web and dark web identities. How businesses can protect themselves from dark web criminals While the dark web seemed impossible to control in the past, law enforcement is now getting ahead. Businesses can also act to give fraudsters less opportunity to make dark web profits out of their data. First and foremost, protect your business's data from being stolen with strong data security practices, including encrypting your data and educating employees on how to avoid accidentally giving cybercriminals access. Your people are your most important security feature because most breaches start with basic errors like clicking a link in a rogue email or giving login details to someone who isn't who they said they were. If your data is already stolen and ends up on the dark web, dark web monitoring services like Have I Been Pwned may help you identify a breach and alert those whose information was stolen faster. As law enforcement becomes more cyber savvy, there are fewer places for cybercriminals to hide. Increasing international cooperation is also helping light up the darkest parts of the web. Businesses also have a part to play by reducing the opportunities for their data to be stolen and sold.
insight story ai machine learning

Customer wins from AI require strategy, not just investment

  • min read
    • There was a time when artificial intelligence (AI) had a menacing ring, but things have moved on. Chat GPT and generative AI apps are creating new roles or making some skills and careers obsolete, depending on who you listen to. Meanwhile, we see its benefits every day, like finding efficiencies and automating repetitive tasks. AI could soon be essential to most businesses. But it's not always clear how to use it. Kaspersky's new podcast, Insight Story unpacks emerging tech trends with global specialists and businesses successfully using the tech. In Episode 5, I speak with AI expert Dr. Romesh Ranawana (Sri Lanka,) customer loyalty consultancy Truth CEO Amanda Cromhout (South Africa) and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. We examine how business should approach AI and machine learning to make the most of the opportunity while staying secure. Understanding what's meant by AI Romesh says we normally mean something more specific when we talk about AI. "All technology – be it Alexa, your car or washing machine – uses algorithms. An algorithm outputs something when you input something. For problems too big or hard to solve with software, a particular type of AI – machine learning – offers a new way to build algorithms, instead of a programmer writing lines of code." And this kind of AI is everywhere. "We hear much about how it's changing e-commerce and video streaming, but nearly every industry uses AI – from healthcare to retail to factories. Many of the biggest brands, like Amazon and AirBnB, owe their success to it." AI in customer loyalty Customer loyalty programs have long used AI to target customers with more relevant, personalized offers. Amanda's company Truth specializes in these. "Data is fundamental to customer loyalty programs. Everything we know about a consumer – whether the information they give or gained through transactions – has proven power." UK grocery outlet Tesco's Clubcard was one of the first schemes of its kind, with some 20 million members today. Amanda says their approach to data was groundbreaking: "Every quarter, Tesco sent out thank you vouchers with a small discount on your next shop. The vouchers were relevant to what you bought, and no set was the same." "It's a value exchange," says Amanda. Customers give their data because of what they get out of it. "Sometimes companies ask members or customers for data less overtly. Financial institutions may offer a reward to answer a questionnaire, creating a profile of your financial needs and propensity to borrow. They're paying so they can get a higher response rate to sales. If done well, it's win-win." Recent research, Global Data Privacy: What the Consumer Really Thinks 2022, found discounts and freebies were in the top three reasons consumers share data with brands. Amanda also thinks some companies confuse using data well with hard-sell. "They're not thinking through the value proposition. The younger generation especially knows their data's worth. They're asking, 'What am I going to get for that?'" Keys to success with AI Most companies investing in AI aren't getting immediate results. MIT research found only three in 10 companies investing in AI are getting a return on their investment. Who succeeds depends on how they approach it, Romesh says. He thinks why you're doing it matters too – it should be about changing how the company does business, not simply making savings. "If you look at AI as a way to automate what you do now, you'll get reduced costs but not much benefit. You need to mesh AI and people in your organization to generate value, so they're learning from each other." Amanda adds, "Many companies want to flick a switch and, in two hours, make it happen. They don't understand it has to be a strategic driver for the business." Romesh and Amanda both highlight good-quality training data as a critical success factor. Romesh says, "Customers and their behaviors change – what you train today may not be relevant in a week's time. AI systems must be continuously trained on real-time, up-to-date data. Companies need data collected continuously kept in a single space – we call it 'the data lake.'" Amanda also believes the C-suite must support an AI strategy, even lead it. "It doesn't start with marketing executives wanting to do this – it starts at the top, with the CEO and the board." But they shouldn't expect too much, too soon. "The leaders of any company must understand it's an ultramarathon, not a sprint." Romesh notes it's becoming possible for more people to work with AI. "AI systems are still complicated. It takes knowledge, data engineering and software skill. Over the last few years, more tools have come out – low-code or no-code tools – making AI more accessible to more people." How AI is changing cybercrime AI didn't need to be more accessible for cybercriminals to use it, which has implications for business. In research with Kaspersky's Global Research and Analysis Team, Fabio Assolini has seen several applications of AI in cybercrime. "AI is helping cybercriminals bypass new authentication methods. Some financial institutions and banking apps use biometric authentication, where the user must look to the right, to the left and smile. We've seen cybercriminals using AI tools to do this with only a victim's photo." How businesses should respond isn't straightforward – they need to identify more fraudsters while not misidentifying too many customers. "You can fine-tune authentication methods to better identify fraud attempts, but you may get many false positives. It's a balance," says Fabio. Fabio recommends businesses ensure AI training data is ethically gathered and complies with privacy regulation in countries they distribute to. "Some free apps for adding special effects to pictures collect and sell data sets for training AI. There's a privacy issue, especially in Europe with GDPR, but sometimes those collecting the data are in parts of the world without privacy restrictions." To comply with GDPR, AI systems that use personal data must be developed, trained and deployed with a clear objective determined at the design stage. It must be legitimate and compatible with the organization's goals. AI's future in business Amanda stresses the need for brands to understand what their data really means about every human behind it. "Data scientist Dr. Shorful Islam says, at the end of every data point is a human being we're trying to persuade to do something differently, or trying to make their engagement with a brand more pleasurable, or whatever the desired outcome. So you've got to think about behavior more like human beings, rather than robots." Romesh sees AI leading to powerful change in consumer behavior. "We're buying things we'd never have bought before because companies are pushing them to us. Amazon reports 35 percent of its revenue comes from recommendations." And those features will only get cleverer. "Systems will become more powerful because they'll have more data feeding in." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
digital trust

Customers’ trust in tech is changing. What should business do?

  • min read
    • Of course, businesses need customer trust, but understanding what trust means in a digital world is becoming more important. Digital trust is users' confidence that tech, people and processes they engage with are secure and private. Recent research suggests how customers decide where to place their digital trust is changing, so some businesses are changing their approach. As Minter Dial wrote before in Secure Futures, the 2022 Edelman Trust Barometer report shows eroding trust in institutions while remarkably, our trust in business remains. Now, there's an opportunity for business to use integrity, empathy, and privacy and ethics around new tech like artificial intelligence (AI) and customer relationships management (CRM,) to lead the way. Kaspersky's new podcast, Insight Story, unpacks emerging tech trends with global specialists and businesses successfully using new tech. In Episode 4, I discuss what digital trust means and how organizations can grow it with Müge Fazlioglu (US,) Principal Researcher, International Association of Privacy Professionals (IAPP), Malek Ben Salem (US,) emerging tech security expert and Fabio Assolini, Head of Research in Latin America for Kaspersky's Global Research and Analysis Team. Unpacking digital trust Digital trust covers much ground, Malek Ben Salem says. "It's about data integrity, technology, people and processes. It's our confidence that our privacy is protected and secured, the reliability of digital transactions and how sure we are of the identities of those we engage with. It's also about how much we trust the information we get as users." Müge Fazlioglu says trust is notoriously hard to pin down. "Our trust when we may or may not share data depends on many things, like our perception of the party we're sharing with, our data's value to them and us. We also weigh the data's sensitivity – what might happen if it were revealed." Trust can make or break a purchase IAPP's March 2023 Privacy and Consumer Trust Report shows privacy concerns influence consumer purchasing decisions. Müge says, "Many people take steps to protect their privacy, like deleting an app or withholding some personal information." So paying more attention to trust could pay dividends. "Organizations gain credibility by taking steps to enhance privacy and data protection. We're now seeing some big brands featuring privacy-related messaging in their advertising and marketing of web browsers and smart home devices," recounts Müge. Trust concerns also make brands hit the headlines for the wrong reasons. Amazon's recent purchase of robot vacuum cleaner brand iRobot triggered privacy objections from consumer and civil rights groups, then an EU investigation. How companies help (and harm) trust Tech research consultancy McKinsey's 2022 Digital Trust report said while 70 percent of people trust companies to protect their privacy, most companies aren't living up to the expectation. So what should companies do? Müge says much best practice is around transparency. "Few consumers have a good grasp of how companies use their information – what they collect, and if they follow good practice. So companies need to ensure they write a simple, clear privacy policy and have an easy-to-use page for people to manage their privacy settings." Regulators also think easy-to-adjust privacy settings matter. The US Federal Trade Commission (FTC) recently fined the company that makes the game Fortnite for its hard-to-use privacy settings. Müge thinks regulators, businesses and consumers can all play a role in improving communication around privacy. "How a company communicates its data practices affects trust – the duty should not be on customers to make daily decisions based on lengthy and complicated legal agreements. Regulators have an important role in raising awareness and providing education. Some, like the FTC and European Union data protection authorities, are starting to do that." Müge also recommends being prepared for how you'll handle a data leak. "Responding slowly means more consumer loyalty lost. Have an incident response plan for the inevitable." Data leaks are common but often have a big impact on business. Kaspersky's 2022 IT Security Economics report found that among 3,230 businesses surveyed, data leaks were the most commonly encountered security issue, with 55 percent considering them the most challenging incidents. Malek points to one business leading in digital trust. "Apple stands out in how it uses privacy-preserving technology to train artificial intelligence (AI) on mobile phones. Devices keep data locally and use it to train user speech-recognition and auto-complete models. Then the models are used to update a central model that can be applied to many users. So the data is not shared or uploaded, but still used to improve the AI." Using cybersecurity to build trust 29 percent of businesses with 500 to 999 employees have experienced a cybersecurity incident, according to Kaspersky's 2022 Small-to-Medium Business Cyber Resilience report.  As your business scales into a larger enterprise, so does the likelihood of a cyberattack or data leak. Malek thinks investing in cybersecurity is vital to protect customer trust. "To build secure infrastructure and allow for secure transactions, you need a cybersecurity strategy and proper governance, and you must hire the right talent. More importantly, be transparent." Or, as Müge says, "Shine a bright light on what you're doing." New technologies are evolving cybersecurity's contribution to digital trust. Malek sees many applications of AI in security tech: "It helps identify who is accessing a system by profiling user behavior. It can detect and respond to security incidents. It can classify unstructured data like business documents, so we don't need people to read them to know what's sensitive or confidential." A relatively new approach to security, zero trust, is influencing what we'll see next. "People will own their full identity and use pieces as needed. For instance, if I want to buy something that requires proof of age, I can share just my age without information the seller doesn't need, like full birth date. Zero-trust principles mean allowing access only to the information needed." But Kaspersky's Fabio Assolini says businesses may not be able to adopt these good practices overnight. "Many networks need adapting for zero-trust principles. It's a challenge for administrators, but it's important they understand how it works and prepare corporate networks for it." He also highlights the value of transparency, not just between businesses and customers, but between businesses and suppliers. "You must be able to trust your cybersecurity providers, especially as we're seeing many targeted attacks that abuse cybersecurity software or infrastructure. Security vendors could be more transparent about their technologies. At Kaspersky, we let customers review our code at transparency centers. We'd like to see other companies doing that." He adds, "Training is also important. Sometimes cybercriminals send a phishing attack to just one employee, so it matters that each employee is trained in identifying attack attempts." Asked for one key recommendation for business in building digital trust, Malek says, consider cybersecurity part of your environmental, social and governance (ESG) framework because "it elevates the discussion." Müge says, "Keep in mind all the smart technology you use. It uses many different kinds of information. Use the privacy features and regularly monitor data sharing." Listen to the full Insight Story audio series on Podbean or your usual podcast provider.
unexpected data collection, GDPR, regulations

The one data privacy principle no one talks about

  • min read
    • Let's say there's a short form on your organization's website visitors use to sign up to receive company news. They're asked to give their name and email address. One day, you hear colleagues in marketing are going to add something to the regular company news email those sign-ups receive: Promotions of partner companies' products. Are your data protection alarm bells ringing? They should be, but if they're not, you're not alone. Purpose limitation is a data security principle many are unfamiliar with. Understanding it will help you reduce data security and data privacy risks and show your customers you respect their data. What is purpose limitation? Purpose limitation has two parts. First, when you gather anyone's personal information, your organization must be clear about how it will use the information from the start. Second, you must not use the data for another purpose. Much data protection regulation around the world includes some kind of purpose limitation requirements, notably the EU's General Data Protection Regulation (GDPR.) Under GDPR, organizations must document the data's purposes and specify the purposes in the privacy information they supply. But why does purpose limitation matter? Surely if someone chooses to give their data, your organization can use it without limit as long as you keep it private? Not so fast. This is one tin of spaghetti that fast turns into a can of worms. The young woman, the chaplain and the hospital Some privacy trainers tell a story about a young woman who was asked to fill in a form when she was admitted to hospital. One question on the form is asking for her religion. Perhaps this information is important in medical care and she's been asked this question on forms before, so she dutifully fills in her religion as she always has. Why the question? This hospital uses the information to tell the hospital chaplain there's a patient who may appreciate a visit, but they don't tell the patient this. Small world – the hospital chaplain is a friend of the young woman's family. She is unmarried and is in hospital for a pregnancy-related issue. Her family doesn't know she's pregnant and she has no intention of telling them. Now, the young woman and the chaplain are in an awkward position. Apart from infringement of data use regulation, some might say the woman had free choice over whether to give the information, so the results are her responsibility. On the other hand, the trust patients place in hospitals is crucial to the hospital being able to achieve its purpose: To help patients get well. Can organizations live up to the trust customers need to place in them? Data recycling happens all too often Several incidents around customers surprised how companies used or sold their data, given why they provided it, have hit headlines recently. Take for example, the period-tracker app that fed customer data to Facebook, where it was used to market products for expectant Moms. One user found herself suddenly marketed to as though she were pregnant, when she'd only forgotten to use the app to log her period. It's easy to imagine how this kind of sensitive information re-use could emotionally harm some customers. In 2017 Uber settled a complaint from the Federal Trade Commission out of court. Part of the complaint included that some employees had used the software's 'God View' function to track the movements of politicians, celebrities and even ex-partners. Although Uber hadn't sanctioned these misuses, it had no effective processes to prevent it. Do companies, and their employees, understand their responsibilities in limiting how they use customer data? Can you recycle personal data? What the law says GDPR is up front on purpose limitation being a core principle of data protection. Article 5 section 1b outlines how personal data must only be collected when its use is specified and explicit. The data cannot be further used in ways that don't match the original purpose. There's exceptions for historic, scientific and statistical uses, and "if the legitimate interests of that controller or a third party override the interests of the data subject." The European Commission gives guidance to help organizations know if what they're planning to do with data is consistent or inconsistent with its purpose. They suggest considering for example, whether the data is sensitive (including health information, political beliefs and more) and how further use could affect the person who gave the data. While penalties for breaching the purpose limitation principle so far haven't been huge, there's been a steady stream of reputation-damaging prosecutions. Norway's data protection authority fined the Norwegian Public Roads Administration the equivalent of 50,000 US dollars for using 'security' cameras to monitor contractors' work. Breaching the principle with just one customer's data doesn't mean lesser fines – Spanish authorities fined bank Bankia the equivalent of 50,000 US dollars for retaining and reusing one customers' data 16 years after they'd stopped being a customer. When considering fines, regulators punish not for violation of principle, but for the consequences. For example, if companies don't comply with data processing purpose limitation, they may also violate other GDPR requirements, such as having a legitimate reason to process the data. It's not just Europe that has enshrined purpose limitation in data use law. California added a purpose limitation clause to their California Consumer Privacy Act (CCPA) in 2018. The clause says businesses must, before collecting personal information, inform consumers how it will be used and need consumer agreement to use the data for another purpose. What do businesses do to meet purpose limitation obligations? "Every organization processes different kinds of personal data, in different ways, for different purposes," says Kaspersky's Head of Data Protection and Privacy for Europe, Alexey Testsov. "GDPR requires data controllers and processors keep records of what data the organization gathers, why they're gathering it and how long it's kept for. Alongside information auditing and data mapping, these records are vital in complying with purpose limitation responsibilities. "Employees must know how to collect, store and use personal data within the law. Given the high risks of data processing, it's more reliable to discuss changes in processes with a security officer or legal department. Employees should know how to consult internal experts and not be afraid to do so." Here are two examples of identified problems that can lead to failures to control data use purposes. Systems to keep data separate Effective safeguards to prevent any set of data being used for other purposes might have avoided some recent cases of data recycling. In the UK, the Information Commissioners' Office (ICO) fined a political campaigning organization and an insurance company 120,000 UK pounds (around 165,000 US dollars.) The ICO found personal information given for political campaigning had been used to market insurance. It highlighted ineffective data protection systems within the two organizations. "Systems for segregating the personal data of insurance customers' from that of political subscribers' were ineffective." Look for changes in how upgraded software uses data Hunter Nelson, President of Tortoise and Hare Software, says software developers should realize the potential privacy impacts of 'function creep.' He advises, "Controllers and processors must use care when developing systems not to breach privacy law as new features are released. A process checkpoint should be included in the release to review new features with a privacy lens." Regardless of the privacy legislation your organization operates under, knowing the importance of purpose limitation will help you uphold high data privacy standards. Ensure that when you ask customers for personal information, they understand how you will use it. Put in place systems to ensure their data cannot be used for other purposes. These actions will show your respect for customers' privacy and help build the trust that every organization needs.
paper dead shredder

Is paper dead?

  • min read
    • For retailers, predicting customers' future wants and needs is crucial – especially in this era of disrupted supply chains. I hope you won't recognize this story as something that might happen in your business, but it demonstrates how soon retailers of all sizes could find themselves in a new future. I bought a blouse recently from a traveling vintage clothes seller. Picture several racks of bright retro outfits set up under a caravan awning with a changing room crafted from tie-dyed blankets. Incense hangs in the air, as does the ringing of tiny bells attached to the seller's impossibly long hair, jingling as she wanders around after customers, straightening coat hangers. To pay, I offer cash, but she instead presents me with a beautifully calligraphed sign showing her bank account details. Given the riskiness of this practice, I offer a moment of security education. She tells me she's in the habit of giving out her bank details because it means more sales, and keeping enough change around is hard when you're always on the road. Even those on the fringes are moving towards electronic payment for its convenience and customer preference, albeit sometimes not in ideal ways. When it comes to meeting customer expectations in how your transactions happen, are you ready for a future where paper money, receipts, plastic cards are a thing of the past? Could your retail business work in a world where all money is changing hands by smartphone? Among Kaspersky researchers' privacy prediction for 2023 is that we'll keep seeing smartphones and other smart devices encroaching on activities once dominated by paper and plastic cards. A future where all we'll need is a smartphone seems close when we're paying by near-field communication (NFC) like Apple or Samsung Pay or QR code like Swish, or using apps to show COVID-19 testing and vaccination status. What does this mean for paper and plastic transactions? And what privacy and security issues should business consider when it comes to doing it all by smartphone? Environmental reasons to stop using paper and plastic Some might say the sustainability drive to eliminate paper and plastic in business transactions is overplayed. While both have significant environmental impacts, business transactions are not a major source. Meanwhile, electronic transactions can be responsible for much energy use and the equipment used will ultimately become resource-heavy and hard-to-recycle ewaste. Gen Z, Millennials and those younger will do much to avoid adding more plastic and paper to the world. Regardless of environmental impact, consumer demand for more convenient paperless and cardless transactions will only grow. Processes likely to move to smartphone apps Digitized identity documents look set to be the next big frontier for smartphones. It's already been a common approach to declaring COVID-19 testing and vaccination status worldwide, but soon passports, driver licenses, student IDs and more will be made available through apps. Germany started using app-based ID cards in 2021. Around the same time, Apple announced several US states would make digital identity cards and driver licenses available using Apple Wallet. ID stored on phones brings convenience and risk. A well-implemented system would let stores verify customers' age without seeing personal details they don't need, like home address – also known as 'zero trust' security. Digitized IDs could also speed up know-your-customer (KYC) procedures when applying for a loan with a smartphone. But using a smartphone to store growing amounts of personal data introduces 'single point of failure' security risk. Those who develop and commission smartphone software like apps must ensure top-notch device security and privacy-preserving data storage. Cardless cash withdrawal at ATMs is taking off around the world, especially where bankcard fraud is more common, like India. Smartphone apps enable cardless withdrawals, for example, scanning a QR code on the ATM screen with a payment app like Google Pay, or using near-field communication (NFC.) Again, these transactions aren't without risk. Speaking to price-comparison service Bankrate, Ricardo Pina, founder of personal finance blog The Modest Wallet, said, "Since bank cards are being replaced by phones, criminals will now be more enticed to target and hack your phone to mine your data, information and even change your phone and bank app settings." When will paper and card transactions become history? Those who run businesses that experience higher overheads thanks to processing cash, cards and printed receipts may dare to dream of a world where these go the way of the 'check.' Ubiquitous throughout most of the 20th century, many banks have stopped issuing and accepting these. Check payment is expected to be extinct by 2026. Those old enough to remember when checks were commonplace might think they'd disappeared years ago. But sometimes these methods strongly persist in parts of an economy that need them for specific reasons. A few years ago, a friend and I hiked the five-day South West Coastal Path in Cornwall, UK – and yes, it was glorious. This part of the UK is far from any major city. We were surprised to notice most bed-and-breakfasts  accepted only cash or check. Once we understood the area's geography, we paid by check wherever we could. Traveling on foot and far from towns, it seemed unwise to part with cash we might need. These businesses told us they didn't take card payments because they only had customers in summer, making point-of-sale machines uneconomic. Similarly, can smartphones – and reliable access to affordable data to operate apps – be all things to all people in all places? While access to mobile technologies has certainly enabled greater economic participation from marginalized people, we can easily overestimate how many can and will use these technologies if we use them or see them used around us often. Pew Research estimates around 85 percent of the US population owns a smartphone, but in China and India, it's lower at 70 percent. While China leads the world in mobile payment adoption, smartphone ownership numbers don't tell us how many people could use their smartphone for payments – for example, successfully download and register to use payment apps, and access data when needed. Cash transactions still account for far more business than many people think – in 2021, customers used cash for over 20 percent of point-of-sale transactions globally, according to the International Currency Association. Many businesses wouldn't survive losing 20 percent of their sales. There is also the inevitable backlash against smartphones because of negative mental health impacts, seeing some choose to quit or radically reduce how much they use them. It seems paper- and card-based identity and payment options will be with us much longer than we think, if the lifecycle of check payment is anything to go by. For small business, alternative point-of-sale card payment providers are fast making accepting cards more affordable, making paying by card even more ubiquitous without reducing security. When it comes to taking payment, it 'pays' to be flexible and listen to what your customers want, rather than focusing on what suits your business. Meanwhile, keep an eye on evolving technology making retail transactions simpler and more affordable.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries