Where the Real Cybersecurity Risk Comes From

Schwartz: We had one of those things as well. Same exact thing: The rep was about to go on vacation. Reps do dangerous things when they are leaving in two hours for vacation because they don’t check as carefully as they should.

There are really two categories of vendors. One is where there’s money that can be sent out. In other words, if it’s your clearing firm, the person can get in there and get a check written. If it’s Albridge, they can’t. No money is going anywhere — not to say Albridge is therefore unimportant and it doesn’t matter if somebody goes into an Albridge account, but it’s one thing to get somebody’s Social Security number or get some information about them. It’s another thing to have the ability to wire $1 million to Lithuania.

Certainly, your No. 1 defense has to be in places where you actually have money sitting. Let’s face it, how many accounts were hacked at J.P. Morgan? Something like 8 million accounts or something? But they didn’t take anything. Obviously those are ugly, but they are not nearly as ugly as when a whole pile of money disappears.

We’ve had about one a year for the last two or three years, and before that we never had any, but fortunately, none have been over $30,000. You may even call the client and the client says, ‘Yeah,’ or they thought you are talking about the IRA distribution they were asking for and this is a different account. I don’t think too many broker-dealers have gone as far along [as American Portfolios]. Most advisors get pretty prickly when you want to call up their $20 million client because he wants a $4,000 wire. I think that is an extreme, but you’ve taken it further. You’re either a forward thinker, or somebody that your reps are going to go crazy over.

Dolber: We had some reps go crazy about it, but you know something? We had one advisor who was screaming bloody murder and saying, ‘Wire that money, wire that money!’ I said, ‘No, I can’t get your client.’ They actually threatened to leave. It turned out it was a fraud, and they were very thankful we didn’t wire the money.

Schwartz: Let’s face it, breaking into banks and robbing trains isn’t really that fashionable these days. Cybersecurity, worst comes to worst, you get caught and then you make $1 million each year going around the circuit speaking about cybersecurity.

Cybersecurity Insurance ‘Evolving Area’

Green: What kind of liability insurance do you have?

Dolber: I just took out a $30,000 policy, cybersecurity insurance policy, because you do have expense. You have liability of expense. Some states have rules about having to inform clients of a breach.

DeVito: We might have expenses to set them up with a credit check, [or] you have to put a LifeLock on them. We all have insurance for it.

Schwartz: We have it, too.

Green: I’m sorry, that protects the broker-dealer? Does that protect the rep?

Schwartz: It does not protect against fraud by the rep or by some third-party. If $30,000 gets wired out of an account at National or Pershing incorrectly, we are going to be writing that check. Pershing and National certainly aren’t going to write it, unless you can prove clearly they are at fault.

Now understand, cybersecurity is a relatively new thing. Insurance policies available are probably nowhere near as sophisticated or all-encompassing as they will be in three or five years. [We] are constantly assessing the new policies because it’s not like E&O insurance, which is going on around 30, 40 years and everybody has figured out all the ways you can lose money.

The pricing of it is a little uncertain because there’s not enough history for the insurance company to figure out what their expenses are going to be.

Stringer: There may be exclusions they need to sharpen up.

Schwartz: Yes, and we don’t even know. We haven’t had enough of them to know, ‘We can get burned these 137 new ways.’ This is an evolving area of law and of protection and of insurance, which obviously you need to continue to monitor and try to protect yourself from.

Many advisors think that because they are good people, clients will never complain, they’ll never get these different things happening. Obviously, you try to educate them as to the risks, so that they are your eyes and ears, versus being oblivious to it. Let’s face it, they’re busy doing what they are doing. I wouldn’t be thinking about cybersecurity if we hadn’t had it happen. You can’t expect the advisor to. That’s what they’re paying us for, [so] that on these kind of issues, we’re ahead of the curve, educating them, making them our partners in it.

Client (Dis)Service

Dolber: There’s a service element when you create a client portal, but one suggestion would be, why not just give the client the choice of two-factor? If you don’t want to do it because it’s a management issue and it’s a resource issue, at least offer the client the choice of having two levels of authentication.

Even if you don’t have a portal, you can offer them the choice of two levels of authentication into Albridge or into Pershing or into TD, as an example.

Schwartz: For years, the whole thing about investor portals was to build them so they were single sign-on. That was the goal: ‘Okay, you sign into Cambridge, boom, you’re in.’ Then you go out of National and you come into Albridge, and there’s a new sign-in.

Dolber: We wouldn’t do that. We would use sign-in 2.0 across the board. What happens is the client would log into a portal and all of the authentication would be done there, and then they would [have a] single sign-on to any of the services they would use.

I would authenticate them through a client portal so I wouldn’t have to do two-factor at the individual places because I’ve already done it at the front end. But you might ask them if they want to turn on two levels of authentication on that way.

Schwartz: It’s an interesting idea. My gut would tell me that 98% of the rep clients would choose not to do that because they’ve never had [a cyberattack] happen, and they don’t know any friends who have had it happen, and [two-factor authentication] is a pain to go through.

Dolber: It is.

Schwartz: You get spoiled. I have sites I go to regularly, some of which are, ‘Remember my sign-in.’ Other ones, they ask me who my mother was, and if I ever go in with my iPad instead of my regular computer, there are three more questions.

Dolber: For God’s sake, in my own conference room, if my temp file gets blown out for any reason, I will go log in and it will be asking me for the code. I have to go get my iPhone because it’s being texted to me, and I have to put that in. It’s an inconvenience.

Schwartz: It’s the extinction level events that worry me. What’s going to put you out of business? That’s your first extinction level event. Even if it’s only a one out of 10,000 chance, you can’t do those.

Dolber: At the Pershing conference, they had an FBI agent there talking about it. First of all, the wholesalers got hit, and the department stores got hit. Then the banks got hit. Do you know who’s going to get hit? If these guys start looking at the independent broker-dealer model, they start looking at us and how we work, you are going to start seeing more cybersecurity attacks. It’s just going to be a matter of time.

Schwartz: Yes. They go where the biggest dollars are, where the most well-known companies are.

Green: Where the vulnerabilities are.

Schwartz: If we’re having 10 of these attacks a day, or a week, people will be going to triple sign-ons or whatever else very quickly.

Dolber: But I can give you an economic reason that offsets the cost. If you have a client portal, we can do certain things that we don’t do now. I can ask the client to opt out of receiving certain things like the privacy statement. If I do a client portal where I have a handshake with the client, I can ask them to opt out of paper.

So our thinking didn’t start with a portal for cybersecurity. It started because I wanted a way to opt out of the ADV mailing, to opt out of the privacy statement, to opt out of the three-year mailing, to opt out of the welcome letter. But if I do a handshake with the client, which is required, I can then deliver things to them electronically.

I asked my brokers, ‘Do you mind if I do that? Is that getting between you and your customer?’ They said ‘No.’ If all you are doing is asking them to opt out of receiving a copy of the privacy statement, or receiving the three-year letter when there is no activity, or getting the welcome letter that was sent, they don’t mind that.

Think about it. You know what you spend on paper? We’re spending over a quarter of a million dollars a year sending out the welcome letters, the privacy statement and the three-year, and the suitability and address change letters. We’re constantly sending letters to clients.

DeVito: We do both. Some are emails, some are letters.

Schwartz: We’re still doing mailing, but we basically have concluded that we need to do a mailing once a year anyway, so we basically just pile everything into one.

Stringer: That’s how we do it.

Schwartz:  We do have a program to get people to opt out of some of this stuff, but it is a constant effort. Even if you have the handshake, most of them ignore it and go right on to the next thing.

It seems almost a crime against nature at this point that we should be printing as much paper in this society that we are now in. Computers can print papers much faster than humans, so we actually use more paper than we did before we had that functionality.

It’s unfortunate that regulators make it so hard to get some of the stuff electronically, especially since many of the clients would prefer it. But it takes a lot of effort to get them all to sign up for it. The clearing firm started trying to encourage us to do more of these years ago because they started charging you for paper stuff that they didn’t charge for before.