Reputational damage: When fraud causes more than financial loss
Fraud doesn’t always mean a direct financial loss. It can cause reputational damage, which can negatively impact your business’s credibility. Learn more about the risks that can cause reputational damage so that you can be prepared to protect more than just your capital.
Three possible causes of reputation damage are identity theft, reputational risks, and data breaches. Let’s break down how these risks can impact your reputation:
Identity theft
While identity theft is always a risk to individuals, the risks increase for business owners. Bad actors can use a stolen identity to set up business trading accounts or pretend to be you at events or conferences. Such activity can complicate business relationships and partnerships. Identity thieves can even apply for loans by accessing your personal data, damage your business’s credibility with banks and making it more difficult to access the products you need when you need them.
The data most likely to be used includes credit card information and account numbers, identifying information about business owners, and account usernames and passwords. Much of this information is often already online, but sometimes fraudsters obtain it by physically stealing it.
Reputational risk
Reputational risk is a threat to the brand of your business that could cause reputational damage. These threats often arise due to an event that causes negative public perception or bad publicity. Examples can be as simple as poor reviews or a dissatisfied customer taking their issues to the media. It can also include events outside of your control. Perhaps a business you work with is caught in a scandal and you come under scrutiny due to your connection. Or a high-level employee accepts an interview with media and says something off-brand. These moments can capture the attention of customers and prospects and can impact your reputation for months after they occur.
Data breaches
Bad actors or hackers can access your database to steal your customers’ identities or threaten to release data to the public unless your business pays a ransom. No matter what, you are obligated to share the occurrence of a data breach with your customers, which can cause a loss of confidence in your business.
What can you do?
There are steps that you can take to decrease the risk of reputation damage happening at your business. These include:
Prevent identity theft
- Ensure your business has a privacy policy and that it is kept up to date.
- Ensure any personal information is securely stored and destroyed correctly when it is no longer needed.
- Use appropriate password controls and update passwords regularly.
Reduce reputational risk
- Create strong customer policies that are required training for any client-facing personnel. The stronger your customer service policies, the less likely to receive negative comments and reviews.
- Develop policies that ensure a consistent brand presence online and in the media. This can include policies for responding to interviews, policies on how to field comments on websites or social media channels, expectations for employees’ social media activity, tracking news published about you, and more.
- Identify PR firms or consultants who could understand your business, meet your budget, and could step in if any situations rise to the attention of media.
Protect against data breaches
- Ensure secure transfer of information, e.g. on a secure file transfer system, not via email.
- Create a clear cyber security plan to restore access to key services and data if they happen to be lost or frozen due to malware.
- Conduct exercises internally or with your IT provider to check that the recovery process will work as expected.
- Consider cyber risk insurance.
- Establish good password management, keep your IT systems up to date, understand the threats, and make sure you and your staff use 2-factor authentication to access critical information.
- Conduct a fraud audit and reduce the amount of information that is in the public domain.
- Build a fraud awareness system so that all employees are aware of the ever-changing fraud landscape. Make sure employees at all levels of the business know what to do if they are sent malicious links or receive suspicious phone calls that are seeking sensitive information.
Make sure that your staff and business partners are aware of the businesses' privacy obligations—privacy is everyone’s responsibility.
Worst-case scenario preparation
If the worst happens, the best you can do is be prepared to respond quickly.
- A crisis communication plan is essential. These can be sophisticated plans created with PR consultants, or it can be as simple as a list of potential risks with prepared response.
- Your fraud awareness system should include training on what to do if someone clicks on suspicious links or shares sensitive information so that response can begin immediately. IT partners and financial partners should always be informed as soon as possible to begin monitoring accounts and taking steps to minimize damage or loss.
- If you become a victim of identity theft, contact your local police department to file a police report. Contact all financial partners to work together on minimizing loss. It's a good idea to obtain a credit report to determine how much damage may have incurred, and continue to monitor your credit to ensure nothing changes in the next few months.
