How to manage risk by working collaboratively

In the afternoon of the last day of NRF PROTECT 2022, Christian Beckner, NRF’s vice president for retail technology and cybersecurity, gathered a group of senior technology executives for a brief, fast-paced discussion of some overarching themes of the conference. Joining him were Andrew McLean, executive vice president and chief commercial officer, American Eagle Outfitters; John Matas, head of fraud operations, Etsy; and Kevin Miller, vice president for information security and customer privacy, Tractor Supply Co.

The session, entitled “On the eve of disruption: Managing global risk with resilience and agility,” was designed to go to the heart of the value proposition of the conference, bringing together loss prevention, fraud and cybersecurity on a single stage to talk together about what they’re doing to protect their employees, their customers, their data and other assets — and ultimately to bring these activities together to address risk as a function and improve the bottom line.

A major factor in this bringing together of formerly diverse activities has been and continues to be the convergence of the online and in-store sales channels, which only accelerated during the COVID-19 pandemic. This has brought with it a threat convergence, in which fraudsters have taken advantage of omnichannel retailing by committing multichannel crimes.

“We pretty much doubled the size of our operation in that first quarter of 2020,” Matas said, “all based on COVID. We have teams in Brooklyn, Hudson, New York, Dublin and the Philippines. Getting the workforce that traditionally was in an office building to work from home, and be able to handle the volume of activity that comes from doubling the size of your organization — from a sales perspective, fraud went along with that.

“What was a fairly frictionless environment for fraud prior to COVID, post-COVID, the fraud really just exploded, mainly in the form of account security, account takeovers and a significant increase in non-human attacks. We were a fairly static workforce that was accustomed to dealing with X percent of transactions, and we were overwhelmed.”

"The truth is, if you get the right people in the room, you get that ingenuity and the ability to work our way around whatever it is."

Andrew McLean, American Eagle Outfitters

“It’s not just operational,” Miller said. “There’s an operational aspect to it — our tools can be used to help loss prevention, for instance, and vice versa — but there’s also a need to have long-term planning. We need to be on the same page in terms of what tools we’re going to deploy and what communications are in place to make sure information is always flowing between the teams.”

Throughout the conversation, a couple of key points kept surfacing. One was that the current risk environment — and, as far as anyone can tell, the future as well — is fluid and unpredictable. “We keep trying to script out all these plans,” McClean said, “but the plan’s dead at hello. It’s a question of understanding who you have to talk to and where the threat could come from. The truth is, if you get the right people in the room, you get that ingenuity and the ability to work our way around whatever it is.”

A second was that the size, unpredictability and lack of borders of the current threat environment make it not just an operational issue, but a business issue. The panelists agreed that the directors of large retail companies need to understand that the kinds of problems the panelists were discussing could affect a company’s margins and even viability.

“You have to do it right,” Matas said, noting that these leaders don’t have a lot of discretionary time. “They’re focused on profit and brand, not operations.”

A final area of agreement, at least judging from the panelists’ comments and the audience response, was that it had been a good idea for NRF to bring together all the different specialties and groups represented at this conference. “The investigators are fascinated by the digital data people and how they might help catch bad guys,” Matas said. “This new environment, where we’re all sort of on the same team now, just makes things so much easier.”