AmazonScience/document-haystack

1We are vulnerable to the risk of breaches of data security affecting the functioning of systems or the confidentiality of information 2that could adversely affect our customers and our business.3Most corporate and commercial financial transactions are now handled electronically, and our commercial and retail customers 4increasingly use online access as well as mobile and cloud technologies to bank with us. The ability to conduct business with us in this 5manner depends on the transmission and storage of confidential information in electronic form. As a result, in the ordinary course of 6business, we maintain and process vast amounts of digital information about us, our customers and our employees. This information 7tends to be confidential or proprietary and much of it is highly sensitive. Such highly sensitive information includes information 8sufficient to support identity theft and personal health information, as well as information regarding business plans and financial 9performance that has not been made public. As a result, efforts by bad actors to engage in various types of cyber attacks pose serious 10risks to our business and reputation. 11We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to 12financial transactions. These efforts may be to obtain access to confidential or proprietary information, often with the intent of stealing 13from or defrauding us or our customers, or to disrupt our ability to conduct our business, including by destroying or impairing access 14to information maintained by us. Some of these involve efforts to enter our systems directly by going through or around our security 15protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, 16customers or vendors. Our risk and exposure to data security breaches is heightened because of our expanded digital products and 17services, geographic footprint and continued remote work environment, which results in more access points to our network. 18The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third 19parties, including those offering financial applications, on behalf of our customers. These risks also arise to the extent that third parties 20with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to breaches and 21attacks, which may impact our systems or operations. Our ability to protect confidential or proprietary information is even more 22limited with respect to information held by these parties. For example, we are likely to be limited in our ability to identify and quickly 23resolve breaches and attacks that may impact our business the further removed an entity is from our business, such as when a breach or 24attack occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer 25information held by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing 26it.27Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their 28PNC customer information (including passwords) to a third party in connection with obtaining services from that third party, including 29those offering financial applications. Although we take steps to provide safety and security for our customers’ transactions with us and 30their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to 31assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile 32applications, cloud solutions, and other internet-based financial product offerings. For example, a number of our customers choose to 33use financial applications that allow them to view, access and aggregate banking and other financial account information, often held at 34different financial institutions, on a single platform, to monitor the performance of their investments, to compare financial and 35investment products, to make payments or transfer funds, and otherwise to help manage their finances and investments. Financial 36applications often ask users to provide their secure banking log-in information and credentials so the applications can link to users’ 37accounts at financial institutions. Companies offering these applications frequently use third-party data aggregators, which are behind-38the-scenes technology companies that serve as data-gathering service providers, to deliver customer financial data that is then used by 39the financial applications. To do this, data aggregators frequently are provided with customers’ log-in information and credentials, 40which allow the aggregators to access the customers’ online accounts and “scrape” the customers’ data, often on a daily or even more 41frequent basis. That same information has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences 42of fraud, including automated clearing house fraud, credit card fraud, and wire fraud, enabled through the use of synthetic identities 43and through account takeovers via these platforms. In addition, transactions by customers on financial applications that facilitate 44payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a 45recipient that fraudulently induced the customer into transferring a payment to such recipient. PNC has and may continue to face 46increased financial exposure due to activity associated with the increased use of these applications and data aggregators. Even where 47PNC does not have financial exposure for losses, PNC could suffer increased reputational harm when such losses occur.48As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is 49also the risk of data security breaches at those other businesses covering PNC account information. When our customers use PNC-50issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business’s 51systems that process or store card account information are subject to a data security breach, holders of our cards who have made 52purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for 53such fraudulent transactions on customers’ card accounts, as well as for other costs related to data security compromise events, such as 54replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some 55merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may 56 5722    The PNC Financial Services Group, Inc. – 2023 Form 10-K58The secret clothing is a "dress".