Capital One 2012 Annual Report Download - page 45

conduct financial transactions and the increased sophistication and activities of organized crime, perpetrators of
fraud, hackers, terrorists, activists, formal and informal instrumentalities of foreign governments and other
external parties. As noted above, our operations rely on the secure processing, transmission and storage of
confidential information in our computer systems and networks. Our businesses rely on our digital technologies,
computer and email systems, software and networks to conduct their operations. In addition, to access our
products and services, our customers may use computers, smartphones, tablet PCs and other mobile devices that
are beyond our security control systems. Although we believe we have a robust suite of authentication and
layered information security controls, our technologies, systems, networks and our customers’ devices may
become the target of cyber-attacks or other attacks that could result in the unauthorized release, gathering,
monitoring, misuse, loss or destruction of our or our customers’ confidential, proprietary or other information,
including their access credential to accounts with online functionality, or that could result in disruptions to the
business operations of us or our customers or other third parties. For example, Capital One and other U.S.
financial services providers were targeted recently on several occasions with distributed denial-of-service attacks
from sophisticated third parties. On at least one occasion, these attacks successfully disrupted consumer online
banking services for a period of time. If these attacks are successful, or if customers are unable to access their
accounts online for other reasons, it could adversely impact our ability to service customer accounts or loans,
complete financial transactions for our customers or otherwise operate any of our businesses or services online.
In addition, a breach or attack affecting one of our third-party service providers or partners could impact us
through no fault of our own.
Because the methods and techniques employed by perpetrators of fraud and others to attack, disable, degrade or
sabotage platforms, systems and applications change frequently and often are not fully recognized or understood
until after they have been launched, we and our third-party service providers and partners may be unable to
anticipate certain attack methods in order to implement effective preventative measures. Should a cyber-attack
against us succeed on any material scale, market perception of the effectiveness of our security measures could
be harmed, and we could face the aforementioned risks. Though we have insurance against some cyber-risks and
attacks, it may not be sufficient to offset the impact of a material loss event.
The Growth Of Our Direct Banking Business Presents Certain Risks.
As a result of our strategic decisions and acquisition of ING Direct, we have grown our direct banking business
significantly over the past few years. Today, we operate the largest online direct banking institution in the U.S.,
with approximately $109 billion in deposits as of December 31, 2012. While direct banking represents a
significant opportunity to attract new customers that value greater and more flexible access to banking services at
reduced costs, it also presents significant risks. In addition to the software, infrastructure and cyber-attack risks
discussed above, we face risks related to direct banking, including:
• We face strong competition in the direct banking market. Aggressive pricing throughout the industry may
adversely affect the retention of existing balances and the cost-efficient acquisition of new deposit funds and
may affect our growth and profitability. In addition, the effects of a competitive environment may be
exacerbated by the flexibility of direct banking and the increasing financial and technological sophistication
of our customer base. We have transitioned from the “ING Direct” brand to a new brand, “Capital One
360,” which may not be readily accepted by customers, and these customers may not accept our branding,
image, name, reputation, policies or level of service or may be dissatisfied with perceived differences
regarding how they manage their online accounts after the transition, and as a result may transfer their
accounts and business to a competitor. Customers could also close their online accounts or reduce balances
or deposits in favor of products and services offered by competitors for other reasons. These shifts, which
could be rapid, could result from general dissatisfaction with our products or services, including concerns
over pricing, online security or our reputation.
Our direct banking business is dependent on our ability to process, record and monitor a large number of
complex transactions. If any of our financial, accounting, or other data processing systems fail or have other
26