MasterCard 2008 Annual Report Download - page 49

Account data breaches involving card data stored by us or third parties could adversely affect our
reputation and revenue.
We, our customers, and other third parties store cardholder account and other information in connection
with payment cards bearing our brands. In addition, our customers may sponsor third-party processors to process
transactions generated by cards carrying our brands. A breach of the systems on which sensitive cardholder data
and account information are stored could lead to fraudulent activity involving our cards, damage the reputation of
our brands and lead to claims against us. In 2007 and 2008, there were several high-profile account data
compromise events involving merchant systems that process and store information related to credit and debit
card transactions, which affected, and may potentially affect, millions of MasterCard, Visa, Discover and
American Express cardholders. As a result, we may be subject to lawsuits in connection with data security
breaches involving payment cards carrying our brands. If we are unsuccessful in defending lawsuits involving
such data security breaches, we may be forced to pay damages, which could materially and adversely affect our
profitability. In addition, any damage to our reputation or that of our brands resulting from an account data
breach could decrease the use and acceptance of our cards, which could have a material adverse impact on our
transaction volumes, revenue and future growth prospects, or increase our costs by leading to additional
regulatory burdens being imposed upon us.
An increase in fraudulent activity using our cards could lead to reputational damage to our brands and
could reduce the use and acceptance of our cards.
Criminals are using increasingly sophisticated methods to capture cardholder account information to engage
in illegal activities such as counterfeit, or other fraud. As outsourcing and specialization become a more
acceptable way of doing business in the payments industry, there are more third parties involved in processing
transactions using our cards. Increased fraud levels involving our cards could lead to regulatory intervention,
such as mandatory card re-issuance, adoption of new technologies or enhanced security requirements, and
damage to our reputation and financial damage to our brands, which could reduce the use and acceptance of our
cards or increase our compliance costs, and thereby have a material adverse impact on our business.
If we are not able to keep pace with the rapid technological developments in our industry to provide
customers, merchants and cardholders with new and innovative payment programs and services, the use of
our cards could decline, which would reduce our revenue and income.
The payment card industry is subject to rapid and significant technological changes, including continuing
developments of technologies in the areas of smart cards, radio frequency and proximity payment devices (such
as contactless cards), electronic commerce and mobile commerce, among others. We cannot predict the effect of
technological changes on our business. We rely in part on third parties, including some of our competitors and
potential competitors, for the development of and access to new technologies. We expect that new services and
technologies applicable to the payments industry will continue to emerge, and these new services and
technologies may be superior to, or render obsolete, the technologies we currently use in our card programs and
services. In addition, our ability to adopt new services and technologies that we develop may be inhibited by a
need for industry-wide standards, by resistance from customers or merchants to such changes or by intellectual
property rights of third parties. Our future success will depend, in part, on our ability to develop or adapt to
technological changes and evolving industry standards.
Adverse currency fluctuations and foreign exchange controls could decrease revenue we receive from our
international operations.
During 2008, approximately 52.8% of our revenue was generated from activities outside the United States.
Some of the revenue we generate outside the United States is subject to unpredictable and indeterminate
fluctuations if the values of other currencies change relative to the U.S. dollar. Resulting exchange gains and
losses are included in our net income. Our risk management activities provide protection with respect to adverse
39