Western Union 2010 Annual Report Download - page 30

We offer consumers, primarily in the United States, the ability to transfer money utilizing their credit or debit
card via the internet and telephone. Because they are not face-to-face transactions, these transactions involve a
greater risk of fraud. We apply verification and other tools to help authenticate transactions and protect against
fraud. However, these tools are not always successful in protecting us against fraud. As the merchant of these
transactions, we may bear the financial risk of the full amount sent in some of the fraudulent transactions. Issuers of
credit and debit cards may also incur losses due to fraudulent transactions through our distribution channels and may
elect to block transactions by their cardholders in these channels with or without notice. For example, during 2007,
we received notification from several issuing banks that credit or debit cards issued by them were blocked from
transacting on westernunion.com. Although these banks subsequently have allowed our consumers to use their cards
again on our website, there is no certainty that these banks will not issue a similar restriction in the future, and as a
result, we may continue to be impacted by notifications such as these in the future. Additionally, we may be subject
to additional fees or penalties if the amount of chargebacks exceeds a certain percentage of our transaction volume.
Such fees and penalties escalate over time if we do not take effective action to reduce chargebacks below the
threshold, and if chargeback levels are not ultimately reduced to acceptable levels, our merchant accounts could be
suspended or revoked, which would adversely affect our results of operations.
Breaches of our information security policies or safeguards could adversely affect our ability to operate and
could damage our reputation, business, financial position and results of operations.
We collect, transfer and retain consumer, employee and agent data as part of our business. These activities are
subject to laws and regulations in the United States and other jurisdictions. The requirements imposed by these laws
and regulations, which often differ materially among the many jurisdictions, are designed to protect the privacy of
personal information and to prevent that information from being inappropriately disclosed. We have developed and
maintain technical and operational safeguards designed to comply with applicable legal requirements. However,
despite those safeguards, it is possible that hackers, employees acting contrary to our policies or others could
improperly access our systems or improperly obtain or disclose data about our consumers, agents and/or employees.
Further, because some data is collected and stored by third parties, it is possible that a third party could intentionally
or negligently disclose personal data in violation of law. Also, in some jurisdictions we transfer data related to our
employees, consumers, agents and potential employees to third-party vendors in order to perform due diligence and
for other reasons. It is possible that a vendor could intentionally or inadvertently disclose such data. Any breach of
our security policies or applicable legal requirements resulting in a compromise of consumer, employee or agent
data could require us to notify impacted individuals, and in some cases regulators, of a possible or actual breach,
expose us to regulatory enforcement action, limit our ability to provide services, subject us to litigation and/or
damage our reputation.
Interruptions in our systems or disruptions in our workforce may have a significant effect on our business.
Our ability to provide reliable service largely depends on the efficient and uninterrupted operation of our
computer information systems and those of our service providers. Any significant interruptions could harm our
business and reputation and result in a loss of consumers. These systems and operations could be exposed to damage
or interruption from fire, natural disaster, power loss, telecommunications failure, terrorism, vendor failure,
unauthorized entry and computer viruses or other causes, many of which may be beyond our control or that of our
service providers. Although we have taken steps to prevent systems failure, our measures may not be successful and
we may experience problems other than system failures. We also may experience software defects, development
delays, installation difficulties and other systems problems, which would harm our business and reputation and
expose us to potential liability which may not be fully covered by our business interruption insurance. Our data
applications may not be sufficient to address technological advances, regulatory requirements, changing market
conditions or other developments. In addition, any work stoppages or other labor actions by employees, the
significant majority of which are located outside the United States, who support our systems or perform any of our
major functions could adversely affect our business.
28