Western Union 2012 Annual Report Download - page 34

29
We offer consumers, primarily in the United States, the ability to transfer money utilizing their credit or debit card via the
Internet and phone. Because these are not face-to-face transactions, these transactions involve a greater risk of fraud. We apply
verification and other tools to help authenticate transactions and protect against fraud. However, these tools are not always successful
in protecting us against fraud. As the merchant of these transactions, we may bear the financial risk of the full amount sent in some
of the fraudulent transactions. Issuers of credit and debit cards may also incur losses due to fraudulent transactions through our
distribution channels and may elect to block transactions by their cardholders in these channels with or without notice. We may
be subject to additional fees or penalties if the amount of chargebacks exceeds a certain percentage of our transaction volume.
Such fees and penalties escalate over time if we do not take effective action to reduce chargebacks below the threshold, and if
chargeback levels are not ultimately reduced to acceptable levels, our merchant accounts could be suspended or revoked, which
would adversely affect our results of operations.
Breaches of our information security policies or safeguards could adversely affect our ability to operate and could damage our
reputation, business, financial condition and results of operations.
We collect, transfer and retain consumer, business, employee and agent data as part of our business. These activities are subject
to laws and regulations in the United States and other jurisdictions, see risk factor “Current and proposed regulation addressing
consumer privacy and data use and security could increase our costs of operations, which could adversely affect our operations,
results of operations and financial condition” below. The requirements imposed by these laws and regulations, which often differ
materially among the many jurisdictions, are designed to protect the privacy of personal information and to prevent that information
from being inappropriately used or disclosed. We have developed and maintain technical and operational safeguards designed to
comply with applicable legal requirements. However, despite those safeguards, it is possible that hackers, employees acting contrary
to our policies or others could improperly access our systems or improperly obtain or disclose data about our consumers, business
customers, agents and/or employees. Further, because some data is collected and stored by third parties, it is possible that a third
party could intentionally or negligently disclose personal data in violation of law. Also, in some jurisdictions we transfer data
related to our employees, business customers, consumers, agents and potential employees to third-party vendors in order to perform
due diligence and for other reasons. It is possible that a vendor could intentionally or inadvertently disclose such data. Any breach
of our security policies or applicable legal requirements resulting in a compromise of consumer, business, employee or agent data
could require us to notify impacted individuals, and in some cases regulators, of a possible or actual breach, expose us to regulatory
enforcement action, including fines, limit our ability to provide services, subject us to litigation and/or damage our reputation.
Interruptions in our systems or disruptions in our workforce may have a significant effect on our business.
Our ability to provide reliable service largely depends on the efficient and uninterrupted operation of our computer information
systems and those of our service providers. Any significant interruptions could harm our business and reputation and result in a
loss of consumers. These systems and operations could be exposed to damage or interruption from fire, natural disaster, power
loss, telecommunications failure, terrorism, vendor failure, unauthorized entry and computer viruses or other causes, many of
which may be beyond our control or that of our service providers. Further, from time to time, we have been the subject of cyber
attacks. These attacks are primarily aimed at interrupting our business or exploiting information security vulnerabilities. Historically,
none of these attacks or breaches has individually or in the aggregate resulted in any material liability to us or any material damage
to our reputation. Furthermore, disruptions related to cybersecurity have not caused any material disruption to the Company's
business, although there can be no assurance that a material breach will not occur in the future. Although we have taken steps to
prevent systems disruptions, our measures may not be successful and we may experience problems other than system disruptions.
We also may experience software defects, development delays, installation difficulties and other systems problems, which would
harm our business and reputation and expose us to potential liability which may not be fully covered by our business interruption
insurance. Our data applications may not be sufficient to address technological advances, regulatory requirements, changing market
conditions or other developments. In addition, any work stoppages or other labor actions by employees, the significant majority
of which are located outside the United States, could adversely affect our business.