PNC Financial (PNC) Risk Analysis

Most corporate and commercial financial transactions are now handled electronically, and our customers increasingly use online access as well as mobile and cloud technologies to access our products and services. The ability to conduct business with us in this manner depends on the gathering, maintenance, use, transmission and other processing of vast amounts of digital information in electronic form. As a result, in the ordinary course of business, we gather, maintain, use, transmit and otherwise process vast amounts of digital information about us, our customers and our employees. This information tends to be confidential or proprietary and much of it is highly sensitive and personal. Such confidential, proprietary, sensitive and personal information includes information sufficient to support identity theft and includes personal health information, as well as information regarding business plans and financial performance that has not been made public. As a result, efforts by bad actors to engage in various types of cyber attacks and breaches, including by way of computer viruses, hacking, ransomware and other malware, denial of service attacks, credential staffing, phishing, social engineering, account takeovers, insider threats and supply chain attacks pose serious risks to our business and reputation. We are faced with ongoing, nearly continual, efforts by others to breach data security at financial institutions or with respect to financial transactions. The effectiveness of these efforts may be enhanced using AI. These efforts may be to obtain access to confidential information, often with the intent of stealing from or defrauding us or our customers, or to disrupt our ability to conduct our business, including by destroying or impairing access to information gathered, maintained, used, transmitted or otherwise processed by us. Some of these involve efforts to enter our technology directly by going through or around our security protections. Others involve the use of social engineering schemes to gain access to confidential information from our employees, customers or vendors. The modernization of the payment systems, including near real-time movement solutions, increases the complexity of preventing and detecting these attacks and recovering fraudulent transactions. Our risk and exposure to cyber attacks and breaches is heightened because of our expanded digital products and services, geographic footprint and dispersed workforce, which results in more access points to our network. The same risks are presented by attacks potentially affecting information held by third parties on our behalf or accessed by third parties, including those offering financial applications, on behalf of our customers. These risks also arise when third parties with whom we do business, or their vendors or other entities with whom they do business, are themselves subject to cyber attacks and breaches, which has impacted our business and may do so in the future. Our ability to protect confidential information is even more limited with respect to such information gathered, maintained, used, transmitted or otherwise processed by these parties. For example, we are likely to be limited in our ability to identify and quickly resolve cyber attacks and breaches that may impact our business the further removed an entity is from our business, such as when a cyber attack or other data security breach occurs at vendors of our vendors. We may suffer reputational damage or legal liability for unauthorized access to customer information gathered, maintained, used, transmitted or otherwise processed by other parties, even if we were not responsible for preventing such access and had no reasonable way of preventing it. Our customers often use their own devices, such as computers, smartphones and tablets, to do business with us and may provide their customer information (including passwords and other confidential information) to a third party in connection with obtaining services from that third party, including those offering financial applications. Although we take steps to provide safety and security for our customers' transactions with us and their customer information, to the extent they utilize their own devices or provide third parties access to their accounts, our ability to assure such safety and security is necessarily limited. These risks are heightened as we and others continue to expand mobile applications, cloud solutions and other internet-based financial product offerings. For example, a number of our customers use financial applications to help manage their finances and investments, including through the aggregation of banking or other financial information that may require our customer to provide their secure banking credentials or account-identifying information to the financial application to aggregate this financial data. In some instances, third-party data aggregators are used by the financial application to access customers' accounts and obtain the customers' data and may be obtaining secure banking credentials or account-identifying information from our customers which has the potential to facilitate fraud if it is not properly protected. This has resulted in incidences of fraud, including automated clearing house fraud, credit card fraud and wire fraud, enabled through the use of synthetic identities and through account takeovers via these platforms. In addition, transactions by customers on financial applications that facilitate payments and fund transfers have also been fraudulently induced. These transactions occur when a customer authorizes payment to a recipient that fraudulently induced the customer into transferring a payment to such recipient. PNC has and may continue to face increased financial exposure due to activity associated with the increased use of these applications and data aggregators. Even where PNC does not have financial exposure for losses, PNC and the third parties with whom we do business could suffer increased reputational harm or regulatory scrutiny when such losses occur. As our customers regularly use PNC-issued credit and debit cards to pay for transactions with retailers and other businesses, there is also the risk of cyber attacks and other data security breaches at those other businesses covering PNC account information. When our customers use PNC-issued cards to make purchases from those businesses, card account information often is provided to such businesses. If a business's systems that gather, maintain, use, transmit and otherwise process card account information are subject to a cyber attack or other data security breach, holders of our cards who have made purchases from that business may experience fraud on their card accounts. We can be responsible for reimbursing our customers for such fraudulent transactions on customers' card accounts, as well as for other costs related to cyber attacks and breaches, such as replacing cards associated with compromised card accounts. In addition, we provide card transaction processing services to some merchant customers under agreements we have with payment networks such as Visa and Mastercard. Under these agreements, we may be responsible for certain losses and penalties if one of our merchant customers suffers a cyber attack or other data security breach. Moreover, to the extent more confidential information becomes available to bad actors through the cumulative effect of cyber attacks breaches at companies generally, bad actors may find it easier to use such information to gain access to our customer accounts. Other cyber attacks and data security breaches are not focused on gaining access to credit card or user credential information, but instead seek access to a range of other types of confidential information, such as internal emails and other forms of customer financial information, and this information may be used to support a ransomware attack. Ransomware attacks have sought to deny access to data and possibly shut down systems and devices maintained by target companies. In a ransomware attack, system data is encrypted, stolen or extorted, or access is otherwise denied, accompanied by a demand for ransom to restore access to the data or to prevent public disclosure of confidential information. Cyber attacks and data security breaches have also been conducted through business email compromise scams that involve using social engineering to cause employees to wire funds to the perpetrators in the mistaken belief that the requests were made by a company executive or established vendor. These types of phishing attacks have increased over time, and they have evolved to include other types of attacks like vishing (through voice messages) and smishing (through SMS text). Other cyber attacks and data security breaches have included distributed denial of service attacks, in which individuals or organizations flood commercial websites with extraordinarily high volumes of traffic with the goal of disrupting the ability of commercial enterprises to process transactions and possibly making their websites unavailable to customers for extended periods of time. Similarly, cyber attacks and breaches have been conducted through application program interfaces where bad actors seek to exploit the interfaces between mobile or web applications. We (as well as other financial services companies) have been subject to such cyber attacks and breaches. Recent cyber attacks and breaches have also included the insertion of malware into software updates and the infection of software while it is under assembly, known as a "supply chain attack." Cyber attacks and breaches affecting our customers may put these relationships at risk, particularly if customers' ability to continue operations is impaired due to the losses suffered. The techniques used in cyber attacks and breaches change rapidly and are increasingly sophisticated, including through the use of generative AI and deepfakes, and we expect in the future through the use of quantum computing, and we may not be able to anticipate cyber attacks or other data security breaches. Additionally, cyber attacks and breaches in some cases appear to be supported by foreign governments or other well-financed entities and often originate from less regulated and remote areas of the world. We have seen a higher volume and complexity of attacks during times of increased geopolitical tensions. In addition to threats from external sources, insider threats represent a significant risk to us. Insiders, including those having legitimate access to our information, communications systems and other technology and the information contained therein, have the easiest opportunity to make inappropriate use of their access. Addressing that risk requires understanding not only how to protect us from unauthorized use and disclosure of data, but also how to engage behavioral analytics and other tools to identify potential internal threats before any damage is done. As more work is conducted outside of PNC's facilities, the risk of improper access to PNC's network or confidential information has increased, including for reasons such as a failure by an employee or contractor to secure a device with PNC access. Cyber attacks and breaches often are not recognized until launched against a target and may go undetected for a period of time (or remain undetected), with the adverse consequences likely greater the longer it takes to discover the problem. As a result, we may be unable to implement adequate preventative measures to address these methods in advance of such cyber attacks and breaches. We have been and expect to continue to be the target of some of these types of cyber attacks and breaches. To date, none of these types of cyber attacks or other data security breaches has had a material impact on us. Nonetheless, we cannot entirely block efforts by bad actors to harm us, and there can be no assurance that future cyber attacks or other data security breaches will not be material. Attacks on others, some of which have led to serious adverse consequences, demonstrate the risks posed by new and evolving types of cyber attacks and breaches.