In 2022, advances in artificial intelligence captured our collective imaginations in unprecedented ways. Whether it was the artistic text-to-image renderings of <a href="https://openai.com/dall-e-2/" target="_blank" rel="noopener noreferrer">Dall-E2</a> shown in this blog post or in-depth conversations with <a href="https://openai.com/blog/chatgpt/" target="_blank" rel="noopener noreferrer">ChatGPT</a>, the implications of data advances in analysis, prediction, and generation became clearer than ever to the “non-techy” public. Last year, governments around the world raced to stay on top of data advances through various data governance approaches, such as <a href="https://www.dlapiperdataprotection.com/" target="_blank" rel="noopener noreferrer">data protection legislation</a>, or draft approaches to regulating AI including the <a href="https://www.whitehouse.gov/ostp/ai-bill-of-rights/" target="_blank" rel="noopener noreferrer">White House’s AI Bill of Rights</a> and the <a href="https://artificialintelligenceact.eu/" target="_blank" rel="noopener noreferrer">EU’s AI Act</a>. What has become very clear is that there is both tremendous excitement at the promise of these advances, as well as significant concern.

Several sessions at <a href="https://financialinclusionweek.org/" target="_blank" rel="noopener noreferrer">Financial Inclusion Week</a> (FIW) 2022 focused on data-driven advances in inclusive finance that grappled with the duality of exciting opportunity and concerning risk – particularly with regards to low-income and vulnerable consumers, like female-owned MSEs and migrants.
<h1>Data Opportunities</h1>
A few sessions shared how customer data is helping to shape product design for traditionally underserved consumers. The UN Capital Development Fund hosted a session on <a href="https://www.youtube.com/watch?v=g15noAC2vWU&amp;list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb&amp;index=5" target="_blank" rel="noopener noreferrer">Driving Women’s Financial Inclusion and Resilience</a>, with a focus on how consumer data, whether administrative or survey based, can drive innovative financial products for women. In this session, a speaker from <a href="https://imeremit.com.np/" target="_blank" rel="noopener noreferrer">IME Nepal</a> talked about how the company is leveraging remittance transaction data during COVID to better understand consumers and expand its digital offerings, including a wallet. UNCDF highlighted demand-side research that showed the challenges women face in onboarding to digital remittance services. My colleague <a href="https://www.centerforfinancialinclusion.org/bio/anindita-chakraborty">Anindita Chakraborty</a> contributed to the discussion with insights from CFI’s research on the difficulties <a href="https://www.centerforfinancialinclusion.org/research/covid-19-and-msmes-data-and-analysis-to-understand-impact">female-led MSEs</a> faced during the pandemic, and how that data should inform products to help MSEs be more resilient in future shocks.
<blockquote>Customer data is helping to shape product design for traditionally underserved consumers.</blockquote>
In addition to leveraging consumer data, looking at data on a larger scale can have significant benefits. In a <a href="https://www.youtube.com/watch?v=F0aZV-Zfzd0&amp;list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb&amp;index=5" target="_blank" rel="noopener noreferrer">short session by Principal Financial Group</a>, the Principal team shared the launch of the Global Financial Inclusion Index, a ranking of 42 markets based on what governments, financial systems, and businesses are doing to advance financial inclusion for their populations. This index aims to give investors insights into the strength and resilience of these markets.

Several fintechs and providers shared insights on their data-driven business models. A <a href="https://www.youtube.com/watch?v=WwecOBYOyi4&amp;list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb&amp;index=6" target="_blank" rel="noopener noreferrer">session</a> hosted by Korean fintech giant <a href="https://www.sentbe.com/" target="_blank" rel="noopener noreferrer">SentBe</a> presented how its cross-border money transfer services leverage data on traditionally underserved consumers – including migrants from Bangladesh and Cambodia working in Korea – to provide customer-centric receipt options. Senegalese fintech <a href="https://www.lebfay.com/" target="_blank" rel="noopener noreferrer">LebFay</a> presented <a href="https://www.youtube.com/watch?v=DA8wqNKl2f4&amp;list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb&amp;index=7" target="_blank" rel="noopener noreferrer">its business model</a> that uses an app and artificial intelligence-driven scoring model to lend to traditionally underserved MSEs and tradesmen. And, <a href="http://imbita.org/" target="_blank" rel="noopener noreferrer">Imbita Swaziland Women’s Finance Trust</a> spoke about the digitalization journey in offering its savings and credit cooperative society (SACCO) members a USSD-based platform to save, borrow, and make mobile payments.
<h1>Data Risks</h1>
<blockquote class="pullquote--right">Challenges, including privacy, bias, and other human rights issues, can stem from the exponential growth of digital lending.</blockquote>
At the same time, several sessions highlighted the risks around data-driven innovation and what inclusive finance stakeholders need to do about it. <a href="https://aapti.in/" target="_blank" rel="noopener noreferrer">Aapti Institute</a>, an India-based think-tank that conducts research at the intersection of technology and digital rights, hosted a session <a href="https://www.youtube.com/watch?v=lXLY7BsG_fg&amp;list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb&amp;index=3" target="_blank" rel="noopener noreferrer">on AI and Financial Inclusion</a>, discussing risks and opportunities for risk mitigation with representatives from <a href="https://www.dvara.com/research/" target="_blank" rel="noopener noreferrer">Dvara</a>, <a href="https://rbihub.in/" target="_blank" rel="noopener noreferrer">RBI Innovation Hub</a>, and <a href="https://www.undp.org/india" target="_blank" rel="noopener noreferrer">UNDP</a>. This session raised challenges, including privacy, bias, and other human rights issues, that could stem from the exponential growth of <a href="https://www.centerforfinancialinclusion.org/digital-credit-algorithms-in-india-expanding-access-or-cementing-exclusion">digital lending in India</a>. I was honored to moderate a session on the <a href="https://www.youtube.com/watch?v=J0QaPM6sDDk&amp;list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb&amp;index=2" target="_blank" rel="noopener noreferrer">Potential of Privacy by Design for Inclusive Finance</a> with inputs from <a href="https://www.paypal.com/us/home" target="_blank" rel="noopener noreferrer">PayPal</a>, <a href="https://foundation.mozilla.org/en/" target="_blank" rel="noopener noreferrer">Mozilla Foundation</a>, and the <a href="https://www.dlak.co.ke/" target="_blank" rel="noopener noreferrer">Digital Financial Services Association of Kenya</a>. Representatives from PayPal and Mozilla discussed how Privacy by Design has been implemented in their business models, and Kevin Mutiso of DFSAK shared how startup fintechs can integrate and benefit from strong privacy practices.
<h1>Looking Ahead</h1>
As we look ahead to 2023, CFI will be monitoring how advances in AI are integrated into the inclusive finance space. Will there be chatbots or financial capability curricula that use ChatGPT? We’ll also be watching for countries to codify the use of AI and enforce data protection legislation. With so much happening in this space at the moment, there is a lot to pay attention to as we continue to grapple with the duality of data opportunities and risks.

View the full <a href="https://www.youtube.com/playlist?list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb" target="_blank" rel="noopener noreferrer">Data Risks &amp; Opportunities</a> Playlist from FIW 2022.

Financial Inclusion Week 2022 had over 3,300 registered participants from 2,000 organizations across 148 countries. With almost 400 speakers and 125 sessions, FIW 2022 was the largest event to date. All sessions from FIW 2022 can be viewed here.

And be sure to save the date for FIW 2023 which will take place October 16-19, 2023.

FIW Recap: Grappling with Data Opportunities and Risks in Inclusive Finance

Privacy choices are inherently <a href="https://www.ariewaldman.com/book-industry-unbound" target="_blank" rel="noopener noreferrer">contextual</a>, and individuals make different privacy calculi from one situation to another, deciding each time what and how much to share. The boundaries we negotiate depend on our expectations of what will happen to our information in each situation and how much we trust the recipient. For instance, you probably wouldn’t share the same information about your financial status with an acquaintance at work as you would with your tax advisor.
<blockquote class="pullquote--right">Negotiating privacy boundaries in the digital world, including inclusive finance, has become increasingly difficult.</blockquote>
The trouble is that negotiating privacy boundaries in the digital world, including inclusive finance, has become increasingly difficult. <a href="https://www.ipsos.com/en-us/news-polls/trust-in-the-internet-2022" target="_blank" rel="noopener noreferrer">Trust in digital providers</a> has dropped amidst well-documented data breaches and abuses. Trust is also challenged by consumers’ <a href="https://www.youtube.com/watch?v=lXLY7BsG_fg&amp;list=PL30fMMRd3G_4MWcg0tioe63vFk1WA8Clb&amp;index=3" target="_blank" rel="noopener noreferrer">surprise</a> over what data is collected about them. CFI’s <a href="https://www.centerforfinancialinclusion.org/trust-of-data-usage-sources-and-decisioning-perspectives-from-rwandan-mobile-money-users">research in Rwanda</a> found that mobile money users who had applied for digital credit were upset that inputs such as airtime top-ups might be used as part of the underwriting process.

All of this is why, in honor of Data Privacy Week, which is celebrated every year in late January, we’re calling for the inclusive finance field to rethink privacy – specifically to shift it to the left.  Shifting privacy left means bringing up privacy considerations early on in the product lifecycle and paying attention to privacy concerns from the outset, rather than just a final box to check for compliance once a product is already created.
<h1><strong>Focus on Privacy by Design</strong></h1>
One of the ways that people are rethinking privacy in inclusive finance is through an approach called Privacy by Design (PbD). The premise behind PbD is that because privacy is a core property of an IT system, it should influence the underlying system design, rather than be bolted on as an afterthought. In PbD, privacy considerations must therefore start at the ideation phase and be maintained throughout the product lifecycle. This stands in contrast to the compliance-driven approach that typically brings privacy into the discussion after all major design decisions have been made. Popularized by Dr. Ann Cavoukian in 2009, Privacy by Design is most notably mentioned in <a href="https://gdpr-info.eu/art-25-gdpr/" target="_blank" rel="noopener noreferrer">Article 25 in the GDPR</a>.

Despite enthusiasm for the approach and privacy as a value-proposition to consumers, there are limited resources to operationalize Privacy by Design, particularly for organizations like inclusive finance fintechs operating in emerging markets and serving low-income consumers. Last year, CFI conducted a literature review to better understand how PbD has been implemented and its potential for inclusive finance. The results, shared in a report entitled <a href="https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2022/12/Potential-of-Privacy-by-Design-in-Inclusive-Finance-3.pdf">Embedding Trust: The Potential of Privacy by Design in Inclusive Finance</a>, landscape the various approaches to PbD in the legal, engineering, UX/UI, and academic fields. While each of the approaches, <span class="ui-provider wc b c d e f g h i j k l m n o p q r s t u v w x y z ab ac ae af ag ah ai aj ak" dir="ltr">outlined in the graphic below, </span>provided valuable tools, there were few examples of holistic approaches that product teams could use to embed privacy throughout the design and development processes.

<img class="wp-image-45694 aligncenter" src="https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2023/02/Screenshot-2023-02-02-at-9.19.21-AM.png" alt="" width="904" height="570" />

&nbsp;

CFI believes that five key considerations should guide any applications of PbD in inclusive finance:
<h3><strong>1. PbD should be positioned as business-enhancing.
</strong></h3>
Because privacy has historically been seen as a compliance-related cost, to encourage private companies and fintechs to employ PbD techniques, PbD needs to be presented as a business-enhancing design benefit.
<h3><strong>2. PbD needs to be adapted to work for resource-constrained companies and emerging markets. </strong></h3>
Because PbD has been developed and largely implemented in developed countries, little work has been done to date to make PbD approachable and operational outside of those contexts.
<h3><strong>3. PbD should incorporate low-income and vulnerable consumers’ offline privacy needs in addition to privacy for their digital data.</strong></h3>
In considering the user and his/her privacy capacities and needs, PbD can bring customer-centricity into the data-intensive aspects of digital financial products.
<h3><strong>4. PbD must balance consumer privacy preferences with companies’ needs.</strong></h3>
When implementing PbD, it will be important to consider both the information that companies must collect to be able to perform their work, as well as the privacy preferences of consumers. A balance must be found to ensure that a product will function without compromising consumer privacy.
<h3><strong>5. PbD must articulate privacy responsibilities across disaggregated value chain and partnerships.</strong></h3>
Consumer data can sit and be shared across multiple organizations in today’s modularized fintech ecosystem, and not all actors in the value chain have equal power and influence.

&nbsp;

Moving forward, CFI is working to create a PbD playbook for fintech product teams to embed and position privacy as a core value proposition to consumers. The playbook aims to help product managers – in their role of facilitating product development by technical staff (data scientists, engineers, UX/UI, etc.) -- define the user journey and set metrics for product success, and ultimately present a strong opportunity to embed privacy. While product teams are key to executing Privacy by Design, a fintech’s executives and leadership must also recognize the business value of investing in privacy for it to succeed. Similarly, investors and funders need to prioritize privacy and realize the value of embedding privacy into design from the outset, not only because it is the right thing to do for consumers, but also because it is increasingly important to their bottom lines. By increasing awareness of Privacy by Design in the inclusive finance space, we can make strides in ensuring that consumers are protected and help build trust in digital finance.

In Honor of Data Privacy Week, Let’s Rethink Privacy in Inclusive Finance

The pandemic <a href="https://www.worldbank.org/en/news/press-release/2022/06/29/covid-19-drives-global-surge-in-use-of-digital-payments" target="_blank" rel="noopener noreferrer">accelerated the adoption of digital financial services</a>, especially in emerging economies, largely due to the number of people who <a href="https://www.un.org/sustainabledevelopment/blog/2021/12/as-internet-user-numbers-swell-due-to-pandemic-un-forum-discusses-measures-to-improve-safety-of-cyberspace/" target="_blank" rel="noopener noreferrer">began using the internet for the first time</a>. The <a href="https://www.worldbank.org/en/publication/globalfindex" target="_blank" rel="noopener noreferrer">Global Findex 2021</a> found that of the adults in developing countries who paid utility bills directly from an account, one-third did so for the first time during the pandemic. In India, more than 80 million adults made their <a href="https://www.worldbank.org/en/news/press-release/2022/06/29/covid-19-drives-global-surge-in-use-of-digital-payments" target="_blank" rel="noopener noreferrer">first digital merchant payment</a> after the start of the pandemic; in China, over 100 million adults did the same. However, the Findex 2021 data also showed a rise in consumer protection risks and cautioned that less experienced financial consumers were more vulnerable to such risks.

As digital financial services proliferate, new risks emerge. One of these risks is known as <a href="https://www.deceptive.design/" target="_blank" rel="noopener noreferrer">deceptive designs</a>, which are tricks used by companies when designing user interfaces that have the effect – either deliberately or otherwise – of obscuring, subverting, or impairing consumer autonomy, decision making, or choice. In other words, deceptive designs are used to manipulate people into making decisions that may not be in their best interest. Deceptive design is all around us and is increasing with rapid digitalization.

Those most vulnerable to deceptive designs are consumers with low digital capability, low financial means, or are those who are vulnerable because of life events or mental health issues. The use of deceptive designs in financial services, especially when catering to low-income and vulnerable consumers, can cause harm such as loss of agency and risks of data privacy, and can extend to financial losses that increase vulnerabilities and erode trust in the usage of digital financial services.

While the implications of deceptive designs on user privacy and data protection are beginning to be discussed among regulators, consumer protection concerns have yet to be addressed. This is partly because design is hard to regulate, and manipulative design can exploit existing laws and legal loopholes.
<h1>Deceptive Design Patterns Are Ubiquitous</h1>
In the last week, how often have you used an app on your smartphone or a website to order groceries? To shop for clothes? Or logged in to read online news? Chances are at least once. It is also likely that you encountered several deceptive designs during that time. Harry Brignull, who raised awareness of deceptive design, features nearly <a href="https://www.deceptive.design/hall-of-shame/all" target="_blank" rel="noopener noreferrer">400 examples of deceptive design practices</a> on his website. The New York Times, a publication that was one of the earliest to speak about deceptive designs, uses deceptive designs to make their paywall “smarter” and <a href="https://www.techdirt.com/2022/08/19/when-tech-companies-do-it-the-ny-times-calls-it-dark-patterns-when-the-ny-times-does-it-its-called-being-smart/" target="_blank" rel="noopener noreferrer">make it difficult to cancel subscriptions</a>.

In Kenya and Tanzania, <a href="https://www.cgap.org/sites/default/files/Focus-Note-Consumer-Protection-in-digital-Credit-Aug-2017.pdf" target="_blank" rel="noopener noreferrer">CGAP’s research</a> found several challenges with how digital lenders disclose actual pricing to consumers, using monthly or weekly interest rate figures instead of a standardized calculation like an annualized percentage rate (APR). <a href="https://wiredspace.wits.ac.za/server/api/core/bitstreams/d6e32783-24e7-4e50-8bcf-8c58f84bd872/content" target="_blank" rel="noopener noreferrer">Research by Mazer and Rowan (2016)</a> also found that some digital lenders only disclosed the price after consumers clicked the “I accept” button and the loan was executed. Insurance, a financial product that often is accused of mis-sale, can also use deceptive designs when sold online. In the UK, Currys, a well-known retailer, <a href="https://twitter.com/darkpatterns/status/1561031067334844418" target="_blank" rel="noopener noreferrer">nudges online shoppers during check out</a> by preventing them from moving forward unless they choose to buy insurance. In India, until laws changed recently to prevent the mis-sale of travel insurance, it was common to see travel portals use <a href="http://rsrr.in/wp-content/uploads/2021/04/UNPACKING-DARK-PATTERNS-UNDERSTANDING-DARK.pdf" target="_blank" rel="noopener noreferrer">pre-checked buttons to bundle travel insurance</a> with ticket purchase.
<h1>Focus on Consumer Protection by Design</h1>
The nature of these emergent risks requires new partners to work together – including designers, researchers, technologists, civil society actors, and lawyers who work on consumer rights, along with regulators, supervisors, investors, financial service providers, and tech-based providers. To kick off this work, CFI and <a href="https://www.credit-suisse.com/us/en.html" target="_blank" rel="noopener noreferrer">Credit Suisse</a> are partnering to leverage the diverse talent and expertise of Credit Suisse employees through the Innovation for Impact series, a spinoff of the bank’s <a href="https://www.credit-suisse.com/careers-news/en/articles/careers/spark-ideas-explore-new-trails-202012.html" target="_blank" rel="noopener noreferrer">Future of Banking Hackathon</a>. Applying Credit Suisse’s Fresh Perspectives! Framework, the bank’s innovation lifecycle approach, teams of Credit Suisse employees will be guided through addressing the challenges that low-income consumers can face from the use of deceptive designs in financial services. The teams will work together to generate novel ideas, and rapidly test, learn, and adapt their solutions to address the presented challenges.

Through its <a href="https://www.credit-suisse.com/about-us/en/our-company/corporate-responsibility/economy-society/financial-inclusion.html" target="_blank" rel="noopener noreferrer">Financial Inclusion Initiative</a> (FII), Credit Suisse has partnered with Accion for over a decade, including as a founding supporter of CFI. Through the FII, Credit Suisse aims to support the availability of innovative and financially inclusive solutions to help advance progress towards the UN Sustainable Development Goals (SDGs) by providing both financial as well as human resources. The Innovation for Impact series provides a win-win opportunity for Credit Suisse employees to leverage and develop their expertise and innovation capabilities while at the same time contributing to an important challenge facing the inclusive finance sector.

The partnership between Credit Suisse and CFI is a way to begin generating awareness of deceptive designs with investors and financial service providers, and the harms they can cause to low-income consumers. The work on deceptive designs is part of a larger body of work that CFI is developing that looks at how to embed consumer protection by design for systemic change to create digital, inclusive financial systems that are more equitable, less discriminatory, and more empowering.

CFI is launching a strategic area of work around ‘Consumer Protection by Design’ to identify and address newer risks that emerge as inclusive finance is digitalized. This area of work will define the term consumer protection by design, identify newer risks (including deceptive designs), and assess whether these risks tend to be prevalent in specific geographies, industries, and company stages, and if they target specific user groups that are more susceptible. CFI will also conduct a landscape analysis of the specific harms posed to vulnerable consumers with a focus on identifying market monitoring tools and regulatory solutions that can be used to mitigate these harms.

The Hidden Traps of Deceptive Design: Embedding Consumer Protection into DFS

India’s fintech lending industry has grown rapidly since 2014, with the evolution of new models and approaches to lending. This rapid growth offers the potential for many upsides in the form of <a href="https://www.cgap.org/blog/indian-start-for-digital-credit" target="_blank" rel="noopener noreferrer">easier access to much needed credit and including hitherto excluded consumer segments</a> who may not have the ability to prove their ‘creditworthiness’. In India, as in other parts of the world, the growth in digital lending has been accompanied by a variety of risks. Some of these risks – such as over-indebtedness, poor market practices of aggressive marketing and collection, and pricing – have long been associated with lenders and need to be addressed as a market conduct issue. However, the digital nature of fintech lending poses several new risks that, combined with traditionally known risks, create an environment of poor consumer outcomes and mistrust of the industry.
<h1><strong>Fintech Risk Barometer Study</strong></h1>
While there has been extensive media coverage around several of the fintech lending risks, these cases tend to be anecdotal and do not provide a sense of which risks are highest priority as the industry evolves. To better understand the multitude of risks the Indian fintech lending industry faces, the <a href="https://faceofindia.org/" target="_blank" rel="noopener noreferrer">Fintech Association for Consumer Empowerment</a> (FACE) and CFI partnered to conduct a risk barometer study. The resulting <a href="https://www.centerforfinancialinclusion.org/fintech-lending-risk-barometer-2022-2023">fintech lending barometer report</a> is the first attempt at identifying how risks are perceived by various stakeholders associated with the fintech lending industry in India and is a crucial first step to documenting how risks evolve.

For fintech lenders, this report presents an opportunity to understand the landscape, identify the opportunities and dangers, and plan or correct their course of action. For regulators, supervisors, and policymakers, the survey findings signal what areas within the Indian fintech industry need to be more closely examined and addressed with urgency.

The fintech lending barometer study followed a mixed methods approach. First, a survey was used to gather initial perceptions of risks, which then was followed by a series of qualitative interviews with select respondents to further understand how emerging risks impact consumer lives. For each risk, the survey asked participants to rank 23 risks on a scale of 1-7, with one being the lowest severity risk and seven being the highest. The survey also captured comments and feedback from survey participants on these risks and the top three opportunities.

<em>Top 10 Risks Identified by Survey Respondents</em>

<img class="alignnone wp-image-45643" src="https://content.centerforfinancialinclusion.org/wp-content/uploads/sites/2/2023/01/Screenshot-2023-01-13-at-2.02.11-PM.png" alt="" width="666" height="775" />

The top three risks identified were unscrupulous fintech lenders, rising cyber fraud and crime, and issues around data privacy. The report is being released at the <a href="https://inclusivefinanceindia.org/" target="_blank" rel="noopener noreferrer">Inclusive Finance India Forum 2023</a> and can be accessed <a href="https://www.centerforfinancialinclusion.org/fintech-lending-risk-barometer-2022-2023">here</a>.
<h1><strong>Consumer Protection Implications</strong></h1>
<blockquote class="pullquote--right">Industry associations have an inherent advantage in gathering early insights on consumer complaints and experiences from their members and in getting inputs on market trends.</blockquote>
Kate McKee, former senior policy advisor at CGAP, who pioneered thinking on consumer protection for inclusive finance, often referred to the three legs of the ‘<a href="https://www.mfw4a.org/sites/default/files/resources/Kate_McKee_english.pdf" target="_blank" rel="noopener noreferrer">consumer protection stool’</a> –  regulation, market monitoring and self-regulation, and building consumer awareness – where each of the three legs must be stable in order to responsibly and reliably provide for consumers. While the Reserve Bank of India has been proactive as a regulator in issuing guidelines on digital lending, there is a role to be played by industry associations like FACE and others in enabling market monitoring. Industry associations have an inherent advantage in gathering early insights on consumer complaints and experiences from their members and in getting inputs on market trends. For instance, they may hear about specific instances of fraud from their members which can erode the reputation of the industry in general. This provides associations with a unique opportunity to identify emerging risks and either escalate them to supervisors or establish responsible market conduct. This in turn can boost trust in businesses and offer long term value. For supervisors, this interaction with industry associations can help them stay abreast of market developments and assists with considerations for investing in appropriate suptech tools depending on the nature of risk identified.

A host of market monitoring tools exist and several are summarized in <a href="https://www.cgap.org/topics/collections/market-monitoring-tools" target="_blank" rel="noopener noreferrer">this toolkit</a> by CGAP. However, effective market conduct supervision depends on timely identification of market risks and reviewing how these risks evolve with market growth. CFI’s consumer protection strategy focuses on strengthening market conduct supervision by researching emerging risks and working with partners who can elevate these risks to supervisors. This partnership with FACE is a step towards this goal and offers insights for industry associations of digital lenders in other markets.

Matters of Urgency: Insights From a Fintech Risk Barometer Study

Consumer privacy risks have proliferated in the last decade in parallel with the increased adoption of digital technologies and the availability of consumer data. The great onboarding onto digital finance necessitated by COVID-19 also opened up vulnerable consumers to data misuse through scams in markets like the Philippines, Kenya, and India, among many others. Privacy violations can also have serious long-term consequences for financial inclusion and, even as access has improved, trust remains a critical ingredient in translating that progress into sustainable gains for consumers.

Evidence shows that when consumers fall prey to privacy-related harms, the loss of trust dissuades them from the opportunities afforded by digital finance. Privacy implications not only affect consumers but also impact businesses. While compliance with new data protection regulations has brought stronger safeguards, the rapid speed at which consumer data is collected, used, and shared in digital finance has far outpaced consumers’ understanding. For low-income digital financial consumers, the limits of informed consent and choice are even starker.

This report is intended to be an introduction to Privacy by Design (PbD) and to review the main PbD approaches in literature and wider market practice for their potential applications in the inclusive finance sector. The analysis is based on a literature review and key informant interviews with privacy and inclusive finance experts conducted by the Center for Financial Inclusion (CFI) between May and August 2022. The paper groups findings into four approaches to PbD, each of which attempts to embed privacy through different means, often by combining various tools, methods, and areas of application. The paper also identifies a series of gaps and barriers that limit the potential of PbD, particularly in emerging markets and developing economies. The report closes with considerations for the adaption of PbD for fintechs working with low-income and vulnerable consumers. CFI aims to build off this initial report to develop practical guidance on PbD for fintech product teams.

Embedding Trust: The Potential of Privacy by Design for Inclusive Finance

Privacy Perceptions, Attitudes, and Behaviors: Perspectives from Indonesian Smartphone Users

<em><span class="TextRun SCXW233993774 BCX0" lang="EN-US" xml:lang="EN-US" data-contrast="auto"><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun" data-ccp-charstyle-defn="{&quot;ObjectId&quot;:&quot;8eed487e-3b20-4552-bee3-737de11680fa|42&quot;,&quot;ClassId&quot;:1073872969,&quot;Properties&quot;:[469775450,&quot;normaltextrun&quot;,201340122,&quot;1&quot;,134233614,&quot;true&quot;,469778129,&quot;normaltextrun&quot;,335572020,&quot;1&quot;,469778324,&quot;Default Paragraph Font&quot;]}">In honor of</span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun"> International Women’s Day 2022</span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun"> and </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">this year’s</span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun"> IWD theme of </span></span><a class="Hyperlink SCXW233993774 BCX0" href="https://www.internationalwomensday.com/" target="_blank" rel="noreferrer noopener"><span class="TextRun Underlined SCXW233993774 BCX0" lang="EN-US" xml:lang="EN-US" data-contrast="none"><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="Hyperlink">#Break</span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="Hyperlink">T</span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="Hyperlink">heBias</span></span></a><span class="TextRun SCXW233993774 BCX0" lang="EN-US" xml:lang="EN-US" data-contrast="auto"><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">, </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">CFI is </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">focused on shedding light on the </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">biases that hinder the advancement of <a href="https://www.centerforfinancialinclusion.org/research/womens-financial-inclusion">women’s financial inclusion</a>.</span> <span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">CFI applies a gender lens across all </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">its</span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun"> research, </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">working to </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">understand and address </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">barriers to </span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">women’s financial inclusion and economic empowerment</span><span class="NormalTextRun SCXW233993774 BCX0" data-ccp-charstyle="normaltextrun">.</span></span></em>
<h2><b><span data-contrast="auto">Online Safety and Security Risks Present Barriers for Women’s Financial Inclusion</span></b></h2>
<span data-contrast="auto">Although the pandemic has </span><a href="https://www.centerforfinancialinclusion.org/yes-covid-is-the-big-bang-of-digital-payments"><span data-contrast="none">accelerated the use of digital financial services</span></a><span data-contrast="auto"> and mobile phones provided opportunities to pivot businesses, stay connected, and continue working, </span><a href="https://www.gsma.com/r/wp-content/uploads/2021/06/The-Mobile-Gender-Gap-Report-2021.pdf" target="_blank" rel="noopener noreferrer"><span data-contrast="none">mobile ownership remained flat</span></a><span data-contrast="auto"> among women in low- and middle-income countries during COVID. As we look to make progress on women’s financial inclusion, we must also look at what is needed to help women feel safe and able to use mobile financial services.</span><span data-ccp-props="{&quot;134233117&quot;:true,&quot;134233118&quot;:true,&quot;201341983&quot;:0,&quot;335559740&quot;:240}"> </span>

<span data-contrast="auto">Safety and security are crucial components for online gender equity. And are a necessary and first step to using digital financial services. The </span><a href="https://www.gsma.com/r/wp-content/uploads/2021/06/The-Mobile-Gender-Gap-Report-2021.pdf" target="_blank" rel="noopener noreferrer"><span data-contrast="none">GSMA Mobile Gender Gap Report 2021</span></a><span data-contrast="auto"> reported safety and security in accessing mobile internet as the third barrier to women’s mobile internet access, behind literacy and affordability. As digital financial services become commonplace, ensuring safe and secure online spaces is a crucial first step towards inclusive finance for women. However, safety and security risks present barriers to mobile adoption for many women, ultimately impeding women’s access to and trust in mobile financial services.</span>
<h2><span class="TextRun MacChromeBold SCXW68164729 BCX0" lang="EN-US" xml:lang="EN-US" data-contrast="auto"><span class="NormalTextRun SCXW68164729 BCX0" data-ccp-charstyle="normaltextrun" data-ccp-charstyle-defn="{&quot;ObjectId&quot;:&quot;8eed487e-3b20-4552-bee3-737de11680fa|42&quot;,&quot;ClassId&quot;:1073872969,&quot;Properties&quot;:[469775450,&quot;normaltextrun&quot;,201340122,&quot;1&quot;,134233614,&quot;true&quot;,469778129,&quot;normaltextrun&quot;,335572020,&quot;1&quot;,469778324,&quot;Default Paragraph Font&quot;]}">Why </span><span class="NormalTextRun SCXW68164729 BCX0" data-ccp-charstyle="normaltextrun">Digital Safety and Security Are Especially </span><span class="NormalTextRun SCXW68164729 BCX0" data-ccp-charstyle="normaltextrun">Concerning</span><span class="NormalTextRun SCXW68164729 BCX0" data-ccp-charstyle="normaltextrun"> for Women</span></span></h2>
<span data-contrast="auto">While there are risks to online environments that can make anyone – man or woman – feel unsafe, it is important to understand that these risks can often be heightened for women. </span><a href="https://pollicy.org/resource/alternate-realities-alternate-internets-feminist-research-for-a-feminist-internet/" target="_blank" rel="noopener noreferrer"><span data-contrast="none">Online environments</span></a><span data-contrast="auto"> can mimic and exacerbate risks in the physical environment that stem from offline gender norms and discrimination against women. The internet poses numerous risks – ranging from a higher potential for fraud, surveillance, and identity theft, to targeted violence, misuse of personal images and data, and sharing inappropriate content or behavior. The fear of being unable to cope with any of these – combined with the lack of redressal options and the absence of affordable legal recourse mechanisms – can lead to feeling unsafe.</span>
<blockquote class="pullquote--right"><span data-contrast="none">Online environments</span><span data-contrast="auto"> can mimic and exacerbate risks in the physical environment that stem from offline gender norms and discrimination against women.</span></blockquote>
<a href="https://gh.bmj.com/content/6/Suppl_5/e005596" target="_blank" rel="noopener noreferrer"><span data-contrast="none">Cultural norms and ideologies</span></a> <span data-contrast="auto">that limit women’s freedom of movement often translate into restrictions in accessing the internet, or even having access to a mobile phone. </span><a href="https://dai-global-digital.com/cybersecurity-frontier-insights-findings-user-perceptions-of-trust-and-privacy-on-the-internet.html" target="_blank" rel="noopener noreferrer"><span data-contrast="none">Others face consequences, or social censure from having an online presence</span></a><span data-contrast="auto"> reinforcing norms experienced in the real world. These barriers shape women’s online behavior and create significant obstacles for usage, exacerbating the mobile gender gap.</span>

<span data-contrast="auto">In addition to mimicking and exacerbating risks online, gender norms in the real world can shape one’s online behavior. </span><a href="https://www.dai.com/fi-cyber-user-trust.pdf" target="_blank" rel="noopener noreferrer"><span data-contrast="none">Research in India</span></a><span data-contrast="auto"> showed that the very act of going online can violate expectations of a woman’s behavior in society. Women are told they should not talk to men outside their family or be accused of “improper” behavior. The fear of being discovered online by family or extended family forces women to minimize their online footprint and reduce their internet usage.</span>
<blockquote class="pullquote--left"><span data-contrast="auto">In societies with hegemonic gender ideologies, the woman is almost always blamed for everything that goes wrong.</span></blockquote>
<span data-contrast="auto">Furthermore, the perception of women being more vulnerable is reinforced by a lack of clarity on recourse mechanisms, which often do not exist. If recourse mechanisms do exist, in some cultural contexts, women may be blamed for putting themselves in a compromising situation or may not have the courage to speak up. Finally, countering online harassment can be harder for women because it is often subversive, can be conducted through one-on-one interactions, and is difficult to track and trace since abuser identities are often hidden or fake. In societies with hegemonic gender ideologies, the woman is almost always blamed for everything that goes wrong.</span>
<h2><span class="TextRun MacChromeBold SCXW65126004 BCX0" lang="EN-US" xml:lang="EN-US" data-contrast="auto"><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun" data-ccp-charstyle-defn="{&quot;ObjectId&quot;:&quot;8eed487e-3b20-4552-bee3-737de11680fa|42&quot;,&quot;ClassId&quot;:1073872969,&quot;Properties&quot;:[469775450,&quot;normaltextrun&quot;,201340122,&quot;1&quot;,134233614,&quot;true&quot;,469778129,&quot;normaltextrun&quot;,335572020,&quot;1&quot;,469778324,&quot;Default Paragraph Font&quot;]}">What Can Be Done to Support a </span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">S</span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">afe and </span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">S</span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">ecure </span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">Online E</span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">nvironment for </span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">W</span><span class="NormalTextRun SCXW65126004 BCX0" data-ccp-charstyle="normaltextrun">omen</span></span></h2>
<span data-contrast="auto">Creating a safe and secure online environment for women to transact will need cross-sector collaboration and will require efforts from multiple stakeholders. Below are a few ideas for ways to better support women with online and digital services.</span>
<ol>
 	<li data-leveltext="%1." data-font="" data-listid="3" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">
<h3><b><span data-contrast="auto">Financial service providers or fintechs that develop apps have a responsibility to ensure that principles of necessity and </span></b><a href="https://edps.europa.eu/data-protection/our-work/subjects/necessity-proportionality_en" target="_blank" rel="noopener noreferrer"><b><span data-contrast="none">proportionality</span></b></a><b><span data-contrast="auto"> are followed when seeking user data. </span></b></h3>
<span data-contrast="auto">Requesting access to photographs on phone galleries, or getting access to phone contacts should not be automatic, and must be restricted for access and use by employees of a fintech who use this to </span><a href="https://www.icirnigeria.org/nigerian-fintech-companies-shame-threaten-customers-for-late-payment-of-loans/" target="_blank" rel="noopener noreferrer"><span data-contrast="none">collect overdue loans</span></a><span data-contrast="auto">, or follow up on payments. This can prevent </span><a href="https://www.wired.co.uk/article/google-loan-apps-india-deaths" target="_blank" rel="noopener noreferrer"><span data-contrast="none">misuse and harassment</span></a><span data-contrast="auto"> that specifically targets women.</span></li>
 	<li data-leveltext="%1." data-font="" data-listid="3" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">
<h3><b><span data-contrast="auto">Design easier complaint processes.</span></b></h3>
<span data-contrast="auto">IPA’s </span><a href="https://www.poverty-action.org/publication/nigeria-consumer-protection-digital-finance-survey" target="_blank" rel="noopener noreferrer"><span data-contrast="none">research in Nigeria</span></a><span data-contrast="auto"> shows that even with digital products, customers tend to resolve challenges in person. And when complaints remain unresolved, usage tends to drop. Apps should have easy-to-access safety mechanisms that can help them block calls or alert the provider through a help button, in case of an emergency. Additionally, customers who have </span><a href="https://www.poverty-action.org/publication/nigeria-consumer-protection-digital-finance-survey" target="_blank" rel="noopener noreferrer"><span data-contrast="none">lower income and education levels</span></a><span data-contrast="auto"> are </span><a href="https://www.centerforfinancialinclusion.org/client-voices-rwandans-speak-on-digital-financial-services"><span data-contrast="none">less likely</span></a><span data-contrast="auto"> to use formal redress channels. Initiatives like ‘</span><a href="https://www.digitalsafetea.com/" target="_blank" rel="noopener noreferrer"><span data-contrast="none">Digital Safe-tea’</span></a><span data-contrast="none">,</span><span data-contrast="auto"><span data-contrast="auto"> an interactive fiction game about digital safety issues, can help alert women on rules to follow in an online or digital world. Using peer learning mechanisms also could help women learn how to navigate digital environments safely.</span></span></li>
 	<li data-leveltext="%1." data-font="" data-listid="3" aria-setsize="-1" data-aria-posinset="1" data-aria-level="1">
<h3><b><span data-contrast="auto">Create a conducive policy and legal environment for data rights.</span></b></h3>
<span data-contrast="auto"> Sharing information may be crucial to enable access to digital financial services. However, FSPs, MNOs and other actors involved should have data sharing policies and be held accountable when this data is misused by their employees or agents, or when there are data breaches. When customers receive calls from people who claim they are from a specific company or have access to personal information, there should be a way to verify the information or report it to the company and a central authority that can adjudicate on the breach of rights.</span></li>
</ol>
<blockquote class="pullquote--right"><span data-contrast="auto">Women will only trust the digital environment if they feel safe enough to report online incidents and if these reports are acted upon.</span></blockquote>
<span data-contrast="auto">Women will only trust the digital environment if they feel safe enough to report online incidents and if these reports are acted upon. Inclusion can only take place if there is a common culture that respects all customer voices. We need to better encourage women, or anyone facing abuse and discrimination, that if they see something, they need to say something. As we work to break the biases that hinder women’s financial inclusion and, ultimately women’s economic empowerment, ensuring safe and secure online spaces is a crucial first step.</span>

If You See Something, Say Something

When Goldman Sachs came under fire for offering women lower lines of credit than men on the now <a href="https://www.nytimes.com/2019/11/10/business/Apple-credit-card-investigation.html" target="_blank" rel="noopener noreferrer">infamous Apple Card</a>, they defended the product against charges of sexism by explaining that gender had not been an input to the credit scoring model. If an applicant’s gender was never fed into the algorithm, how did credit decisions end up discriminating against women who had similar credit histories as men?

Gender-blind credit scoring is an example of what many AI bias researchers call “fairness through unawareness,” an approach that intentionally excludes data on sensitive attributes like race, ethnicity, religion, or sex with the goal of reducing discriminatory outcomes. Behind this approach is the idea that eliminating markers of different group identities will prevent basing decisions on those characteristics. This has led to failures in the past, notably <a href="https://cpb-us-e1.wpmucdn.com/sites.suffolk.edu/dist/3/1172/files/2014/01/Rice-Swesnik_Lead.pdf" target="_blank" rel="noopener noreferrer">redlining</a>. Recent research has shown it can also make <a href="https://arxiv.org/abs/2009.06251" target="_blank" rel="noopener noreferrer">discrimination harder to detect and address</a> in the era of algorithmic decisions.
<blockquote class="pullquote--right">“Fairness through unawareness” intentionally excludes data on sensitive attributes like race, ethnicity, religion, or sex with the goal of reducing discriminatory outcomes.</blockquote>
As algorithms <a href="https://www.centerforfinancialinclusion.org/the-stories-algorithms-tell-bias-and-financial-inclusion-at-the-data-margins" target="_blank" rel="noopener noreferrer">transform the financial sector</a>, we need a better understanding of how to mitigate against discriminatory outcomes to ensure that those left out of the digital ecosystem today do not face further financial exclusion. Otherwise, we may not know how many Apple Card equivalents exist in inclusive finance.

This post explores the challenges and tradeoffs of using sensitive attribute data for detecting discrimination in the context of evolving data protection norms and regulations.
<h2>The Perils of Fairness through Unawareness</h2>
The idea may seem counterintuitive: if you remove gender from the data inputs of a credit model, how does the algorithm consistently assign a lower limit to women? The reason is that credit scoring algorithms are crunching larger amounts and new sources of data, which means that the model can inadvertently use proxies for sensitive attribute data in decisions, even if that was not the intention of the model developers. For instance, the <a href="https://journalofbigdata.springeropen.com/articles/10.1186/s40537-019-0180-9" target="_blank" rel="noopener noreferrer">type of phone</a> someone uses or the <a href="https://dl.acm.org/doi/10.1145/2721896.2721908" target="_blank" rel="noopener noreferrer">apps a person installs on their phone</a> can act as proxies for gender, age, or other characteristics.
<blockquote class="pullquote--left">Models can inadvertently use proxies for sensitive attribute data in decisions, even if that was not the intention.</blockquote>
A very simple method for testing algorithmic bias within a credit scoring model requires only a few variables like the actual default rate, the actual score of the individual when approved, and the variable you want to test with your algorithm, such as gender or race.
<h2>Data Tensions: Privacy vs. Anti-Discrimination</h2>
So, why isn’t this done? The answer lies in data limitations, sometimes based on very legitimate concerns about histories of injustice. It illustrates one of the challenges of detecting and monitoring for bias in algorithmic systems without infringing on privacy rights.

Many countries around the world prohibit collecting sensitive data or basing credit decisions on protected categories either under their banking regulations or under new data privacy legislation. In India, lenders are prohibited from discriminating on the <a href="https://www.rbi.org.in/Scripts/PublicationReportDetails.aspx?ID=764" target="_blank" rel="noopener noreferrer">grounds of sex, caste, or religion</a>. In the U.S., the Equal Credit Opportunity Act (ECOA) made it illegal for credit providers to discriminate based on sex, race, national origin, and other protected characteristics in response to widespread denials of credit to women and people of color. ECOA prohibits lenders from collecting this data in the first place, even for the purpose of detecting discrimination, because of fears it will be used improperly to further perpetuate bias in consumer lending. Research in the US shows that discriminatory trends have been <a href="https://arxiv.org/pdf/1912.06171.pdf" target="_blank" rel="noopener noreferrer">hard to detect in consumer lending</a> and that a lack of sensitive attribute data has also created enforcement challenges.

While not all lending regulations prohibit the collection of sensitive data, data privacy legislation introduces new limits on this data. The General Data Protection Regulation (GDPR), which has become the model for legislation in many developing markets, bars certain sensitive data from being collected or processed -- including data on race and ethnic origin, political opinions, philosophical beliefs, sexual orientation, and biometrics -- without individual consent.
<blockquote class="pullquote--right">Concerns about safely and properly using sensitive attribute data are valid given histories of discrimination and surveillance of minority groups in both wealthy and developing countries.</blockquote>
On top of GDPR, the European Commission has recently put forward <a href="https://digital-strategy.ec.europa.eu/en/library/proposal-regulation-laying-down-harmonised-rules-artificial-intelligence" target="_blank" rel="noopener noreferrer">draft legislation to regulate artificial intelligence</a>, with specific provisions for AI systems classified as high risk, which includes credit scoring. The draft legislation suggests that AI providers should process “special categories of personal data” to monitor and correct for bias in the public interest, but does not clarify collection practices or consent processes for such data. Concerns about safely and properly using sensitive attribute data are valid given histories of discrimination and surveillance of minority groups in both wealthy and developing countries. Changes in regulatory frameworks to allow for use of this data to mitigate against further discrimination require public trust bolstered by technical solutions that protect against misuse. Depending on a country’s history or in places experiencing active or simmering conflict, technical solutions may not be enough. For example, in a country like Rwanda where <a href="https://www.nytimes.com/2004/04/09/world/a-decade-after-massacres-rwanda-outlaws-ethnicity.html" target="_blank" rel="noopener noreferrer">ethnic distinctions are banned</a>, the tensions around sensitive identities make it difficult to fathom collecting and using such information, especially by the government.
<h2>Data Ecosystems in Emerging Markets: It’s Complicated</h2>
This tension between privacy and anti-discrimination may be exacerbated in developing markets by the <a href="https://centerforfinancialinclusion.org/rethinking-financial-inclusion-at-the-data-margins/" target="_blank" rel="noopener noreferrer">limited digital footprints</a> of customers at the data margins, as well as paltry knowledge on how data trails and protected groups intersect.

Sex-disaggregated data is still <a href="https://data2x.org/wp-content/uploads/2020/03/MappingGenderDataGaps_Economic.pdf" target="_blank" rel="noopener noreferrer">largely unavailable</a> in the financial sector and for many economic indicators in developing markets. Beyond availability, there is less understanding of how women’s lives and the barriers that shape their economic behaviors are reflected in data used for credit decisions. The reality is that gender, ethnic, or religious identities interact with other indicators (like income, asset accumulation, or technology use) and will impact individuals’ data trails in ways that may misrepresent individuals’ potential and result in disparate outcomes (i.e. access to a financial product). Fairness through unawareness approaches are blind to this intersectionality.
<h2>Where Do We Go From Here?</h2>
As an industry, we can do more to understand the data inputs for digital financial services and how socioeconomic realities present in these datasets, especially for traditionally excluded groups. There will still be tradeoffs between privacy and anti-discrimination, but managing those tradeoffs requires a conversation between providers, regulators, donors, and the public to identify what is possible and explore the right balance.

These conversations can start with the many open questions that exist from a technical perspective. For instance, can <a href="https://ieeexplore.ieee.org/document/8970908" target="_blank" rel="noopener noreferrer">third parties</a> play a role in securely storing sensitive data, or are there options to use <a href="http://proceedings.mlr.press/v80/kilbertus18a/kilbertus18a.pdf" target="_blank" rel="noopener noreferrer">encryption</a> or <a href="https://spectrum.ieee.org/artificial-intelligence/machine-learning/engineering-bias-out-of-ai" target="_blank" rel="noopener noreferrer">synthetic data</a> techniques? Can regulators develop tools that allow them to estimate the demographic characteristics of a dataset, like the <a href="https://www.consumerfinance.gov/data-research/research-reports/using-publicly-available-information-to-proxy-for-unidentified-race-and-ethnicity/" target="_blank" rel="noopener noreferrer">Consumer Financial Protection Bureau has done</a> in the U.S.? Can investors encourage investees to design monitoring and evaluation indicators to help answer questions about how their algorithms perform on inclusion?

While the road ahead may be complex, starting these conversations and bringing the public into them, especially those whose lives will be affected by algorithmic decisions, will be crucial for building trust. We need to engage with emerging research on possible solutions to see what might be appropriate in developing markets. At the very least, financial inclusion stakeholders should know enough to respond to any gender-blind or fairness through unawareness approaches in digital finance with healthy skepticism.
<blockquote>Starting these conversations and bringing the public into them, especially those whose lives will be affected by algorithmic decisions, will be crucial for building trust.</blockquote>

Reducing Bias in Algorithmic Decisions Cannot Rely on “Blind” Approaches

This report, the third in a <a href="https://www.centerforfinancialinclusion.org/series/municipal-cash-transfer-programs-design-ids-and-data-protection">series</a> on municipal cash transfers in the U.S., focuses on data protection for undocumented or mixed-status beneficiary households. In the context of cash-based assistance (CBA) programs, poor data protection practices could add additional risks for low-risk individuals by providing data trails that could pave the way for unauthorized access to applicant or beneficiary data or leakage of personally identifiable information. These could leave a digital footprint that can make it easier for law enforcement to target undocumented individuals.

Considering these risks, we have identified and detailed approaches and strategies used to protect applicant and beneficiary data through four programmatic phases: targeting beneficiaries, outreach and onboarding, disbursement and distribution, and ongoing monitoring and data storage/retention. Insights in this report are gleaned from CFI interviews with cities, community-based organizations (CBOs), debit card providers, and privacy advocates.

This report and the others in this series are intended to guide municipal officials and CBOs considering or developing programs to support undocumented or mixed-status households. The insights may also be of interest to organizations advocating for and supporting the rights of undocumented populations, students and academics, and anyone <span data-contrast="auto">interested in </span><span data-contrast="auto">access to financial and</span> <span data-contrast="auto">public</span> <span data-contrast="auto">services</span><span data-contrast="auto"> for all members of U.S. communities. </span>

Protecting Beneficiary Data: Guidance for Municipal Cash Transfer Programs Responding to COVID-19

Though U.S. citizens and residents received economic support following passage of the CARES Act in spring of 2020, undocumented and mixed-status households were left behind. To bridge this assistance gap, state and local governments across the U.S. have partnered with community-based organizations (CBOs) to establish cash transfer programs to support these populations during the pandemic.

This report, part of a three-part <a href="https://www.centerforfinancialinclusion.org/series/municipal-cash-transfer-programs-design-ids-and-data-protection">series</a>, provides practical guidance to municipalities considering or currently operating direct cash assistance programs. It is based on insights from in-depth, semi-structured interviews conducted by CFI with 12 program administrators representing seven cash assistance programs.

We identify and detail practices for defining target beneficiaries, establishing eligibility criteria, conducting outreach, onboarding recipients, and disbursing funds. This report also highlights the relative advantages and disadvantages of different approaches at each step of the process.

The insights here may also be of interest to organizations advocating for and supporting the rights of undocumented populations, students and academics, and anyone <span data-contrast="auto">interested in </span><span data-contrast="auto">access to financial and</span> <span data-contrast="auto">public</span> <span data-contrast="auto">services</span><span data-contrast="auto"> for all members of U.S. communities. </span>

Designing Municipal Cash Transfer Programs to Mitigate the Economic Impact of COVID-19

Alexandra (Alex) Rizzi

Senior Research Director, Consumer Data Opportunities and Risks

Jayshree Venkatesan

Sugandh Saxena

Anindita Chakraborty

Alex Kessler

Jacobo Menajovsky

Madeleine Longwell

Eric Noggle

Tess Johnson

Malacci Ohrt

Elisabeth Rhyne

Ezra Mannix

Patrick Traynor

Pablo Anton-Diaz

India

South Asia

East Asia and Pacific

Indonesia

North America

United States

Benin

Ghana

Uganda

Rwanda

Sub-Saharan Africa

Alternative Data

Appropriate Product Design and Delivery

Consumer Protection

Data Analytics

Financial Technology

Privacy

Delivery Channels

Digital Financial Services

Transparency

Client Treatment

Enabling Environment

Financial Service Providers

Fintechs

Fraud

Financial Capability

Complaint Resolution

Underserved Groups

Women

Credit

Credit Provision

Digital Credit

Policy, Regulation and Government Initiatives

Responsible Digital Finance

Underwriting

Challenges and Crises

Credit/Debit Cards

Payments

Product Pricing

Telcos

Agent Banking

Mobile Banking

Consumer Credit

Nano Loans

Blog Post

Report

Brief

Event

India is a global leader in financial inclusion. For over a decade, Accion has worked with and learned from India’s innovators, investors, and policymakers to expand economic opportunity for its people and businesses.

Although the CARES (Coronavirus Aid, Relief, and Economic Security) Act has mobilized a whopping <a href="http://crfb.org/blogs/whats-2-trillion-coronavirus-relief-package">$293 billion</a> to provide one-time economic impact payments to American households, many are ineligible for this federal support due to <a href="https://www.nilc.org/resources-covid19-crisis-and-consequences/faq-eligibility-for-assistance-based-on-immigration-status/">their immigration</a> status or living in a <a href="https://www.nytimes.com/2020/04/28/us/coronavirus-undocumented-immigrants-stimulus.html">mixed-status household</a>. Cities, counties and states across the United States are stepping in for these residents by bridging the gap with cash transfer programs of their own.

Beyond the inherent complexity of quickly establishing a safe and efficient cash distribution program, serving this marginalized population presents specific challenges. First, local governments need to identify and enroll beneficiaries from a population that generally lacks official identity documentation and can be difficult to reach. Second, in addition to being undocumented, this population is often unbanked or underbanked, raising questions about how cities and counties can safely deliver financial stimulus in a cost-effective manner. Third, data protection is high stakes for this population, which tends to be at greater risk for financial fraud or exploitation, as well as targeting by Immigration and Customs Enforcement (ICE).

Given these challenges, how should US cities design cash transfer programs to serve undocumented communities?

With support from Open Society Foundations, CFI identified more than 70 examples of city- and county-led municipal identification initiatives (active, inactive, and proposed) that sought to address challenges residents face in obtaining government-issued forms of identification. For marginalized and vulnerable populations—such as the undocumented, those experiencing homelessness, and the elderly—a lack of official identification makes everyday tasks like accessing social services or opening a bank account difficult.

Cities that have established these programs, particularly those that have sought to leverage them to advance financial inclusion, provide several lessons to cities facing similar challenges while establishing cash assistance programs in response to COVID-19.

&nbsp;

&nbsp;

Municipal IDs Offer Cities Lessons for COVID-19 Cash Assistance Programs

<h1>Why Consumer Rights and Responsibilities?</h1>
The <a href="https://www.smartcampaign.org/about/smart-microfinance-and-the-client-protection-principles">Client Protection Principles</a> provide a common framework for financial service providers (FSPs), policymakers, and clients to better understand and discuss consumer protection issues. While much of the Center for Financial Inclusion’s (CFI) work with the financial inclusion industry has focused on providers and regulators, there is a third crucial constituency: clients.

Client awareness and capability is a critical component of effective financial consumer protection. Clients have the right to demand fair treatment and lodge complaints with government authorities, but these rights mean little if they don’t know what constitutes lawful treatment or how to access complaints channels. Similarly, clients play a role in protecting themselves by practicing behaviors to maintain their privacy and safety. While FSPs can institute protective processes and regulators can craft policy safeguards, improving client awareness of their rights and responsibilities helps consumers play their part to support a sustainable financial system.

This report provides lessons learned from initiatives in Ghana, Uganda, and Benin to raise consumer protection awareness among clients through multimedia campaigns, digital tools and other outreach strategies. It covers country-specific consumer protection issues and the individualized campaigns to address these issues. We also offer five key takeaways to help inform future client protection and empowerment awareness building activities.

Clients Deserve to Know: Using Radio to Educate and Empower Consumers in Africa

Today there are close to 700 million mobile money accounts registered worldwide — a number that, if it were a population, would rank as the world’s third-largest country. East Africa continues to lead in digital financial innovations as well as account usage, with two-thirds of the combined adult populations of Kenya, Rwanda, Tanzania, and Uganda actively using mobile money. With the proliferation of mobile financial services, particularly among underserved populations, it is vital that users be treated fairly and with dignity. In the momentum to define responsible digital finance and recognize providers of high-quality financial services, the industry must not forget the consumer.
<h1>Client Voices: Why We Listened</h1>
<a href="/about/what-we-do/the-smart-campaign/">The Smart Campaign</a>, a global initiative to create an environment in which financial services are delivered safely and responsibly to low-income clients, has long recognized that client perspectives are often underrepresented in consumer protection discussions. With the Client Voices Project, the Campaign questions whether the industry’s assumptions about what constitutes problematic treatment rightly reflect what clients themselves worry about.

The dual objectives of the project are to solicit input from low-income clients about what they consider good and bad treatment in their interactions with financial service providers and to assess the prevalence of consumer protection problems among these clients, using quantitative surveys. The project is designed to act as a catalyst for financial service providers, regulators, industry associations, consumer advocacy groups, and others to improve client protection in ways that are grounded in client feedback.
<h1>Major Findings</h1>
Based on a survey of over 1,200 people in three districts in Rwanda, this report delves into the experiences of individuals who use digital financial services (DFS), the main client protection issues they are concerned about, and the impact and prevalence of negative experiences. We find that mobile money enjoys a high degree of satisfaction and trust from clients in Rwanda, even though 40 percent of clients report being targeted by fraudulent schemes, which have become increasingly sophisticated.
<blockquote>Customers report wising up to scams and fraud, but with a continuous influx of new mobile money users and fraudsters who innovate quickly, the threat is real and constant. Fraud represents the greatest potential to damage customer trust and engagement with mobile money in Rwanda.</blockquote>
However, there are many ways that DFS operations and practices can be improved to better protect clients and strengthen trust. Client recourse mechanisms, for example, represent an important area for improvement: many clients shared that they feel helpless and unsure about what to do after realizing they have been duped. Additionally, for business models that rely more on the mobile interface than on human interaction, clients increasingly rely on agents for information and guidance. This presents an opportunity to provide better service, as well as a risk for poor client treatment.

We hope that providers, industry associations, support organizations, regulators, consumer protection advocates, and clients can benefit from these findings to create a stronger, more inclusive client protection ecosystem. We offer specific recommendations for many of these stakeholders.

Client Voices: Rwandans Speak on Digital Financial Services

<a href="/about/what-we-do/the-smart-campaign/">The Smart Campaign</a> will participate in the AFI Consumer Empowerment &amp; Market Conduct (CEMC) &amp; Digital Financial Services (DFS) Working Group Meetings March 25-29 in the Bahamas. Elisabeth Rhyne will speak on a joint working group panel entitled “Data Protection and Privacy in the Age of Data Driven Financial Services.” This session will examine how innovations in technology that resulted in the proliferation of data and why consumers need to be more aware than ever about the risks of sharing personal details, and why financial institutions need to start thinking about data protection seriously. The Campaign will also present on the <a href="/help-us-shape-standards-for-responsible-digital-lending">draft Consumer Protection Standards for Digital Credit</a> and forthcoming updates to the Model Legal Framework for digital financial services.

Alliance for Financial Inclusion Working Group Meeting

<em>This post originally appeared on American Banker's <a href="https://www.americanbanker.com/opinion/consumer-harm-from-data-breaches-is-a-black-box">BankThink</a> page.</em>

Data privacy and security concerns are red-hot right now, with near daily headlines about yet another breach. Often missing from the conversation, however, is information about the nature and prevalence of harms consumers actually experience as a result of poorly protected data. We appear to enjoy speculating about what might happen to consumers more than documenting what does and has happened. And yet, there is no better guide to prioritizing remedial action than clear documentation of the consequences of shortcomings, their frequency and their severity.

The Center for Financial Inclusion at Accion, an action-oriented think tank focused on financial inclusion, examines issues around data protection among financial service providers around the world, with an emphasis on those serving the base of the pyramid. From the financial inclusion point of view, we need to understand the financial losses that customers experience — primarily theft and fraud — when data breaches occur.

While we have been able to <a href="https://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2">explore security vulnerabilities</a> by working with the computer scientist Patrick Traynor of the University of Florida, we have found it more difficult to find good data on the consumer side. How often do consumers experience theft and fraud, how harmful are these events to consumers and financial institutions when they do occur, and how do they relate to security lapses or poor policies among financial institutions and their regulators? Without this data, we as a sector can only view part of the problem. We are unable to analyze the link between security system measures and actual consumer harm. It’s as though we have lost the car keys but are only able to look for them under the streetlight.

It sounds overly simplistic to say that a data breach leads to negative consequences only when those who obtain personal information actually use it. But while the breach of data from millions of bank accounts makes front-page news, we know startlingly little about the number of uses of those identities or the amounts of money lost. One estimate of incidence comes from the Identity Theft Resource Center, a nonprofit dedicated to assisting victims. It cites 1.6 billion record breaches since 2005, but only 16.7 million identity theft victims. A quick hallway poll of my own colleagues revealed many experiences of fraud, generally through idiosyncratic events rather than massive ones, underlining the fact that hackers and fraudsters tend to rip people off quietly and often individually. When this happens, victims themselves may not know how or when their personal data was tapped. As an industry, we are short of information about the pathways hackers use to turn data breaches into monetary thefts.

Where could the industry begin to gather this information?

Cybercrimes units among law enforcement agencies undoubtedly have a great deal of information about the incidence of theft resulting from fraudulent uses of personal data. In theory, their financial forensics can work backward from a monetary theft to the data breach that made it possible. But we need to ensure that such units address losses by ordinary consumers and not just big ticket white collar crimes. We also need to ensure that law enforcement knowledge translates into useful advice for financial institutions and regulators.

Large banks and major card providers also have masses of relevant information and expertise. They have invested enormous resources over decades to identify and cope with fraud, creating fraud detection systems and workforces dedicated to assisting customers who are victims, and they still write off millions of faulty transactions. While it may be expensive, that very investment is a major source of their business success: It makes it possible for consumers to trust that when their credit card information is stolen, they will not be liable. But what about smaller financial institutions and new market entrants that cannot afford the sophistication of major card providers? They need to know more about how consumers experience fraud and theft. It would be valuable for the regulators, researchers and industry associations that monitor the financial sector and have a stake in its success to gather more systematic demand-side research to document these consumer experiences — and that information needs to be publicly available so that financial service providers and their consumers can benefit from it.

These recommendations are a starting point to better inform consumers and the financial services industry about the risks associated with data breaches, and how they can be prevented and addressed. Better information on the incidence and severity of consumer harms can enable financial service providers and policymakers to weigh trade-offs between data protection investments and the risks associated with incomplete protection. As a result, they can target remedial actions more effectively, avoiding both over-spending and running unacceptable risks — with better outcomes for consumers.

Consumer Harm from Data Breaches is a Black Box

The keynote speaker at a recent EU conference on data protection and privacy, Apple CEO Tim Cook s<a href="https://www.computerworld.com/article/3315623/security/complete-transcript-video-of-apple-ceo-tim-cooks-eu-privacy-speech.html">poke surprisingly bluntly</a> about the consequences of how data is being collected and used, and stressed an immediate need to enact data privacy regulation -- at least in Apple’s home country -- which would be on par with his host’s General Data Protection Regulation (GDPR) framework, enacted May 2018.

“Our own information, from the everyday to the deeply personal, is being weaponized against us with military efficiency,” he said. “Platforms and algorithms that promised to improve our lives can actually magnify our worst human tendencies. Rogue actors and even governments have taken advantage of user trust to deepen divisions, incite violence, and even undermine our shared sense of what is true and what is false.”

Cook reviewed the four rights that are articulated in the GDPR: First, the right to have personal data minimized; second, the right to knowledge; third, the right to access, that is, to make it easy for users to get a copy of, correct, and delete their personal data; and fourth, the right to security.

For those of us in the financial inclusion space, it was a pleasant surprise to see such a high-profile tech CEO speak so forthrightly on the topic. Data security has also very much consumed our discussions, both in an <a href="https://content.centerforfinancialinclusion.org/getting-data-right/">essay</a> and in a <a href="https://www.centerforfinancialinclusion.org/the-road-to-getting-inclusion-right-data-and-an-effective-ecosystem">speech</a> at our recent 10th anniversary symposium. We’re grappling with this technical and multi-faceted issue in order to make sure that we “get it right” as data enables greater financial inclusion in the developing world.

Furthermore, the recent “Banana Skins” report, “<a href="https://www.centerforfinancialinclusion.org/finance-for-all-wedded-to-fintech-for-better-or-worse">Finance for All: Wedded to Fintech for Better or Worse</a>,” published by the Center for the Study of Financial Innovation in conjunction with CFI, reveals that leaders in financial inclusion see technology’s risks as by far the biggest challenge they currently face.

Lofty words and alarms may be on message, but what matters is moving toward tangible steps to protect data. A recent working paper by <a href="https://www.dvara.com">Dvara Research</a>, a financial systems policy research institution in India, lays out a <a href="https://www.dvara.com/blog/2018/11/08/video-effective-enforcement-of-a-data-protection-regime/?utm_source=feedburner&amp;utm_medium=email&amp;utm_campaign=Feed%3A+dvara+%28Dvara+Blog%29">framework for a data protection regime</a> that could addresses both prevention of and response to data breaches. The authors provide a risk-based framework for “responsive regulation” in India, noting that the most regulations are created after a major data breach has occurred (such as the Aadhaar data breach in India about a year ago). The paper highlights principles – such as transparency, accountability, and proportionality – that should guide the regulators.

Speaking of regulation, The Economist Intelligence Unit’s <a href="https://www.centerforfinancialinclusion.org/global-microscope-2018">Global Microscope</a>, a ranking of the enabling environments in 55 countries carried out in partnership with CFI, has also taken a forward-looking digital approach in evaluating governments’ abilities to create smart, practical and deliverable regulation, including in data protection. Colombia (which tops the overall ranking) and South Africa, for example, have dedicated financial consumer protection frameworks and specialized enforcement capacity, along with government entities with a strong capacity to enforce data protection laws.

We at CFI couldn’t agree more with these intentions, and we’re also contributing our part toward making sure the need for data protection, transparency, and consumer knowledge are deeply ingrained in those operating in the financial inclusion space.

This is why the <a href="http://smartcampaign.org/">Smart Campaign</a> is strengthening its attention to data privacy and security in its standards for consumer protection certification for digital financial services. We are also sponsoring research, such as that from CFI Fellow Patrick Traynor, which showed how some digital financial service providers have <a href="https://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2">gaps in their data security</a> protocols, and offered some easily actionable technical fixes (see also this <a href="http://www.cgap.org/blog/cybersecurity-mobile-financial-services-growing-problem?utm_source=CGAP+Reader+%2811.26.18%29&amp;utm_campaign=CGAP+Reader+%2811.26.18%29&amp;utm_medium=email">post and slide deck</a> from CGAP with challenges and best practices for digital financial service providers).

In 2019, CFI will continue to tackle this issue, to do our part as advocates of data protection for billions of vulnerable unbanked and underbanked consumers around the world.

&nbsp;

Apple CEO Sounds Right Notes on Data Protection and Privacy

Mobile phones and networks are transforming the world of finance, creating opportunities  for widespread financial inclusion, especially among neglected regions and groups. Security and privacy should be among the most important considerations when building digital finance systems.
Credit decisions are often based on sensitive information and online finance offerings are no exception. The sensitivity of this information gives rise to a series of critical questions for customers:
<ul>
 	<li>To whom am I giving my data? And who else do they allow to access it? For what purposes?</li>
 	<li>How do the companies protect data so that people who do not have legitimate access cannot use or steal it?</li>
 	<li>What rights and options do I have if something does go wrong?</li>
</ul>
The goal of this research, conducted by CFI Fellow Patrick Traynor, is to examine how well digital lenders are responding to these questions.

&nbsp;

&nbsp;

&nbsp;

Digital Finance and Data Security

Given their rapid spread and growth, this question urgently needs answering. As part of its ongoing CFI Fellows Program, CFI asked <a href="http://www.centerforfinancialinclusion.org/people/patrick-traynor/">Patrick Traynor</a>, professor at the University of Florida’s Department of Computer Information Science &amp; Engineering (CISE) to find out.

Traynor and his team of computer science researchers looked at the security of online fintech applications using a collection of both automated and manual standard analysis techniques widely available in the computer science toolkit. They examined the apps and websites of 52 digital apps, mainly digital lenders, from all across the world to see how they handle user data. Additionally, after the technical analysis, Traynor’s team also evaluated the privacy policies for each application to see if they described how users’ data would be used and protected, and the recourse available to users in case of any misuse. <a href="http://www.centerforfinancialinclusion.org/digital-finance-and-data-security-2/">Read the full report</a>.

These tests allowed for a rapid assessment of the state of communications security between users’ mobile devices and each institution’s backend servers. The tests determined whether the mobile application properly determined the identity of the other end of communications, and whether the institutions’ backend servers were properly configured against the most up-to-date attacks against the SSL/TLS security suites. A thorough analysis of the apps’ public code included, among other things, a review of the process for registration and login, user authentication, money transfers and techniques used to isolate the website or application’s data from other potentially malicious) applications on the phone. Through such an analysis, the researchers were able to determine how easily an adversary could inject false transactions or alter legitimate transactions in the platform.

The results of the study were surprising. No company studied was perfect, some were good enough, and some had real vulnerabilities. The researchers found that the integrity of data gathered from mobile money applications varied dramatically across the sample. Interestingly, neither presence in a developed market nor company maturity predicted better security performance: similar security vulnerabilities were found in both early stage startups and more established providers and in institutions from all world regions in the sample. No company is immune from security gaps, and mobile fintechs are no exception.

In an effort to motivate and enable companies to address these vulnerabilities, CFI sent individual results to each of the companies reviewed in the study. Additionally, Traynor prepared a short guidebook with instructions on how to correct the most commonly identified security vulnerabilities uncovered by this study. The recommended changes will provide significant security improvements for a low time and monetary investment.

Through Accion’s Venture Lab, we organized a private webinar with Traynor for six companies in the sample. He walked participants through the tests and addressed questions on how to implement his recommended changes. We recognize and commend these companies for their dedication to address the issues this study encountered in their systems, and would like to encourage other companies in the study to do the same by reaching out to us directly. Our aim as CFI is to motivate better data security practices and we are available to support any company taking action on this matter.

Accion Venture Lab is also working to create and share resources for their portfolio companies and the broader industry. Focused on developing a set of practical resources to help early-stage fintech startups implement better information security and data privacy, their approach is to leverage insights from industry experts and portfolio companies to create actionable and accessible content. The tools they are building include:
<ul>
 	<li>Diagnostic: checks and tests that companies can use to identify major gaps in security and privacy</li>
 	<li>FAQ: resources to answer the most salient questions from companies about data protection</li>
 	<li>Data policy outline: key components of a quality data policy for financial services companies</li>
 	<li>Implementation guide: best practices to implement changes to data practices</li>
</ul>
Additionally, Venture Lab is working on relevant questions for due diligence. The goal is not to screen out a company based on these, but rather to identify areas where Venture Lab can help develop more robust policies and practices.

At both CFI and Venture Lab, we believe that integrity of client data gathered from mobile applications is important to secure. Companies don’t always dedicate the time and resources to understand their vulnerabilities and compromising incidents with data will damage the credibility and limit the reach of digital apps. By measuring the state of security in this space and providing targeted resources for digital fintechs, we can enable responsible digital financial services and greater financial inclusion.

&nbsp;

New Data Security Study of Fintech Apps Highlights Vulnerabilities