“As attackers continue targeting big retailers, as well as turn their attention to smaller franchised stores, more pressure and scrutiny will be placed on financial institutions that issue cards to monitor all accounts for fraudulent activity, and swiftly and sensitively notify affected individuals,” Bruemmer added.

Additionally, cybercriminals will focus further up the chain, targeting payment processors that could provide access to several payment systems if compromised. “We’ve already seen reports of one major processor getting hit and likely being the source for many of the restaurant breaches that happened this last year. Getting the potential keys to the castle for various and distributed systems is likely too tempting to pass up.”

The biggest threat next year to smaller financial institutions, such as credit unions, is the possibility of aftershock password breaches. “We’re starting to see more and more previous data breaches come back to haunt companies as attackers continue to sell personal credentials on the dark web, often years after the information was originally stolen,” Bruemmer said.

Experian compares this to an earthquake aftershock reverberating after the initial occurrence. Criminals use this information to access individuals’ personal accounts, and companies have to inform those affected of unauthorized logins. Bruemmer added, “Any smaller financial institutions that have yet to implement two-factor authentication for online services are likely to be at higher risk of experiencing an aftershock breach and subsequent increases in account takeover and fraud.”

Another trend that might go unnoticed is the growth of social engineering to defraud companies. “This is an easy and quick way for hackers to cash in and has a pretty low barrier to entry,” Bruemmer explained.

While credit unions are typically not liable for this type of loss, they could engage agitated members who are trying to recover money sent to criminals. This could have an impact on their relationship with the credit union. “It will be important for credit unions and other institutions to help educate their business customers about these types of scams to prevent them from occurring,” Bruemmer suggested.