BinBase.com REPORT: credit card fraud

Transcription

1

2 BinBase.com REPORT: credit card fraud Whether you are a security specialist, an e-commerce web developer, or an online merchant, a knowledge of how credit card fraud works and what you can do to prevent it can reduce your risk and your fraud-related expenses. A number of systems and procedures will help prevent credit card fraud and reduce your financial risk Credit card fraud often includes receiving products or services without paying, and it's frequently related to identity theft. In the U.S., the Federal Trade Commission monitors identity theft and reported a 21 percent increase in Credit card fraud, however, decreased for several years in a row -- as a percentage of transactions. The American Bankers Association reports that more than 10,000 card transactions are made every second around the world. THE COSTS OF FRAUD According to LexisNexis, credit card fraud costs bank credit card issuers about $1 billion annually. LexisNexis conducted a study in 2010 on the true cost of fraud in the U.S., researching more than 1,000 merchants, financial executives, and 5,000 consumers. The study found that merchants pay more than three times the dollar value on fraudulent transactions. In the UK, fraud in 2006 was estimated at 535 million, or about $ million in U.S. dollars. Most of the credit card fraud in the U.S. hits the card issuers hardest, as they absorb most of the fraud losses. A Boston-based research firm analyzed fraud prevention systems and found that two main types of credit card fraud include card not present (CNP) transactions and counterfeit or lost/stolen cards. If a stolen credit Credit card fraud costs credit card issuers about $1 billion annually card is used to purchase from your company, you can be liable when the legal cardholder challenges the transaction. Illegitimate transactions are far too common; in 2005 MasterCard revealed that someone had compromised the network of CardSystems Solutions, a transaction processor for more than 40 million cards, including Visa and MasterCard. Users' CREDIT CARD FRAUD REPORT ~ 2011 BinBase.com ~ sales@binbase.com ~ Page 1 of 6

3 information was compromised, including names, account numbers, and verification codes. In 2009 Bloomberg Business Week reported that online banking fraud had increased by 55 percent during the first two quarters of the year. Despite a decrease in the overall amount of credit card fraud in the UK, annual losses from online banking fraud run close to 80m. Financial Fraud Action UK has warned that online fraud is increasingly sophisticated with the use of malware and phishing scams. Online security measures, though, are effective in reducing fraud. Security systems (for example, those that require the cardholder to use a password for online purchases) have contributed to an 18 percent reduction in fraud. U.S. merchants reject 1 of 9 orders for suspected fraud. Yet fraud is big business, with huge losses -- UK card fraud losses totaled 232.8m in the first half of Internet sales have risen about 20 percent each year since 2000, according to CyberSource, a credit card payment gateway. Though there has been a reduction in the percentage of fraud, reported losses from North American e-merchants increased from $1.5 billion in 2000 to $3.6 billion in And the fraud rates outside the U.S. are higher -- CyberSource's annual report estimated that U. S. merchants reject for "suspected fraud" one of every nine international orders. Why? Just in the year 2007, nearly 4 percent of the orders U.S. merchants shipped to other countries were later categorized as fraud. WHO LOSES? Losses are divided among merchants, card issuers, and acquirers but the majority of losses affect card issuers. This is primarily because when a merchant accepts a credit card on site, as long as the charge is authorized, the merchant gets paid. If the merchant complies with regulations and takes the proper steps to verify the card, the card issuer pays, even if the card was stolen. An authorization for a credit card purchase does not always guarantee that the merchant will be paid. It means only that the card is good at that moment. CARD AUTHORIZATION: Authorization approval, though, doesn't always guarantee payment for the merchant -- it just means that the card hasn't been reported as lost or stolen, and at the time of authorization, the transaction funds were covered. If the card is indeed stolen (or even if it's not), the cardholder can later dispute the charge. CREDIT CARD FRAUD REPORT ~ 2011 BinBase.com ~ sales@binbase.com ~ Page 2 of 6

4 THE COST OF CHARGEBACKS: When cardholders dispute transactions, online retailers are hit with chargebacks. The card issuer will reverse the amount of the purchase, and assess an additional merchantbank fee of $5 to $35 per transaction. If the cardholder reports it to your bank, regardless of the reason for the chargeback, you are assessed a fee for the chargeback. HOW IT STARTS Credit card fraud can start with the theft of a card or the compromise of the account data. Data compromise often occurs without the knowledge of the cardholder -- or the issuing bank or the merchant. Cardholders usually report stolen cards quickly, but a compromised account may take weeks or even months for evidence of fraud to become apparent. A stolen card is only usable till the cardholder notifies the bank of its theft, but unauthorized purchases can be made till the card is canceled. VERIFICATION Though many merchants require some form of I.D. or verification with a card purchase, self-serve systems such as kiosks or gas stations are easy targets for stolen cards -- verification of the cardholder's identity is limited or non-existent. Many merchant systems require that the cardholder keys in a ZIP code or PIN number for authorization. Some card issuers encourage verification processes; Visa, for example, offers lower transaction rates to merchants if they require a customer's ZIP code at purchase. Card issuers also use software that estimates the fraud probability. Too many purchases on one day, or large purchases a long distance from the cardholder's residence, may trigger a hold on the card, rendering it unusable until the legitimate cardholder has authorized its use on The Federal Trade Commission estimates that as many as 10 million Americans suffer some type of identity theft each year. the phone with the issuer. These software systems can instruct the merchant to decline the transaction -- or even instruct the merchant to retain the card or call the card issuer for verification. CNP TRANSACTIONS Online transactions are a major source of fraud against merchants, and online sales comprise the largest bloc of "card not present" or CNP sales. Though safeguards can reduce the risk of fraud associated with CNP transactions, the risk is still considerable enough that many card issuers charge a larger transaction rate for these sales. CREDIT CARD FRAUD REPORT ~ 2011 BinBase.com ~ sales@binbase.com ~ Page 3 of 6

5 The liability for fraud is shifted from the card issuer to the merchant for these transactions, and the merchant is liable for chargebacks even if the bank has authorized the sale. After this type of fraud, the card processors often increase their rates, citing increased risk, so the merchant pays not only the chargeback, but also a chargeback fee and then an increased rate for future transactions. After a set number of such fraudulent transactions, the merchant can even lose the account with the credit card processor. Too many records of credit card risks your account with your credit card processor. With on-site credit card transactions, the issuing bank is responsible for losses from fraudulently acquired goods or services. But CNP sales move that liability to the merchant for the cost of the fraud -- and all online transactions are CNP sales. Online merchants, therefore, need extra protection in place, with precautions to reduce fraud exposure and related financial losses. Fraud prevention systems, though, are a balancing act for online merchants. Customers expect to use credit cards in a simple process without too many additional steps for verifying the cards. Online merchants risk losing sales when customers find the transaction process tedious or burdensome. Because of laws limiting cardholder liability, and because of banks' policies limiting customers' liability, consumers have little Both federal laws and bank reason to advocate for or accept increased policies limit cardholders security measures. Online merchants liability for stolen cards or for sometimes use additional services offered by purchases later deemed the credit card companies offer, such as fraudulent. MasterCard SecureCode or Verified by Visa -- but such protections can sometimes risk losing sales with customers who want the "quick and easy" online sale. AVOIDING CREDIT CARD FRAUD Credit card fraud costs issuers and cardholders and issuers hundreds of millions each year. Reducing or eliminating fraud is best addressed by pro-active measures including card verification, transaction authorization, and identity confirmation. An approval code for a purchase does not mean a transaction is legitimate, and it doesn't mean you won't be hit with a chargeback. The approval code means the card is active and funds are available at the time. Far more important for verifying a card is the Address Verification Service (AVS) response code. You can get an AVS code for all online transactions from your payment gateway. There are three characters in the AVS code. The first is generated from the cardholder's address, and the second number is related to the ZIP code of the cardholder. The third number is used to verify the first two. An AVS code of YYY indicates that the address matches, the ZIP code is correct, and both the address and ZIP code match. If you receive CREDIT CARD FRAUD REPORT ~ 2011 BinBase.com ~ sales@binbase.com ~ Page 4 of 6

6 an AVS response of NYZ, that means "no" on the address match, "yes" on the ZIP code match, and "Z" because only the ZIP code is correct. If your company uses an online system for authorization such as authorize.net, you can configure your account to get the AVS response codes. Though most payment gateways will accept non-u.s. cards and can provide approvals for these, many of them can't provide the AVS response codes for cards from other countries. USING THE BIN DATABASE: A number of systems and programs will help prevent credit card fraud, but a BIN database is one of the most effective tools to reduce your financial risk. The Binbase.com database allows you to cross-reference details on individual cards, and to verify that the cardholder is legitimate. Each of our detailed records includes 11 different semicolondelimited fields, including information to identify credit cards, debit cards, prepaid cards, and others. We have records in the database. There is no larger or more up-to-date BIN database available on the internet, and all of our 111,707 records are complete none of our records are missing data fields. The database is regularly updated, and your license includes free updates. BinBase.com REPORT: credit card fraud This report is 2011 BinBase.com and may not be reproduced or distributed without permission of the publisher. For more information, contact sales@binbase.com CREDIT CARD FRAUD REPORT ~ 2011 BinBase.com ~ sales@binbase.com ~ Page 5 of 6