Protecting Consumers from Card and other types of Fraud. What the consumer needs to know. How can we combat the rise in fraud

Transcription

1 Protecting Consuers fro Card and other types of Fraud What are the trends What the consuer needs to know How can we cobat the rise in fraud What are the future threats

2 Card Fraud What is Card Fraud: Card fraud is a general ter for theft and fraud coitted using a credit card or any siilar payent echanis as a fraudulent source of funds in a transaction. Card skiing is the act of stealing data fro the agnetic strip on a credit card or debit card Card skiing at ATM achines feature iniature caera devices which record cardholders entering their PINs

3 Prevention and 5 Golden Rules Never let your credit card or debit card out of your sight such as in restaurants or shops Shred all official docuents and credit card receipts Never tell anyone your PIN, even if they clai to be fro your credit card copany or fro the police A different PIN for every credit card and debit card. This will ake the fraudster s job ore difficult Make sure the site you are visiting is a genuine site and not a phishing site.

4 Card Fraud Type on UK issued credit and debit cards. Source FFA UK Phone, internet and ail order fraud (Card-not-present fraud) Counterfeit (skied/cloned) fraud % +/-09/ % % Fraud on lost or stolen cards % Card ID theft % Mail non-receipt 15.4 TOTAL Contained within this total: % % UK retail face-to-face transactions % UK cash achine fraud % Doestic/International split of total figure: UK fraud Fraud abroad % %

5 GBP illions Fraud Losses on UK Issued Cards NB. Fraud Data shown is Gross Loss 2010 = Lost or Stolen Card Mail non-receipt Counterfeit fraud 3rd Party Application fraud Theft of Card Details (CNP) Account Takeover (ACTO)

6 The Advance of Chip and PIN The ap below shows the state of play regarding chip and PIN rollout in shops and businesses, giving an indication of how likely cardholders are to be asked for their PIN rather than signing a receipt

7 ATM The introduction of privacy spaces, which coprise a zoned area arked on the ground in front of the cash Machine is one way of cobating crie

8 Cash achine safety Put your personal safety first. If soeone akes you feel uncofortable ove to another achine When travelling only take cards with you that you intend to use; leave others in a secure place at hoe Make sure your card copany has up-to-date contact details for you, including a obile nuber If your cards are registered with a Card Protection Agency, ensure you have their contact nuber and your policy nuber with you When you have travelled overseas and get back Check your card stateents carefully for unfailiar transactions If there are any, report the to your card copany as soon as possible.

9 Banking safely online Up to date anti-virus software and a firewall installed Latest security updates on your browser/operating sy ste Before you bank online ensure that the locked padlock or unbroken key sybol is showing in your browser Bank s internet address should change fro http to https when a connection is secure Be wary of unsolicited eails, known as phishing eails, requesting personal financial inforation. Your bank or the police would never contact you to ask you to disclose the PIN Always access internet banking sites by typing the bank s address into your web browser

10 Shopping On-Line Sign up to Verified by Visa or MasterCard SecureCode whenever you are given the option Only shop on secure sites; before subitting card details ensure the locked padlock or unbroken key sybol is in the browser Print out your order and keep copies of : retailer's ters and conditions, returns policy, delivery conditions, postal address (not a post office box) phone nuber (not a obile nuber)

11 Man in the Browser Attack Designed to intercept data as it passes over a secure counication between a user HTML injection to display socially engineered pages Injecting a field into a page asking for the user s ATM PIN nuber in addition to their usernae and password) Real-tie integration of Trojans with ule account to aid in the transfer autoatically of oney Trojans are capable of perforing session hijacking taking control of a legitiate session while the user is logged into their account

12 Social Networking Threat The enorous popularity of social networking sites with the volues involved contributes to MITB attacks The sheer global reach and traffic volues have ade the a prie target for exploitation - up to 20%of online attacks are targeted at social networking sites (Source RSM) Social networking is an effective ediu for fraudsters as users are ore relaxed and less suspicious when using this counication channel Ultiately this has one result an exponential growth in the nuber of Trojan infected achines such as Zeus a truly powerful virus Zeus, which is capable of conducting real-tie transfers to a designated ule account.

13 Conclusion Criinals are continually evolving their tools and tactics to work around the defences established by the ost security-conscious organizations Man-in-the browser attacks are seen as the ost potentially daaging - affecting worldwide usage The point of least resistance in ost cases is the end user (consuer) not the organisations Organizations and Consuers ust use a cobination of tactics: The use of transaction onitoring to ascertain risk Trojan detection, shutdown and intelligence, Out of band capabilities which include regular postal ail, the telephone, or text essage to create a better defence.