Managing Card Compromises from the Issuer s Perspective

Transcription

1 Managing Cad Compomises fom the Issue s Pespective Industy insides shae tips fo effectively managing mass compomises Numbe 60 June 2012 Lage-scale payment cad compomises and account data beaches continue to occu with fequency yea afte yea, with the numbe of cadholdes affected sometimes eaching statling levels. As a esult, savvy cad issues have adopted a isk-based appoach to managing these events. Instead of boad-bush methods, they e using moe focused, scalable and cost-effective methods that minimize the numbe of customes inconvenienced. Recent cad compomises have put as many as 24 million accounts at isk The success of these new methods depends on issues having systematic pocesses fo deciding which cads ae most at isk fo faud, and fo taking coect and timely actions based on these decisions. A ecent FICO suvey, howeve, suggests that moe than 80% of issues ae stuggling with vaious aspects of these pocesses. This white pape synthesizes best pactices shaed with us by a task foce of leading issues woking towad bette management of cad compomises. It coves tips fo: Helping to identify the compomise location. Assessing the level of faud isk fo compomised cads. Minimizing loss and impoving custome communication duing eissue of high-isk cads. Managing lowe-isk cads ove the longe tem. While ou task foce compised US issues, many of the tips hee have poven successful fo cad issues in othe counties as well. Make evey decision count TM

2 Managing Cad Compomises fom the Issue s Pespective»The» Always-Changing, Neve-Abating Battle Thefts of cadholde infomation that put lage numbes of accounts in ham s way have become a fequent item in the news and a constant fact of business life fo cad issues. As shown in Figue 1, the favoite taget of the moment shifts as ciminals seek out the cuently most vulneable and elatively least isky (fo them) points of attack. Figue 1: Shifting faud concentations US PIN points-of-compomise FICO Cad Alet Sevice statistics PERCENTAGE OF CASES 100% 80% 60% 40% 20% 0% In 2010, fo instance, thee was a concentation of PIN debit cad compomises at US bank ATMs, too many of which wee undepotected. Banks took measues to shoe up defenses, howeve, and that, along with media attention that bought inceased public awaeness, seems to have shifted the focus of faudstes back to etail point-of-sale teminals. In 2011, these again wee the pedominant locus fo PIN debit cad skimming. Meanwhile, in 2012 so fa, the headlines have included a data beach at Zappos, a majo online etaile, exposing as many as 24 million customes to the potential fo faud o identity theft. The aftemath of this cime has included plenty of media excoiation and seveal individual and class-action law suits against the company and its paent, Amazon.com. 1 A few months late, thee wee epots that up to 10 million cedit and debit cads may have been compomised in a beach at Global Payments, a US-based cedit cad pocesso. 2 And at about the same time, the Massachusetts Office of Consume Affais and Business Regulation published a epot showing that as a esult of some 1,800 data beaches ove the past 4 yeas, some 3.2 million people nealy half of the state s esidents have had thei pesonal infomation lost o stolen Souce: FICO Banking Analytics Blog Fai Isaac Copoation. I don t feel secue with that bank any longe. I was upset, haven t got eimbused fo the money lost and it caused me the inconvenience of filling out foms and waiting (who knows how long?) to get my money eimbused. Comment posted on CNNMoney.com Apil 17, 2012 LEGEND POS ATM Non Bank ATM Bank The impact on custome satisfaction fom having tansactions declined and cads blocked and eissued is obvious to anyone who spends a few minutes looking at consume-oiented blogs o Twitte posts on the topic. The dange fo issues is that upset customes may switch to competitos. Full-sevice banks isk undecutting thei own effots at building multi-faceted, moe pofitable elationships with existing customes. 1 Zappos, Amazon sued ove custome data beach, MSNBC, Jan 18, Global Payments data beach exposes cad payments vulneability, Fobes.com, Apil 3, m in Mass have had data lost, stolen, boston.com, Apil 24, page 2

3 Managing Cad Compomises fom the Issue s Pespective»» A Risk-Based Response Is Essential, Though Not Always Easy The fequency and scale of these cad compomises makes it essential fo issues to adopt isk-based esponses. Pevious boad-bush methods of blocking and eissuing all compomised cads ae wasteful, costly and disuptive. Howeve, the challenge fo financial institutions is how to know which cads ae most at isk and how to take popotionate, timely action that balances thei fiduciay esponsibility with the need to minimize custome impact and opeational costs. Figue 2: Issue top challenges in managing cad compomises 10% LEGEND 4% When to block and eissue Custome communication Lack of automation and tools 42% Cad fulfillment issues Not enough pesonnel A ecent infomal FICO suvey of seveal hunded US financial institutions showed that the majoity of institutions ae stuggling with these challenges. As shown in Figue 2, moe than 40% of espondents cited decision making as the single geatest challenge in managing cad compomises. Anothe 28% pointed to lack of automation and tools fo taking systematic, efficient, tageted action. Custome communication was the biggest issue fo 16% of the financial institutions. 28% 16% The best pactices discussed in this pape addess these thee top challenges. They e the secet ecipes fo success that 30 voluntee issues fom a FICO-hosted Managing Cad Compomises Woking Goup found to be most effective at minimizing faud losses, most wok-fiendly to thei intenal pocesses, and most customefiendly to thei cadholdes.»» Issue Best Pactices fo Risk-Based Decision Making To avoid blocking and eissuing cads unnecessaily, financial institutions need timely ways to detemine the goup of cads put at isk by a skimming event, data beach o othe cime, and diffeentiate among cads in the goup based on faud isk level. Identifying the point of compomise To identify compomises that span the gambit fom cedit to ATM, many cad issues use faud detection sevices, such as the FICO Cad Alet Sevice, while also ceating thei own tools and pocesses to aid in the ealy identification of at-isk cads. The following ideas ae excellent examples of the pocedues that many issues have implemented to help identify a common point of puchase whee the compomise is likely to have taken place. Examine six months of accountholde activity based on emeging faud pattens that involve a specific geogaphic aea o simila tansaction type, like PIN POS (point of sale), signatue POS o ATM. page 3

4 Managing Cad Compomises fom the Issue s Pespective»» If you have a goup of cadholdes linked to the same faud case, eview the histoies of the newest cadholdes fist. New cadholdes tend to have significantly less tansactional histoy to eview, so stating with them can save time and incease accuacy. Make evey attempt to ignoe nationally known mechants until you have exhausted all othe possibilities. Lage numbes of tansactions conducted at nationally ecognized mechant locations can impede the outcome of the analysis. If seveal cads in a combined case have only been used once at a specific location, thee is a highe likelihood that one of these locations will be the point of compomise. Examining the unique tansaction dates of the known faud cads tied to a common point of puchase can help to identify a compomise date ange. Fo example: Faud cad A pefomed a single tansaction on Apil 01, 2012, at the suspected point of compomise. No othe faud cads wee used at this location pio to this date. Faud cad J was used once on July 04, No othe faud cads wee used at this location afte that date. Compomise date ange would likely be Apil 01, 2012, to July 04, I am simply too busy to keep evisiting a single cad much less second-guess my decisions. I have to be able to make a fast decision and keep on moving to my next task. Membe of the FICO use community Use the suspected point of compomise date ange to identify all cads tansacting at that location within that window of time. These ae the at-isk cads the highest-isk cads associated with the compomise location. It may be helpful to contact local cad issues and ask them if they ae seeing the same pattens and compomise date anges. Assessing the faud isk Cad issues have to be able to evaluate the cuent isk pictue on a daily basis to detemine what faud-mitigating actions to take next. The following best pactices help with the assessment of cuent losses, while enabling the issue to logically pioitize a wokflow and theeby avoid the inefficiencies of woking the same cad moe than once. Detemine the ate of faud (ROF) fo the goup of at-isk cads. Examine all cads to see how many of these accounts have aleady been closed because of faudulent activity. Divide the numbe of cads with faud by the total numbe of cads in the compomised goup to find the pecentage. Cad issues should individually detemine what ROF pecentage will escalate cad eissuance. Fo example: 850 cads appea on a faud alet fom a thid-paty sevice. Of these, 283 cads have aleady been closed due to faud o epoted as faud by customes. Dividing 283 by 850 esults in a 33% ROF. page 4

5 Managing Cad Compomises fom the Issue s Pespective Revisit you faud stategies and faud claims in tandem. Review cuent faud claims tied to the compomise to see if these faud losses ae aleady managed by cuent faud stategies. Issues may need to pefom a full cad eissuance if existing o new faud stategies ae unable to mitigate the losses. Look at isk exposue on closed and open loop payment cads. Peemptive action to eissue these cads is geneally not advisable unless thee ae substantial numbes of them with peloaded values of $300 o moe. Detemine in advance how many faud claims will be necessay to initiate moe aggessive cad eissuance. Below this theshold, at-isk pepaid BINs should emain in the faud eview pocess to monito the ROF and take action if it ises above the theshold. Sot the entie goup of cads by expiation date. Those natually expiing within the next 30 to 90 days should be eissued immediately, as a simple, outine eplacement. This technique emoves these cads fom those equiing explicit anti-faud teatment. At the same time, it eliminates a substantial amount of the nea-tem faud isk ciminals also sot goups of compomised cads by expiation date so that they can use them befoe expiation. Look at how ecently faud losses fom this compomise have occued. Compomised cads that ae faudulently tansacting today epesent a fa geate isk potential than compomised cads that have aleady peaked in tems of faud spend. Isolate and emove any cads that have aleady been eissued fo any eason AFTER the date ange of the compomise, since thee s little isk of faud on these cads. Detemine if this goup of at-isk cads epesents immediate isk potential. Calculate the faud exposue by multiplying the numbe of emaining at-isk cads against the aveage faud loss fom the cluste. Fo example: In a compomise goup of 1,000 cads, 250 cads have been closed due to faudulent activity with an aveage loss of $378 pe cad, esulting in a cuent oveall loss of $94,500. Loss exposue fo the emaining 750 open cads would be $283,500. Identify cads that ae involved in moe than one compomise, which significantly escalates the odds fo unauthoized use. Coss-counting the numbe of compomise events is, theefoe, a ecognized method of detemining when to eissue. Reissue is ecommended when: An account has been involved in both a cad-pesent and a cad-not-pesent event within the last 365 days. An account is listed on moe than thee compomises, which also significantly escalates the odds fo unauthoized use. page 5

6 Managing Cad Compomises fom the Issue s Pespective Issue Best Pactices fo Managing Risk with Efficient, Tageted Action Once issues have sepaated cads within a compomised goup by faud isk, they have the means to take efficient, tageted actions to mitigate that isk. Reissuing highe-isk compomised cads Identify cads associated with high-net-woth customes. These cads should geneally be eissued pomptly. Pompt action not only educes exposue amounts, it also povides an oppotunity to demonstate excellent sevice and inteact with valuable customes. Figue 3: Geneal decision guidelines based on compomise type Compomise Type Risk Potential Recommended Action Full tack data & PIN Magnetic stipe only Non-magnetic stipe (account numbe, CVC2, expiation date) High isk of PIN countefeit faud High isk of point-of-sale (POS) faud Risk of money ode/telephone (MOTO) o cad-notpesent (CNP) faud Pefom full cad eissuance Undetake isk assessment at individual cad level to detemine appopiate isk mitigation actions Ceate business ules fo high countefeit isk and isolate cads fom geneal potfolio Conside eissuing highe-isk cads Undetake isk assessment at individual cad level to detemine appopiate isk mitigation actions Ceate business ules to combat CNP faud Do not eissue diectly sequential cad numbes. Randomizing the cad numbe sequences and expiation dates can help to pevent one cad fom being used to exploit hundeds moe by ciminals who ty to guess an issue s cad o expiation date pactices. Avoid eissuing cads with the same cad numbe/pan (pimay account numbe). Be sue to include a new CVV/CVC within the magnetic stipe to maximize the secuity of the newly issued cad. Limit cetain tansactions duing the eissuance pocess. (Check to make sue that this pactice does not conflict with fedeal o state egulations.) Limits should be based on the natue of the compomise. Fo example: If the compomise involves PIN captue, block PIN tansactions fo high-isk cads. The cadholde would still be pemitted to make signatue tansactions until the newly issued cad is activated. Conside loweing daily limits until a new cad can be activated by the cadholde. Lowe limits educe isk and may not even impact the typical cadholde, who neve fully maximizes daily limit thesholds. Eliminate delays by making sue that all components of the cad fulfillment pocess ae eady fo immediate action. Set up digital plastics o white plastics whee the cad atwok is applied to white cad stock at the time it is poduced/embossed. page 6

7 Managing Cad Compomises fom the Issue s Pespective Make sue thee is adequate cad plastic in stock at all times fo a majo cad eissuance. Some ecent data beaches have caused consideable delays in cad eissuance due to ovewhelming demand. Have envelopes and othe pinted mateials available in adequate quantities to suppot a majo cad eissuance. Ceate statement insets using on-demand pinting methods to eliminate the need to keep lage amounts of supplies on hand and enable poduct/ageement/disclosue changes to occu moe easily. Consult cad fulfillment patnes to see what options ae available. Monitoing and managing lowe-isk compomised cads Most compomised cads that ae not eissued should be monitoed fo a peiod of time. Watching fo a ising ROF and subjecting the cads to additional ules o detection enables issues to manage thei elevated faud isk. Hee ae some tips fom Woking Goup membes to moe effectively pefom these citical functions of eissuance and monitoing: Ceate a database and impot all at-isk cads not undegoing nea-tem eissuance. Feed the database daily with emeging infomation, such as faud claim data, confimed faud tansactional data and closed cad vs. open cad data. Review the updated data on a weekly basis to identify any cads whee faudulent activity is inceasing to the point whee moe aggessive action is equied. Use a decision matix to detemine when to elevate the level of esponse. Factos might include goss faud losses that meet a pedetemined theshold amount, o ROF that inceases to a cetain pecentage. Take action when the faud pattens being seen ae not easily contolled with cuent faud stategy ules. Fo example: A faud ule that was ceated to deny tansactions in a specific county now needs to be expanded to include othe counties whee the faud has shifted since the oiginal ule was witten. Use flagging as an altenative o supplement to database monitoing. Flag cads when faud alets ae eceived. Pocess flagged cads though additional anti-faud stategies that focus on locations whee the flagged cads ae tansacting. Fo example: Wite an out-of-band ule to identify any tansaction on a flagged cad that occus 100 miles o moe fom the cadholde s addess. page 7

8 Managing Cad Compomises fom the Issue s Pespective Wite ules that apply flags to tansaction elements, such as mechant categoy codes (MCC), authoization amounts o velocity of cetain types of activity. Fo signatue POS tansactions, fo example, such ules might include: By MCC, cad pesent, >$99, > 300 miles fom home addess. By MCC, cad pesent, >$99, in a specific state o county. Gas tansactions (5541), > o = 3 tansactions in 24 hous. Set expiation dates on flags to pevent continuous, needless monitoing. Regulaly eview soon-to-expie flags in case any equie a time extension. Review daily epots that highlight cuent and changing status on the most isky aspects of compomised cads. These might include custom epots on all intenational cad-pesent tansactions and all tansactions declined due to authoization-blocking ules.»» Issue Best Pactices fo Custome Communication Effectiveness Financial institutions today ae acutely awae of the need to impove communication with customes. It s the bedock of thei effots to etain and build moe pofitable elationships. Thee ae some excellent new ways to do this, thanks to technology advances and the boad acceptance of mobile devices with SMS (shot message sevice) and othe texting capabilities. Moe and moe financial institutions ae leveaging these to add innovative methods to thei taditional modes of custome communication. Hee ae some tips fom Woking Goup membes fo communicating with customes effectively duing management of cad compomises: Account alets. Encouage cadholdes to set up thei own accounts fo alets to be deliveed in eal time via thei pefeed communication channel ( , smat phone via SMS, etc.). Account alets ae valuable communication tools fo instantly eaching cadholdes to advise them of a significant tansaction, like a high-dolla ATM withdawal, that could be faudulent. Secue communication. Recognize that the most secue way to communicate with you customes is by posting all confidential communications inside a secue online banking website. Requie customes to sign in and pass authentication challenges befoe viewing sensitive messages. Communication templates. Ceate communication content, such as call scipts, lettes and FAQs in advance, to be able to each out to cadholdes at a moment s notice in the event of a vaiety of faud schemes. Make sue legal expets eview all content befoe it is distibuted to customes. As a stating point fo issues, FICO has posted a sample call scipt, notification lette and online banking FAQ document on the FICO Banking Analytics Blog. page 8

9 Managing Cad Compomises fom the Issue s Pespective Two-Fisted Defense fo Managing Cad Compomises Fo maximum faud defenses both poactive and eactive ely on these fully integated FICO solutions: FICO Cad Alet Sevice is an issue-based ATM faud detection sevice in the US. It analyzes daily ATM tansactions acoss a netwok of moe than 10,000 financial institutions to pinpoint common points of compomise, while also identifying at-isk cads befoe the majoity incu losses. The sevice analyzes moe than 65% of all daily ATM tansactions in the US. FICO Falcon Faud Manage is the most accuate and compehensive solution fo detecting payment cad faud woldwide, educing losses by up to 50%. The solution detects faud acoss multiple channels (online banking, ACH, banch, etc.) and fo both cedit and debit cads. It includes cutting-edge analytics that adapt detection to changing faud pattens and cadholde behavio in the poduction envionment, enabling the detection of up to 44% moe faud. How FICO Solutions Help Potects against multiple countefeit cad faud, skimming and mass compomise isk Identifies cad and PIN compomise locations at POS and ATM teminals, mechants and pocessos Analyzes multiple cad ATM withdawal pattens to identify countefeit cad faud acoss a wide spectum of issues Pefoms pedictive isk analysis of compomised cads based upon faud pattens affecting multiple issues Potects against multiple types of cad faud, including cad not pesent, coss-bode faud, countefeit faud, lost and stolen cad faud Pofiles individual cadholde behavio, mechants and ATM devices to detect the most cedit and debit cad faud at the lowest false positive atios Pioitizes faud alets to enable assignment of faud opeation esouces to cases that ae most likely to be faud Flags cadholde accounts to identify and segment compomised cads fo specialized monitoing Enables the development of unlimited ule stategies to manage flash faud and compomise events FICO Cad Alet Sevice FICO Falcon Faud Manage page 9

10 Managing Cad Compomises fom the Issue s Pespective»»»Conclusion» Lage-scale payment cad compomises and account data beaches have become an unfotunate featue of moden life. Savvy issues have esponded by adopting isk-based management appoaches that ae scalable and cost-effective no matte how many cads and accounts ae affected. These methods balance fiduciay esponsibility with the need to minimize custome impact and opeational costs. The bette the issue handles the details of isk-based compomise management, the geate the benefits to the institution and its customes. Issues adopting best pactices and efining them fo thei paticula equiements gain advantages in loss mitigation and custome satisfaction. Lean moe: Join the faud discussion on Faud Alet Netwok. Registation is complimentay, and esticted to law enfocement and financial institution pesonnel. Paticipate in the fee monthly faud webina, Combating Faud Though Pee Communication. The seies allows hundeds of financial institutions to shae thinking on faud tends and pevention tactics in a noncompetitive envionment. Download Insights papes on the latest thinking in faud management, oiginations decisioning, mobile communications and othe issue-elevant topics. Subscibe to the FICO Banking Analytics Blog fo additional infomation on faud theats and anti-faud best pactices. The Insights white pape seies povides biefings on eseach findings and poduct development diections fom FICO. To subscibe, go to Fo moe infomation Noth Ameica toll-fee Intenational web (0) info@fico.com FICO, Falcon and Make evey decision count ae tademaks o egisteed tademaks of Fai Isaac Copoation in the United States and in othe counties. Othe poduct and company names heein may be tademaks of thei espective ownes Fai Isaac Copoation. All ights eseved. 2878WP 06/12 PDF