Frictionless Experience with Verified by Visa. Risk-based authentication case study

Transcription

1 Frictionless Experience with Verified by Visa Risk-based authentication case study

2 How a risk-based approach to Verified by Visa enables issuers to improve the cardholder experience, increase transaction volumes and reduce costs. Many issuers are changing the way they implement Verified by Visa. By evaluating transactions in realtime, and only seeking additonal cardholder authentication for the small proportion that appear to be risky, issuers can remove friction from the online checkout experience. Everyone benefits: the issuer, the retailer and the cardholder. And at the same time, issuer support costs plummet, and fraud losses remain reassuringly low.

3 About Verified by Visa Based on the 3D-Secure protocol, Verified by Visa is a way to bring additional security to online transactions. When a merchant supports Verified by Visa, the issuer intervenes in the online checkout process. Traditionally, issuers enrol cardholders in their Verified by Visa service. Then, whenever an online transaction is attempted at a merchant that supports Verified by Visa, cardholders are asked to authenticate themselves to the issuer using a passcode. For the issuer, this reduces fraud rates. Meanwhile, the merchant benefits from a liability shift, meaning they are protected from fraud losses. A majority of European e-commerce transactions are now protected by Verified by Visa. However, the cardholder experience has come under criticism and some merchants complain that Verified by Visa can have a negative impact on conversion rates. Consequently, Verified by Visa is evolving and one of the big breakthroughs is risk-based authentication.

4 What is risk-based authentication? With risk-based authentication, issuers can take a more selective or segmented approach to Verified by Visa. Instead of requiring all online transactions to be actively authenticated, irrespective of their characteristics, issuers can identify the small proportion that look in any way suspicious typically around 5% of the total.

5 So how does it work? With risk-based authentication, instantaneous checks are automatically run on online transactions. Depending on the vendor who is supplying the riskbased authentication solution used, these may include: Behavioural checks Does this cardholder typically transact online? Do they typically make this type of purchase? Do they typically transact in this currency? Device checks Is this the device typically used by this cardholder? Where is it located? 95% For low-risk transactions typically up to 95% of transactions the issuer can be confident that an authentic cardholder is conducting a genuine transaction, and no further checks are necessary. Merchant checks Does this fit the type of transaction expected from this merchant? Does this merchant typically generate a high proportion of fraudulent transactions? These checks are typically run within a self-learning risk engine. Consequently, as it is exposed to an ever-higher volume of transactions, the more accurate it becomes. Based on these assessments, the issuer determines how best to treat each transaction. 5% 0.2% For higher-risk transactions typically around 5% of transactions the issuer can invoke a step-up or active authentication method. For highest-risk transactions typically around 0.2% of transactions the issuer can deduce that the transaction is very likely to be fraudulent and decline it accordingly.

6 So how does it work? With such a small proportion of transactions deemed to be higher risk, the issuer can invoke a strong and appropriate authentication method. Depending on their own capabilities and the vendors they work with, this could include dynamic passwords, the type of challenge questions used in their existing online banking solutions, or one-time-passwords delivered via SMS text messages or push messages. Risk-based authentication solutions are available from a number of vendors. As hosted solutions, they can typically be integrated with an issuer s own IT architecture, and/ or they can work in parallel with the services provided by a third party processor. 85% Reduction 70% Reduction 5% of 0% increase 85% Fewer in checkout time when compared to previous 3DS solution in abandonment when compared to previous 3DS solution customers challenged with risk-based approach in fraud when compared to previous 3DS solution inbound calls relating to password resets

7 What are the benefits of risk-based authentication? Risk-based authentication offers tangible benefits to all parties: 1Issuers benefit The drop-out or abandonment rate of Verified by Visa transactions is significantly reduced which translates to higher transaction volumes, higher e-commerce revenues and more satisfied cardholders The volume of cardholder calls to issuer call centres for Verified by Visa password re-sets sees an even more significant reduction which translates to reduced costs The underlying fraud rate remains consistent for both active and risk-based authentication which means that fraud costs remain low Depending on the way the solution is implemented, there may be no need to enrol individual cardholders into Verified by Visa which, again, brings reduced costs

8 2Cardholders benefit The speed, simplicity and convenience of the checkout process is improved which translates to a better customer experience For higher risk transactions, step-up authentication is invoked which can bring a sense of reassurance to more cautious online shoppers 3 Merchants and acquirers benefit The drop-out or abandonment rate of Verified by Visa transactions is significantly reduced which translates to more transactions, higher conversion rates, increased sales and more satisfied customers The volume of customer support calls and enquiries is reduced which translates to reduced costs

9 The UK experience significant, tangible, quantifiable benefits In the UK, several issuers have been using risk-based authentication for a number of years, and the benefits they have experienced are detailed over the next two pages.

10 Commerce ransaction Real-time Risk Assessment (rare) 5% High Risk (minority) 95% Low Risk (majority) Mandatory Authentication Continue Purchase Abandon rate (%) Abandonment and Fraud Rates Before risk-based VbV implemented After risk-based VbV implemented Fraud rate (basis points) Call volume Abandon rate (%) Before risk-based VbV implemented After risk-based VbV implemented Fraud rate (basis points) Call volume Fraud Rate Aban. Rate Reduced customer calls for password resets Before VbV im '+$,-./0-$ $678-$940$:-04;84/.<$=/8< $ >?5$@4A/B-$ =C75"$678-$ 172A/0-$678-$$ Fraud Rate Aban. Rate *"!!#$ Before risk-based VbV implemented After risk-based VbV implemented Call Volume )"!!#$ ("!!#$ '"!!#$ Data supplied by CA Technologies and RSA

11 A better user experience Less friction with only 5% of transactions deemed to be higher risk, 95% of transactions now require no cardholder authentication Faster transactions Increased speed following the implementation, average transaction times reduced from 50 seconds to ten seconds Increased transaction volumes and e-commerce revenues Higher conversion rates following the implementation, abandonment dropped from over 4% to under 1% Cost savings Fewer customer calls following the implementation, customer requests for password resets tumbled by 85% Stable fraud levels Low losses despite the elimination of active authentication on 95% of transactions, e-commerce fraud levels remained reassuringly low

12 At Visa Europe, we can provide additional advice on how you could implement and benefit from risk based authentication.