Risk Mitigation in Travel. New Trends to Reduce Fraud and Increase Revenue

Transcription

1 Risk Mitigation in Travel New Trends to Reduce Fraud and Increase Revenue

2 wherever people pay

3 What We Are Going to Discuss Today 3D Secure: Turning a conversion killer into a revenue creator. Transaction Linking: Re-thinking blacklists. Leveraging transaction linking technology. General Trends: What changes are having an impact on airline risk mitigation.

4 3D Secure: Creating Revenue

5 The Worst Case Scenario 3DS Friction Forgotten Pasword

6 The Customer Experience is More Varied Enrolled without Smart Authentication: Enrolled with Smart Authentication: Not Enrolled:

7 Approach 1: Shift Refusals to 3D Secure Why Deny Transactions When You can Leverage Liability Shift? We shifted a large portion of greyarea automated risk refusals to 3D Secure instead of refusing. The result was a 8.5% increase in conversions.

8 Approach 2: Target High-Conversion Countries

9 Approach 3: Target BINs Based on Performance More and more issuing banks are using risk-based authentication.

10 Approach 4: Target BINs that are not enrolled Free liability shift for the taking. Not Enrolled:

11 Key Takeaway: Move from Binary to Dynamic 3D Secure Logic Geographic Performance Logic 3D Secure Non-3D Secure Enrollment Logic Risk Based Logic Smart Issuer Logic

12 Transaction Linking: Moving Away From Blacklists

13 The Problem Fraudsters are constantly changing attributes in an attempt to appear to be new shoppers. Maintaining blacklists is operationally arduous and non-comprehensive.

14 The Behavior of a Good Shopper Login Identities: [email protected], [email protected], [email protected] Number of Phone Numbers: 3 Number of Devices: 2 tablets, 3 laptops, 2 desktops, 2 phones Number of Countries Purchased From: 7 Number of Distinct Credit Cards: 8 (2 exp.) Anomalies: Multiple declines and AVS mismatches due to international travel

15 The Solution Eliminate blacklisting by using an asynchronous transaction-linking system: 1. Track shoppers across identities, devices, and networks. 2. Leverage for both risk mitigation and friction elimination for loyal customers 3. Provide robust visualizations to Risk Agents that tell the story of the user.

16 Another Example Fraudsters can cycle through cards easily Individual Attribute Card Number: ****1234 Manual Label Label: Card had chargeback One-Off Rule WHEN Card Number = ****1234 THEN CHALLENGE

17 Another Example Define Behavior not Attributes Generalized Velocity and Consistency Rules Rule: WHEN Shopper has had >0 chargebacks THEN CHALLENGE One-Off Rule

18 Key Takeaways 3D Secure When done dynamically, 3D Secure can be revenue positive. Transaction Linking Transaction linking algorithms surpass blacklisting in efficacy and operational overhead. Automation Decreased booking-to-trip time and industry growth make automation more attractive.

19 Questions?

20 Loss Prevention North America Card Brand Chargeback/Fraud Programs

21 Agenda Visa Chargeback Monitoring Program (VCMP) Visa Global Merchant Chargeback Monitoring Program (GMCMP) MasterCard Excessive Chargeback Program (ECP) Visa Fraud Monitoring Program (VFMP) MasterCard Global Merchant Audit Program (GMAP)

22 Visa Chargeback Monitoring Program (VCMP) Updates from Elavon

23 VCMP Thresholds Standard Program: 100 chargebacks AND 1% ratio of chargebacks-to-sales transactions Early Warning Notifications 75 or more chargebacks AND 0.75% or higher ratio of chargebacks-to-sales transactions NOTE: Chargeback reduction plans not required for Early Warning notifications

24 VCMP Stages Standard Timeline: Month 1 Notification Visa notifies acquirer that the merchant has been identified in the program. Months 2-4 (Workout Period) Acquirer/merchant must implement actions to reduce chargebacks; provide Visa with a remediation plan; acquirer must provide monthly updates to the plan. Months 5-11 (Enforcement Period) Continue to implement remediation plan. Beginning month 8 notify merchant they may lose Visa acceptance privileges and provide written confirmation to Visa. Program fees and non-compliance assessments now eligible. Month 12 (Enforcement Period) Merchant is eligible for disqualification; continue to be eligible for program fees and non-compliance assessments.

25 VCMP Fees Standard Timeline: Months 1-4 No Non-compliance assessments or program fees. Months 5-7 US $50 per chargeback Months 8-9 US $100 per chargeback Months US $100 per chargeback plus US $25,000 review fee

26 Visa Global Merchant Chargeback Monitoring Program (GMCMP) Updates from Elavon

27 GMCMP Thresholds Meet or exceed the following: 200 international chargebacks 200 international transactions 2% ratio of international chargebacks to international transactions

28 GMCMP Fees Standard Timeline: Months 1-3 No Non-compliance assessments or program fees. Months 4-9 US $100 per international chargeback If the acquirer and merchant have not implemented procedures to reduce chargebacks, a fee of US $200 per international chargeback may be assessed. Beyond month 9 US $100 per international chargeback plus US $25,000 review fee If the acquirer and merchant have not implemented procedures to reduce chargebacks, a fee of US $200 per international chargeback may be assessed.

29 MasterCard Excessive Chargeback Program ECP

30 ECP Thresholds Chargeback-Monitored Merchant (CMM) 100 chargebacks AND 1% ratio of chargebacks-totransactions Excessive Chargeback Merchant (ECM) Two consecutive calendar months of a minimum of 100 chargebacks AND 1.5% ratio of chargebacks-totransactions

31 ECP Stages CMM: CTR reporting required by the acquirer to MasterCard monthly until merchant is no longer identified as a CMM for 2 consecutive months. Tier 1 ECM: Month 1-6 Acquire must submit ECM report within 30 days of the end of the 2 nd trigger month until the merchant is below 1.5% for two consecutive months. Tier 2 ECM: Month 7-12 Acquirer may be advised by MasterCard regarding the action plan and other measures they should take or consider taking to reduce the merchant s CTR; and/or Require the acquirer to undergo a Global Risk Management Program Customer Risk Review After a merchant has been an ECM for 12 months (consecutive or nonconsecutive) the acquirer will be deemed to be in violation of the Illegal or Brand-damaging Transactions Rule.

32 ECP Fees Standard Timeline: Months 1: No fees Months 2-12: Reporting fee - US $100 for each ECM Issuer Reimbursement Fee - US $25 for each chargeback above the 1.5% threshold Violation Assessment Fee Issuer reimbursement fee times CTR divided by 100 After month 12: Noncompliance assessments of up to US $50,000 per month that the merchant remains an ECM

33 Visa Fraud Monitoring Program (VFMP)

34 VFMP Thresholds Early Warning: US $50,000 or more in fraud dollar amount AND 0.75% or higher ratio of fraud-to-sales dollar amount Standard Program: US $75,000 in fraud dollar amount AND 1% ratio of fraud-to-sales dollar amount High-Risk Program: US $250,000 in fraud dollar amount AND 2% ratio of fraud-to-sales dollar amount

35 VFMP Stages Standard Timeline: Month 1 Notification Visa notifies acquirer that the merchant has been identified in the program. Months 2-4 (Workout Period) Acquirer/merchant must implement actions to reduce fraud levels; provide Visa with a remediation plan; acquirer must provide monthly updates to the plan. Months 5-11 (Enforcement Period) Continue to implement remediation plan. Beginning month 8 notify merchant they may lose Visa acceptance privileges and provide written confirmation to Visa; and Eligible for chargebacks related to reason code 93 (Merchant Fraud Performance Program) for fraud transactions associated with current month s program identification Month 12 (Enforcement Period) Merchant is eligible for disqualification; continue to be eligible for chargebacks for reason code 93.

36 VFMP Fees Standard Timeline: Months No Non-compliance assessments Months 4-12 No non-compliance assessments; Reason Code 93 chargeback liability applies. High Risk Timeline: Months 1-3 US $10,000 per merchant case per month; Reason Code 93 chargeback liability applies from month 1 onward. Months 4-6 US $25,000 per merchant case per month; Reason Code 93 chargeback liability applies. Months 7-9 US $50,000 per merchant case per month; Reason Code 93 chargeback liability applies. Months US $75,000 per merchant case per month; Reason Code 93 chargeback liability applies.

37 Visa Global Merchant Chargeback Monitoring GMCMP

38 GMAP Thresholds Tier 1 (Informational Fraud Alert): 3 fraudulent transactions; at least US $3,000 in fraudulent transactions; a fraud-to-sales dollar volume ratio of 3% and not exceeding 4.99% Tier 2 (Suggested Training Fraud Alert): 4 fraudulent transactions; at least US $4,000 in fraudulent transactions; a fraud-to-sales dollar volume ratio of 5% and not exceeding 7.99% Tier 3 (High Fraud Alert): 5 fraudulent transactions; at least US $5,000 in fraudulent transactions; a fraud-to-sales dollar volume ratio minimum of 8%

39 GMAP Stages All Tiers: Acquirer should evaluate the fraud control measures and training procedures in place for the merchant. Tier 3: MasterCard will determine whether to initiate an audit of the merchant location. MasterCard notified acquirer. Acquirer response due within 30 days. Fraud control action plan required within 90 days. MasterCard will review for a chargeback liability period (6 months and begins on the first day of the fourth month following the Tier 3 identification). MasterCard may extend the chargeback liability period to 12 months. Issuer chargeback rights will apply for reason code 4849 (Questionable Merchant Activity).

40 Dispute Resolution February 2016 CONFIDENTIAL AND PROPRIETARY

41 EMV Liability Shift

42 EMV Liability Shift is effective in the United States for all card types. U.S. EMV Liability Shift Dates: Visa, MasterCard, Interlink, and Maestro: October 1, 2015 American Express, Discover: October 16, 2015 After October 2015, all cards in the United States are supposed to be chip cards and all terminals are supposed to be able to accept chip cards. The majority of fraud chargebacks will be chip based. Applies to Face-to-Face transactions, not Card-absent Environment transactions. Fallback transactions Occurs when a contact chip card is used at a chip-capable POS terminal but the card details are not captured via chip technology and the transaction fall-back to magnetic stripe or keyed. Liability depends on which side did not support EMV technology. EMV LIABILITY SHIFT

43 EMV Chargeback reason codes Visa 57 Fraudulent Multiple Transactions 62 Counterfeit Transaction 70 Card Recovery Bulletin 81 Fraud Card-Present Environment MasterCard 4837 Fraud Card-Present Environment 4870 Chip Liability Shift 4871 Chip/Pin Liability Shift Discover 4866 UA05 Fraud Chip Card Counterfeit Transaction 4867 UA06 Fraud Chip and PIN Transaction Amex F30 EMV Counterfeit F31 EMV Lost/Stolen EMV LIABILITY SHIFT

44 Incoming Disputes

45 Airline Disputes NA and Canadian Dollar Amount - North America Dollar Amount - Canadian $76,102,475 $86,766,355 Incoming 215,843 Fraud 179,565 $8,893,016 $9,064,927 Incoming 10,786 Fraud 10,090 Of this, EMV dollar amount is $44,285 for 364 disputes Of this, EMV dollar amount is $125, for 110 disputes INCOMING DISPUTES

46 Hotel Disputes NA and Canadian Dollar Amount - North America Dollar Amount - Canadian $10,660,918 $17,687,461 Incoming 61,574 Fraud 34,763 $400,072 $432,773 Incoming 1,164 Fraud 913 Of this, EMV dollar amount is $2,418 for 4 disputes Of this, EMV dollar amount is $4,266 for 15 disputes INCOMING DISPUTES

47 Tips and Changes

48 Acquirers will have difficulty defending chargebacks for the following reason codes if the carrier fails to obtain proof of cardholder authorization. Reason Code 81, 83, and 4837, as well as any other fraudulent related reason code If this information is unattainable, the carrier should still provide compelling evidence during the chargeback cycle. Compelling evidence may include: Address Verification (AVS) Card Verification Value (CVV & CVC) Proof that cardholder name matches the customer s name TIPS

49 Reason Code Description Chargeback Conditions Representment Conditions Visa and Visa Europe 30 Airline transactions Services Not Rendered [NP] The cardholder claims that the services were not received as expected For an airline transaction, evidence that the name included in the flight manifest for the departed flight matches the name provided on the purchased itinerary. Visa 81 Fraudulent Transaction Card Present [NP] The cardholder claims that they did not authorize a card present transaction Provide proof of a signed & swiped, or a signed & imprinted, transaction and/or evidence that the name included in the flight manifest for the departed flight matches the name provided on the purchased itinerary. Visa 83 Fraudulent Transaction Card Not Present [NP] The cardholder claims that they did not authorize a card not present transaction Provide documentation proving the cardholder participated in the transaction and/or evidence that the name included in the flight manifest for the departed flight matches the name provided on the purchased itinerary. CHANGES

50 Questions?