Innovations in Debit Card Fraud Analytics Stop Unchecked Fraud Growth by Expanding Visibility into Fraudulent Activity

Transcription

1 white paper Innovations in Debit Card Analytics Stop Unchecked Growth by Expanding Visibility into ulent Activity September 2010»» Summary A healthy debit card market is cloaking an unhealthy rise in debit card fraud. The opportunity to steal cash, and take additional booty by accessing other accounts and services linked to demand deposit accounts is increasingly attractive to criminals, particularly as most PIN debit cards are underprotected. This white paper discusses the need for PIN debit accounts to be managed with the same caliber of transactional fraud detection systems used for credit cards and most signature debit cards. It describes FICO Falcon Manager for Debit, the latest version of which simultaneously detects the inherently different cardholder behavior patterns and fraud patterns associated with signature and PIN debit accounts. The paper also describes two advances that substantially improve fraud detection, speed response and reduce losses: integration of Falcon Manager for Debit with FICO Card Alert Service*, a combination that boosts the performance of both products; and Global Profiling, a FICO analytic innovation which will be in the next Falcon Manager update. *FICO Card Alert Service is currently available in the United States only. Make every decision count TM

2 »» The Danger of Unchecked Debit Growth In business, growth can sometimes mask big problems. For the payment card industry, rapid expansion in debit card market penetration and usage are leading to underestimation of the growing problem of debit card fraud. In fact, debit fraud on both signature and PIN cards is rising at a seriously fast clip. The industry cannot afford to leave this growing fraud problem unchecked. When debit card market growth slows, as it inevitably will, the fraud rate is likely to continue to climb, causing fraud losses in basis points to soar. sters meanwhile, having been undeterred by weak defenses, will have developed and refined even more damaging techniques. Banks and card issuers must act now to avoid potentially huge losses, and the negative impact these losses would have on customer confidence and brand reputation. Criminals are escalating their fraud attacks on debit cards; this is a situation where a good offense is your best defense. Mike Urban, Solutions, FICO The first step is to extend the same real-time transactional fraud detection that protects their credit cards and most signature debit cards to PIN cards as well. Banks and issuers using FICO Falcon Manager for Debit to analyze signature-based transactions can direct their PIN-based transaction traffic through the same solution. The latest version of this product incorporates dual technology. FICO s patented dynamic profiling technology captures inherently different cardholder behavior patterns and fraud patterns associated with signature and PIN debit accounts, enabling Falcon models to detect both types of fraud with a high degree of precision. In addition, this white paper discusses two FICO analytic advances that lift debit fraud detection results even further: 1. Integration of Falcon Manager for Debit with FICO Cart Alert Service. While the Falcon system is focused on detecting fraudulent transactions on individual cardholder accounts, the Card Alert solution, available in the United States, is focused on isolating and controlling largescale card counterfeit losses. Integration improves detection speed and accuracy, and shortens response times, on both sides of the exchange. 2. Global profiling in the next version of Falcon Manager for Debit. Falcon Manager clients that upgrade will gain substantial performance improvements from being able to concisely and efficiently profile not only cardholders, but a wide range of other entities ATMs, point of sale (POS) devices, telephone numbers, etc. involved in card transactions. Both of these solutions improve Falcon performance by providing additional transactional views that provide a more complete picture of fraudulent activity. When the two solutions are used together, their benefits complement each other. Banks and card issuers taking advantage of both these advances will have the means to stay ahead of the rising tide of debit fraud, keep the confidence of their customers and retain more of the profits from their expanding debit card portfolios Fair Isaac Corporation. All rights reserved. page 2

3 Debit Update sters find ways around protections detection is more important than ever sters are attracted to debit cards because, as outlaw Willie Sutton once said, That s where the money is. Debit cards offer the prospect of not only making fraudulent purchases, but accessing cash from ATMs no fencing or selling of goods required. Moreover as DDAs increasingly become the hub for other accounts and financial services, with new channels for using them emerging (e.g., online and phone banking), the potential value of the take from illegal account access further increases. While PIN-based accounts still represent a much smaller percentage of debit fraud than signature accounts, they are attracting concentrated attention by counterfeiters and other fraudsters today. PIN accounts make a vulnerable target since fraud defenses on these accounts are generally less hardened than on signature debit and credit card accounts. sters are finding many ways of working around the protections PINs are intended to provide. For example, with EPP-compliant ATMs now a requirement at non-financial-institution locations, criminals have stopped trying to steal PINs and other card information through wiretapping. But we re now seeing more instances of overlays being installed on top of keypads or tiny circuit board cameras being used to capture PINs, used in conjunction with skimming devices installed over cardreaders to capture card numbers. sters are also targeting more POS devices, especially at smaller merchant locations where older, non-epp-compliant equipment may be in use or where network security may be lax or systems never intended for Internet exposure may be in use. Even the chip-pin protections deployed in the UK and other European Union countries have proven to be surmountable obstacles, simply requiring fraudsters to change their methods. While in the wake of chip-pin, in-market counterfeit fraud has dropped substantially, crossborder fraud has surged. sters use the techniques described above to steal card numbers and PINS for manufacturing counterfeit cards, then use the cards for cross-border fraud in countries where magnetic stripe transactions are common. Stolen card numbers are also heavily used in-market for card-not-present (CNP) fraud, particularly online. Meanwhile fraud patterns are growing more varied and ambitious. For example, fraudsters or their customers may sit on stolen cardholder data for months before attempting to commit fraud with it, but they may also use it within hours at a location far away from the compromise site. Today they re also very quick in testing of stolen card data, with successful tests followed immediately by large withdrawals or purchases, often from another channel. For example, fraudsters may make a small online purchase or obtain a preauthorization through a bogus merchant account to determine that the card account can be accessed. They ll then go to an ATM to empty out the checking account and any linked accounts they can get to. There was even a case recently of a multi-channel kiting scam involving accounts at several banks. Taking advantage of the two-day settlement window for ACH transactions, a fraudster kited ACH deposits by transferring funds from one financial institution s account to another. At the optimal moment for maximizing their take, they used ATMs to withdraw the funds. Total losses perpetrated by this ring amounted to more than $250K. While the perpetrators of such elaborate schemes could be lone fraudsters or small groups of independent operators who today have access to unprecedented technology, outsourced services and secondary markets via the Internet they re likely members of highly organized fraud rings, some of which have the global footprint and resources of a Fortune 500 company Fair Isaac Corporation. All rights reserved. page 3

4 »Combined» Views Speed Detection and Response Two points of view are often better than one. When watching a sports event on television, for example, having more than one camera angle enables viewers to see aspects of game play and moves by the athletes that they wouldn t be able to see with one camera. This is the case with Falcon Manager for Debit and Card Alert Service integration. The two products have different points of view and different processes for achieving the same ultimate goal to prevent fraud losses by detecting fraudulent activity as soon as possible. FIGURE 1: COMPLEMENTARY FRAUD MANAGEMENT SOLUTIONS What it does FICO TM Falcon Manager for Debit Detects fraudulent transactions on cardholder accounts FICO Card Alert Service (US only) Detects large outbreaks of counterfeit card fraud and provides risk management services that prevent the majority of losses Point of view Looks for aberrations from the cardholder s normal transactional behavior patterns Looks for aberrations from the normal transactional patterns in ATM networks Process Detects a wide range of fraud on individual demand deposit accounts by scoring transactions in real time for likelihood of fraud Cardholder profiles updated with every transaction; scores used in conjunction with cutoff thresholds for authorization, case generation and other automated actions Scores and reason codes used to write business rules for applying additional scrutiny or specific types of treatment to individual targeted accounts Detects counterfeit fraud outbreaks affecting multiple demand deposit accounts from multiple debit issuers by analyzing a consortium of ATM network transaction data Link analysis performed to find fraud cards that appear to be traveling together (e.g., showing similar types of activity within potentially related timeframes and locations) Issuers receive list of suspect fraud activity cards; return fraud/no-fraud feedback Confirmed fraud card data analyzed to identify the common point of compromise (POC) and time window when theft of cardholder data probably occurred Issuers receive compromised cards list of accounts likely to have been compromised at that POC during the time window When these points of view and processes are woven together, visibility into fraudulent activity increases, and both solutions become increasingly effective. detection speed increases, in many cases by up to 50 percent. On the next page, you can see why. Figure sets 2a-c map detection and response processes onto timelines to show how these improvements occur through back and forth cooperation and how they accelerate fraud detection and interception Fair Isaac Corporation. All rights reserved. page 4

5 FIGURE 2A: FALCON FRAUD MANAGER FOR DEBIT PROCESS SOLO starts FICO Falcon Manager Day 1 Real-time fraud detection & case generation Case dispositions cards blocked & reissued Day 2 Day 3 Day 4 Day 5 Other cards part of the same compromise may show fraud activity days... or months later FIGURE 2B: card alert service PROCESS SOLO FICO Card Alert Service starts Transactional data received from ATM/POS networks detection Suspect activity report to issuers (within minutes) /no fraud feedback from issuers Point of Compromise identification Compromised Cards report to issuers Issuers block & reissue cards Day 1 Day 2 Day 3 Day 4 Day 5 FIGURE 2C: CARD ALERT AND FALCON FRAUD MANAGER PROCESS INTEGRATED FICO Card Alert Service starts Confirmed fraud card numbers received as cases disposed Point of Compromise identification Compromised Cards report to issuers FICO Falcon Manager Day 1 Real-time fraud detection & case generation Case disposition Day 2 Day 3 Day 4 Day 5 Cards on list blocked & reissued OR managed by Falcon Manager 2011 Fair Isaac Corporation. All rights reserved. page 5

6 FIGURE 3: SUMMARY OF INTEGRATION BENEFITS Higher performance from FICO Falcon Manager More fraud caught. Card Alert makes Falcon Manager aware of fraud activity that does not look aberrant based on the transactional patterns of a specific account. For example, there s nothing suspicious to Falcon Manager about a $200 ATM withdrawal from one account, but the transaction is suspicious to Card Alert because it s one of 20 such withdrawals occurring on multiple accounts in a short time in a small geographical area. Higher performance from FICO Card Alert Service More fraud caught. Falcon Manager makes Card Alert aware of confirmed fraudulent transactions, caught by detecting aberrations in individual cardholder behavior, which Card Alert does not see. Using link analysis, Card Alert may be able to link a fraud card number received from Falcon Manager with other cards showing similar fraud patterns, and thereby be able to detect a mass compromise. Quicker detection and response. Based on Suspect Activity Report from Card Alert, Falcon Manager can automatically generate cases for review. In this way, cardholders will be called sooner and fraud that might otherwise not be detected until the second or third transaction will be intercepted on the first transaction. loss prevention. Card Alert s Compromised Cards list alerts FICO Falcon Manager to accounts where fraud hasn t yet occurred but is likely to, enabling banks/issuers to act promptly to avoid these future losses. For example, they could block and reissue cards that look most risky based on recent Falcon Manager scores or write rules to deny transactions on the account without closing it (fraudsters who find they can t use an account number will probably just move on and not revisit it). For less risky accounts, rules might tighten authorization conditions, causing a case to be generated, for example, if there is an attempt to make a large cash withdrawal. Quicker and more accurate identification of individual cards affected by mass compromise. Because the fraud cases received from FICO Falcon Manager are already confirmed, Card Alert can skip its normal steps of issuing Suspect Activity Reports and waiting for confirmation from issuers. The point of compromise (POC) analysis can begin immediately. In addition, as Falcon Manager sends more confirmed fraud cards, some of these may match up with cards that had transactions at the POC. Using the times of these transactions, Card Alert can improve its estimate of the time window during which the fraud occurred, identifying other potentially compromised cards that also had transactions during the window. The more Card Alert can match up POCs with confirmed cases of fraud received from Falcon Manager, the more accurately it can generate a Compromised Cards list at risk for fraud. More focused and cost-effective response options. With Card Alert sending Suspect Activity Reports and Compromised Cards lists of at-risk cards directly to Falcon Manager, issuers can use Falcon Manager capabilities to automate and accelerate actions, while reducing administrative costs. In many cases, they may choose not to reissue cards, but rather to apply other more focused, flexible methods of protecting potentially compromised accounts from future acts of fraud. And where there are manufacturing delays in supplying new cards, issuers can apply interim measures to protect accountholders. Issuers also have more flexibility if they choose to reduce customer inconvenience by leaving a card open until the customer activates the new card.»» The Big Picture on Debit : Global Profiling The debit fraud environment is becoming very complex as additional products and services are linked to demand deposit accounts and new channels emerge for card usage. It s also increasingly dynamic, as savvy criminals frequently shift their targets and methods. A forthcoming version of Falcon Manager for Debit will address this complexity by expanding FICO s patented profiling technology to capture a broader view of debit transactions across lines of business and multiple channels. This advance also includes a mechanism for adapting profiling to changing fraud activity. FICO s dynamic profiling technology mathematically compresses immense amounts of historical behavioral data into highly predictive variables that facilitate real-time transactional analytics. Profiles enable models to examine intricate nonlinear relationships between many pieces of data in a fraction of a second to detect unusual behavior patterns Fair Isaac Corporation. All rights reserved. page 6

7 Falcon Manager for Debit currently creates account profiles to detect unusual cardholder behavior. In the future, it will also create Global Profiles to detect unusual behavior of other entities in financial services environments, such as ATMs, traditional swipe as well as contactless POS devices, mobile phones and telecom switches. These profiles are global because while they are involved in cardholder transactions, they are not specific to any cardholder account. Global Profiles enable Falcon Manager to detect fraudulent activity that may not look suspicious from the point of cardholder behavior patterns alone. Because FICO s advanced shared memory profiling techniques enable multiple profiles to be analyzed simultaneously by the Falcon models, visibility into fraudulent activity expands. For example, as depicted in Figure 4, a debit cardholder s purchase of $200 worth of jewelry from a merchant, while unusual, is not necessarily suspicious, and thus will probably not score above the threshold for review. What is suspicious is that a hundred similar purchases of jewelry have been made from the same POS device in the past day and all with debit cards that have never been used with that merchant before. The fraud management system will detect this suspicious activity only if it is profiling both debit cardholders and POS devices. FIGURE 4: GLOBAL PROFILES EXPAND VISIBILITY INTO FRAUD Cardholder behavior view POS behavior view 1 day 1 day Sara Brown buying $200 worth of jewelry from a merchant 1 high-value transaction Hundreds of $200 jewelry transactions at the same POS Sara s transactional data within her behavioral norm POS transactional data outside normal patterns The quantities of data involved in global profiling, even with the ultra-compression used, are potentially immense. Yet global profiling has a built-in way to minimize the number of profiles while maximizing the analytic benefit. As shown in Figure 5, dynamic analytic techniques determine, based on historical and current transactional activity and fraud patterns, which entities to profile. In fact, with each transaction scored, Falcon Manager for Debit determines if the entities involved are already being profiled. If so, it updates the existing profiles with any new information from the current transaction. If not, it determines if a profile should be created Fair Isaac Corporation. All rights reserved. page 7

8 FIGURE 3: SUMMARY OF INTEGRATION BENEFITS Transactional data Cardholder profile Scaled profile (converted to common units for comparison with peers) Primary model Preliminary fraud score Adjusted fraud score Review threshold Approve Does a profile exist for this entity? YES NO Update ATM profiles Global Profiles Scaled profiles Secondary model Should it be created now? POS profiles Phone # profiles Case review Other profiles... FICO software innovations support this type of analytic innovation by making multiple-entity dynamic profiling immensely scalable. For instance, a leading UK telecom company, using multiple profiles to detect and predict network faults and revenue leakage, is analyzing over 1.5 billion transactions day in and day out.»conclusion Act» before Debit Becomes a Big Problem Debit card markets will eventually become penetrated and revenue growth will no longer be able to cloak rising debit fraud, which is unlikely to slow. If fraud continues to grow at present rates, it will seriously cut into debit card profit margins. By the time that happens, debit card fraud is also likely to have become a huge customer satisfaction, public relations and political issue for the financial services industry. By acting now to ensure that all of their payment cards are being managed with state-of-the-art transactional fraud detection, financial institutions will avoid the losses, costs and embarrassment of this scenario. By updating their transactional fraud detection systems with the latest advances, they ll stay ahead of fraudsters who are increasingly focusing their ingenuity on getting at the cash and other prizes available through ubiquitous, underprotected debit cards. Once debit cards are subject to powerful transactional detection, like that which has brought credit card fraud rates down, criminals will find it much harder to reach these riches and their return on investment in fraud schemes will drop. Many will become discouraged and move on to look for other low hanging fruit Fair Isaac Corporation. All rights reserved. page 8

9 about FICO FICO (NYSE:FICO) delivers superior predictive analytics solutions that drive smarter decisions. The company s groundbreaking use of mathematics to predict consumer behavior has transformed entire industries and revolutionized the way risk is managed and products are marketed. FICO s innovative solutions include the FICO Score the standard measure of consumer credit risk in the United States along with industry-leading solutions for managing credit accounts, identifying and minimizing the impact of fraud, and customizing consumer offers with pinpoint accuracy. Most of the world s top banks, as well as leading insurers, retailers, pharmaceutical companies and government agencies, rely on FICO solutions to accelerate growth, control risk, boost profits and meet regulatory and competitive demands. FICO also helps millions of individuals manage their personal credit health through Learn more at FICO: Make every decision count. FICO, Falcon and Make every decision count are registered trademarks of Fair Isaac Corporation in the United States and in other countries. Other product and company names herein may be trademarks or registered trademarks of their respective owners Fair Isaac Corporation. All rights reserved. 2478WP 05/11 PDF For more information US toll-free International web (0) info@fico.com