An Oracle White Paper July 2010 U.S. CARD FRAUD

Transcription

1 An Oracle White Paper July 2010 U.S. CARD FRAUD

2 Contents Card fraud can be placed into six categories:

3 Card fraud costs the U.S. card payments industry an estimated US$8.6 billion per year. Although just 0.4% of the US$2.1 trillion in U.S. card volume per year, this number remains a troubling area for the industry due to the volatile nature of fraud clamp down on fraud in one area, and it will inevitably pop up in a less protected area. Figure 1: Overview of US Card Fraud Losses, Source: Aite Group The US$8.6 billion in card fraud losses is split between card issuers, merchants, and acquirers, with the majority of card fraud impacting card issuers. Card fraud creates many tangential costs as well card reissuance costs, increased investment in fraud detection and mitigation technologies, compliance and monitoring with fraud prevention frameworks such as the Payments Card Industry Data Security Standard (PCI DSS), and education of consumers. Consumers lose wages from time spent attempting to resolve card fraud and associated legal fees in cases of identity theft. Other, hidden costs also exist as a result of reputational loss due to card-related crime receiving media exposure. Card fraud can be placed into six categories: Card-Not-Present (CNP) Fraud: This type of fraud most typically involves the theft of genuine card details that are used to make a purchase via the Internet, phone, or mail order. The genuine cardholders may not be aware of the fraud until they check their statements (if they check them at all). The crime is also notable in the complete removal of the requirement for a physical card, making it the most readily accessible form of card fraud for criminals. The rise of e-commerce, coupled with the lack of requirement for a physical card for these crimes, means that CNP fraud is on the rise, particularly in countries where other types of fraud are more difficult to commit due to the introduction of EMV chip-card programs, which require a PIN at the point of sale for all card transactions. Counterfeit Card Fraud: This type of fraud occurs when a fake card is created using compromised details from the magnetic stripe or electronic chip of a legitimate card. While more expensive for fraudsters than CNP fraud, dividends can be higher due to the ease with which fraudsters can use these cards at all locations that accept credit or debit cards. Combined with a compromised PIN, fraudsters can also directly access cash in addition to purchasing physical goods, further increasing the attractiveness of the crime. Lost and Stolen Card Fraud: This category covers cards reported as lost or stolen by the original cardholder, and therefore tends not to be the work of carding gangs. This category of crime is a concern given the global nature of the Internet and easy replication of a magnetic stripe, a lost or stolen card can be used to commit other types of fraud, such as CNP and counterfeit. That said, the exposure is likely 3

4 to be less acute than types of fraud derived from massive data breaches caused by organized carding networks. Mail Non-Receipt Fraud: This fraud involves intercepting legitimate cards while they are in transit from the issuer to the cardholder. Properties with communal mailboxes are particularly vulnerable to this type of fraud, though it is now well managed by legitimate cardholders being required to activate new cards via telephone. ID Theft: This fraud occurs when a criminal uses a fraudulently obtained card or card details to open or take over a card account in the name of a legitimate user. It is separate from CNP and counterfeit card fraud; this type of fraud creates a new identity rather than simply replicating an existing card identity. First-Party Fraud: This fraud is committed either by a fraudster purporting to be a legitimate cardholder or by a legitimate cardholder who intentionally decides not to pay off a credit card balance, leaving the card issuer with the debt. These credit card accounts are often well maintained over time in order to cultivate a higher credit limit so the fraudster can maximize the size of the fraud committed. This area, typically hidden within bank charge-offs, is rarely reported alongside the more overt forms of third-party fraud. The largest single category for U.S. card fraud is first-party fraud, accounting for an estimated 7% to 10% of overall issuer charge-offs. Given recent economic conditions, this is expected to increase as more cardholders intentionally max-out their credit cards without intending to repay them. First-party fraud is rarely tracked alongside more overt forms of third-party card fraud, and may often go undetected by card collections despite accounting for half of all card fraud today. The three main forms of U.S. third-party fraud are card-not-present, counterfeit, and lost-and-stolen fraud, representing approximately 15% of card fraud per category. ID theft and non-receipt card fraud are comparatively small, accounting for 1.5% and 0.3% of card fraud respectively. Figure 3 Main Categories for Card Fraud, 2008 Source: Aite Group While card fraud comprises only a small percentage of total card revenues a percentage that has stayed constant over the last few years the industry cannot afford to rest on its collective laurels. 4

5 Fraud has always been a component of financial transactions. Historically, it has been managed by the payment mechanism having a physical limit on the degree of fraud that can occur counterfeiting bank notes, for example, requires serious investment in materials to perform the operation successfully to a degree that makes the venture profitable. Until a few years ago, this was also true for plastic payment cards the cost of card fraud was prohibitively expensive for all but the most dedicated and well-funded criminals. Two factors have radically altered the landscape: the commoditization of card replication technology, and the ubiquitous reach of the Internet. Each of these has significantly tipped the balance in favor of fraudsters. In combination, they have enabled massive card data theft and subsequent card replication to an alarming degree. Card data can now be stolen in a digital format and replicated anywhere in the world. The collective term for the theft and replication of card data is carding. It refers to a host of activities based around stolen credit and debit card numbers, including computer hacking, phishing, cashing out stolen account numbers, re-shipping schemes, and Internet auction fraud. Carding is distinct from other forms of card data theft, such as skimming, mail interception, and pick-pocketing, in the scale of the crime. Whereas simple card crime involves probably no more than hundreds of victims, carding activities can involve the theft of data relating to thousands or even millions of card details, and is likely to be coordinated by organized criminals rather than petty thieves. Stolen card data is used either directly to commit unauthorized financial transactions (using the card data for card-not-present transactions or via manufactured counterfeit cards), or is sold to other criminals via underground Web sites. Carding is the source for three fraud categories CNP, counterfeit, and ID Theft, collectively 34% of total card fraud. Carding websites have evolved quickly to a very high level of sophistication for discerning clientele. Initial offerings were mostly dumps information copied from magnetic stripe cards revealing track-one and track-two data. Market demands have increased, however, with carding sites now offering fulls a complete package of data relative to a victim, such as Social Security number, address, mother s maiden name, credit history, commonly used passwords and other individual-specific information. Specific attributes such as completeness of identity, currency and exclusivity of the data, and personal wealth of the identity theft victim contribute to the worth of the information. Due to some extremely successful data breaches in 2008 flooding the market with hundreds of millions of stolen card information, the value of card data on the black market has dropped considerably. In 2007, card data from a fresh dump was valued at around US$15 per card. By 2008, the same type of card data was worth less than a dollar. Similarly, full IDs have lost their value due to market saturation, dropping from approximately US$ per ID in 2007 to US$10 or less in In the wake of this tsunami of stolen card data, criminals are increasingly attempting to steal PIN information alongside card data, allowing the simple extraction of funds from a victim s account via ATM or POS withdrawal. Figure 4: Stolen Cards are at Rock Bottom Prices Source: FBI, Aite Group 5

6 This is where great concern for the payments industry resides; the latent threat of massive card fraud taking months or even years to fix, huge financial losses for a breached company, and the likely irreparable reputational damage. The Heartland data breach of January 2009, for example, has cost the payment processor dearly. An estimated 130 million credit and debit card credentials were stolen, with fallout that is still being discovered as counterfeit cards based on these credentials continue to circulate the globe. Heartland has countered with information security policies that are considered best in class, but the company continues to hemorrhage, with US$35.6 million written off in Q as costs relating to the breach. The current number of institutions affected by the breach is 652, with each of these experiencing losses in terms of directly attributable fraud via stolen cards, as well as peripheral costs such as customer service and card reissuance. While three hackers have been charged with the attack, the card payment industry cannot relax. Carding is far too lucrative a business for criminals to ignore, so much so that what was recently the work of Eastern European criminal gangs has migrated to more traditional organized criminal networks such as the Sicilian Mafia. In fact, the industry is bracing for the other foot to drop where are massive data breaches occurring that have yet to be detected? 6

7 July 2010 Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA U.S.A. Worldwide Inquiries: Phone: Fax: oracle.com Copyright 2010, Oracle and/or its affiliates. All rights reserved. This document is provided for information purposes only and the contents hereof are subject to change without notice. This document is not warranted to be error-free, nor subject to any other warranties or conditions, whether expressed orally or implied in law, including implied warranties and conditions of merchantability or fitness for a particular purpose. We specifically disclaim any liability with respect to this document and no contractual obligations are formed either directly or indirectly by this document. This document may not be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without our prior written permission. Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. UNIX is a registered trademark licensed through X/Open Company, Ltd. 0710