FRAUD PREVENTION IN M-COMMERCE: ARE YOU FUTURE PROOFED? A Chase Paymentech Paper

Transcription

1 FRAUD PREVENTION IN M-COMMERCE: ARE YOU FUTURE PROOFED? A Chase Paymentech Paper

2 In the UK, Europe s largest online market, consumers continue to embrace m-commerce at an astonishing speed with an estimated one in every three online sales now made through a mobile tablet or smartphone 1. This might be excellent news for e-tailers but the growth in m-commerce also offers attractive new opportunities for determined fraudsters. Mobile might still be emerging as a retail channel but prudent e-tailers are already integrating m-commerce into their existing fraud prevention strategy. Forewarned is forearmed! It is never too early to close the door on the fraudsters looking to exploit new channels. This white paper highlights eight aspects of fraud prevention and may provide a useful checklist for e-tailers as they develop strategies, methods, and tools to defend effectively against fraudulent mobile transactions. 2 3

3 ADOPT A STRATEGIC APPROACH TO MOBILE FRAUD CUSTOMISE YOUR EXISTING FRAUD PREVENTION Fraudsters employ broadly similar tactics across e-commerce and m-commerce. However, levels of risk and fraud rates may differ between the sites as fraudsters will generally target whichever channel or combination of channels they perceive to be the weakest target. 1: SHOULD YOU CONSIDER MOBILE PAYMENT FRAUD DIFFERENTLY? Reports suggest that overall rates of m-commerce fraud tend to be higher than for other CNP (Card Not Present) channels - and that these rates are increasing 2. This is reflected in a growing number of retailers - and large retailers in particular - who consider the mobile channel to be riskier than standard e-commerce 3. Every CNP channel has its own characteristics and risks. For example, mobile devices may lack the level of security measures taken for granted on desktop computers and laptops, such as anti-virus and anti-malware software. With a 400 per cent increase in mobile malware in , e-tailers may expect mobile fraud to continue to rise, driven by more attempts at identity theft and account takeover fraud. 2: WHAT CAN YOU TELL ABOUT TRANSACTIONS FROM A MOBILE DEVICE? More than half of retailers consider it very important to detect mobile transactions, yet only 16 per cent are able to identify the type of mobile device used 5. Those e-tailers capable of capturing extra data about the source of the transaction may have an added advantage. For example, analysis of the mobile operating system could help identify a higher risk - there may be different risk profiles when comparing Android s operating system with Apple s ios platform. E-tailers should also look out for fraudsters that try to make a transaction appear to come from a mobile device even though it originates from a desktop computer (emulation). This is an attempt by fraudsters to exploit any difference in the way separate m-commerce and e-commerce fraud management systems have been configured, based on the assumption that the controls for verifying mobile transactions may be less sophisticated. 3: HAVE YOU INTEGRATED MOBILE FRAUD INTO YOUR MULTI-CHANNEL STRATEGY? Shoppers frequently use multiple devices when they buy online and retailers can be sure that fraudsters are doing the same in their attempts to commit fraud. Some fraudsters might use mobile malware or stolen credentials to give them access to a customer s account but then make repeat fraudulent purchases through other channels. Alternatively, they might use a number of channels together as part of a single fraud attack, such as making a fraudulent e-commerce order before contacting a call centre to change the delivery address. According to a survey conducted by Chase Paymentech, two thirds of e-tailers interviewed review fraud rates by mobile app and nearly half track fraud for mobile-enabled websites. However, just 21 per cent of retailers interviewed can monitor fraud across all of the CNP channels they use 6. Linking together transaction data from multiple channels can enable e-tailers to build a more complete customer profile. This may help to identify cross-channel fraud as well as to enhance the accuracy of fraud-screening rules by building a better understanding of genuine multi-channel behaviour. It is recommended that e-tailers should use a single, integrated fraud prevention system to process all transactions using a common set of policies. However, these should be customised for the unique characteristics of each CNP channel. 4: CAN YOU ACCURATELY IDENTIFY YOUR GENUINE MOBILE CUSTOMERS? To be able to identify unusual or suspect activity, e-tailers need to first understand what patterns of genuine customer behaviour typically look like. The way consumers shop when they use their tablet or smartphone may be different to the way they use a laptop or desktop computer. For example, retailers might expect a mobile customer to: Shop more in the evening Share their device with others in the family resulting in multiple purchasing profiles Use a number of devices, such as a smartphone, tablet and desktop with the same payment card Behaviour that might trigger an alert on one device might be acceptable in another situation. E-tailers may find it helpful to develop an insight into mobile shopping patterns to refine their existing fraud screening rules, which may drive improvements in the accuracy of their fraud detection systems and in turn may also prevent good orders from being unnecessarily delayed or reviewed. 5: DO YOU USE SPECIALISED FRAUD PROCESSES TO MANAGE MOBILE FRAUD RISKS? Some 28 per cent of UK retailers surveyed by Chase Paymentech believe that their existing CNP fraud tools are flexible enough to meet their needs across all CNP channels but a further 45 per cent believe that they are only flexible enough for some channels 7. There is also growing perception that mobile requires specialised or additional tools 8. The key to effective fraud prevention across a number of channels is flexibility. Some risk decisions need to be put in place that apply to all transactions. However, these need to be flexible enough to make decisions on whether to approve, decline or review transactions based on the type of channel, different shopping behaviour and evolving fraud tactics and risks. 6: HOW CAN YOU REASSURE YOUR CUSTOMERS ABOUT SECURITY? Among UK online shoppers, over 50 per cent of consumers have concerns about using their smartphone to make purchases, although only 22 per cent of tablet owners feel the same 9. One way in which e-tailers can reassure customers about security is to ensure that payment pages are optimised to display correctly on mobile devices. Chase Paymentech offers a mobile version of its hosted payment page that dynamically renders to the device it is run on. E-tailers might also want to encourage customers to use a dedicated mobile app. One report estimates that the number of high-risk transactions is higher on mobile websites compared to native apps 10, since apps may be less prone to the kinds of vulnerabilities found within mobile web browsers. Some payment providers ensure that payment data is encrypted within native apps before it is transmitted to be processed which may offer customers additional protection without the need for iframes or separate windows. 4 5

4 ENHANCED FRAUD TOOLS AND ANALYTICS FOR MOBILE RISKS BALANCE SECURITY WITH CUSTOMER EXPERIENCE RISKS With the right strategy and approach, e-tailers should ensure that their fraud detection tools are updated to allow for the specific challenges involved in identifying mobile fraud. 7: DO YOU RELY ON IP LOCATION TO DETECT MOBILE FRAUD? Internet protocol (IP) geolocation is one of the most popular methods for identifying the physical location of an e-commerce shopper and if m-commerce payments are made from home or another Wi-Fi connection, the IP address can still be used as a crucial risk factor. However, as soon as the mobile device is disconnected from a fixed location it becomes impossible to track using an IP address because mobile operators use a series of different web addresses for the same device. This means that e-tailers need to adopt different tools to track and prevent m-commerce fraud. ID authentication (also known as device fingerprinting or device identification) is one such tool. It assigns a unique identifier to every new device based on a unique picture of the setting or attributes on each device, such as whether Flash is enabled. Once the device has been identified, any attempts to use that same device for multiple fraud attempts can be detected and blocked. However, because ID authentication relies on building-up a history of activity linked to a particular device, it is not able to detect fraudulent transactions from devices that have been detected for the first time. This highlights the importance of using a combination of fraud tools rather than relying on any single technology or approach. 8: HOW OFTEN DO YOU ANALYSE YOUR CHARGEBACK RATES BY CHANNEL? Fraud can be one of the main causes of chargebacks. According to our survey, chargebacks are highest from a PC website (36 per cent), from mobile-enabled websites (21 per cent) or from mobile apps (15 per cent) 11. No discussion about fraud tools would be complete without considering the impact of any fraud measure on the customer experience, especially since mobile shoppers have high expectations of a fast, easy, and convenient payment process. For example, even though Chase Paymentech can enable e-tailers to include 3D Secure as part of their mobile payment process, it is the card issuer s bank that dictates how this is displayed. Because 3D Secure is unable to detect the type of device being used to make a payment, it may not be optimised for mobile screens, which may be frustrating for mobile shoppers. With around 85 per cent of m-commerce sales made on a tablet 13, it should be possible to display 3D Secure most of the time without an impact on conversion. However, e-tailers should analyse conversion rates and adjust their fraud prevention tools if particular fraud processes have a negative effect. CHASE PAYMENTECH S APPROACH TO FRAUD PREVENTION Every business will have its own approach to fraud prevention depending on its industry, products, customer expectations and attitude to risk. That s why when we advise our customers on their fraud and data security needs, we adopt a customised, flexible and scaleable approach that offers merchants solutions that can grow with their business needs. Our dynamic hosted payment page and in-app payment processing offer secure and encrypted connectivity to our payment gateway from mobileenabled websites and native apps. This is fully supported by our advanced suite of Safetech SM Fraud Tools to provide customers with real-time protection against the latest fraud threats. Our online payment reporting system offers comprehensive reports on fraud and chargebacks which can be analysed by mobile channel. Chargeback analysis can provide a valuable source of information about mobile fraud, which is why Chase Paymentech provides its customers with real-time dedicated fraud reports that can be analysed by channel. This can help e-tailers to identify potential weaknesses, enabling fraud rules to be refined. However, despite its value, only 38 per cent of merchants currently use their payment history data to help identify fraud by sales channel 12. TO LEARN MORE ABOUT FRAUD PREVENTION IN M-COMMERCE, PLEASE CONTACT: UK or visit: 6 7

5 Chase Paymentech, the global payment processing and merchant acquiring business of JPMorgan Chase & Co. (NYSE: JPM), is a leading provider of payment, fraud and data security, capable of authorising transactions in more than 130 currencies. The company s proprietary platforms enable integrated solutions for all major credit and debit card payments as well as mobile payment options. Chase Paymentech has uniquely combined proven payment technology with a long legacy of merchant advocacy that creates quantifiable value for ecommerce companies. In 2013, Chase Paymentech processed 35.6 billion transactions with a value of $750.1 billion. More information can be found at References Chase Paymentech Europe Limited, trading as Chase Paymentech, is a subsidiary of JPMorgan Chase Bank, N.A. and is regulated by the Central Bank of Ireland. Registered Office: EastPoint Plaza, Second Floor, EastPoint Business Park, Dublin 3, Ireland. Registered in Ireland with the CRO under. No Directors: Shane Fitzpatrick, Kevin Moran, Daniel Charron (US). The information herein or any document attached hereto does not take into account individual client circumstances, objectives or needs and is not intended as a recommendation of a particular product or strategy to particular clients and any recipient of downloadable document shall make its own independent decision. Information in this document has been obtained from sources believed to be reliable, but neither Chase Paymentech Europe Limited nor any of its affiliates warrant the completeness or accuracy of the information contained herein. This downloadable document and the information provided herein may not be copied, published, or used, in whole or in part, for any purpose other than expressly authorised by Chase Paymentech Europe Limited. 2014, Chase Paymentech Europe Limited. All rights reserved. 1 IMRG/Capgemini: Quarterly Benchmarking (Q4 2013/4) 2 Cybersource: Mobile Payments Management Trends Kount: Mobile Payments & Fraud Survey (2014) - page 43 4 Trustwave: Global Security Report Kount: Mobile Payments & Fraud Survey (2014) page 51 6 Dynamic Markets/Chase Paymentech: Online Retail Challenges: 2014 (March 2014) page Channels through which CNP fraud rates can be reviewed 7 Dynamic Markets/Chase Paymentech: Online Retail Challenges: 2014 (March 2014) page Ability of fraud tools to accommodate evolution of channels 8 Kount: Mobile Payments & Fraud Survey (2014) page 45 9 Dynamic Markets/Chase Paymentech: Putting Customers First? (March 2013) page Devices consumers have security concerns about when paying online 10 Iovation: 2014 Mobile Fraud Trends & Impact page Dynamic Markets/Chase Paymentech: Online Retail Challenges: 2014 (March 2014) page Chargebacks 12 Dynamic Markets/Chase Paymentech: Putting Customers First? (March 2013) page Use of payment history data 13 IMRG/CapGemini: e-retail Sales Index (September 2013)