Skip to main content

POST Champions league for card fraud

Although it will be a while until we get the 2017 figures, the 2016 figures were unequivocal. Card fraud is worse than ever, and in the UK it’s now worse than when chip and PIN was introduced.

Card fraud losses for 19 European countries hit approximately €1.8 billion, a new high. The UK saw the highest losses at £618 million, a 9 percent rise over 2015, topping the previous peak in card fraud, set in 2008 after the introduction of chip and PIN.

From European Card Fraud for 19 Countries Hit Record €1.8B in 2016 | FICO®

We’re fighting with the French for top spot in the European Champions League of Card Fraud. Who’s in front depends on how you measure things. Our fraud is  high, largely because of our very high Card Not Present (CNP) fraud which is running at more than 12 basis points. So we have higher absolute losses but their overall loss is worse in proportion. Of course, it isn’t just a European problem.

Fraud, grew by 19%, and outpaced volume, which grew by 15%.

From Annual Global Card Fraud to More Than Double Reaching Over $35 Billion in Four Years

My general sense of the industry, without giving away anyone’s figures, is that not only is fraud growing faster than volume, but that merchants are getting annoyed because declines are growing even faster than fraud. (We need a sea change in tackling fraud and I think there are two parts to this: changing the security vs. convenience model at the front end and changing the transaction validations model at the back end.) Actually, merchants are annoyed not only because of declines.

As e-commerce merchants continue to invest in fraud prevention, those efforts cost, on average, 8 percent of their annual revenue, up from 7.6 percent last year, according to a new report… undertaken by Javelin Strategy & Research

From Fraud Prevention Costs Merchants 8% of Annual Revenue: Report – CardNotPresent.com

It’s actually nearer 10% for online-only merchants. This seems unsustainable to me, but remember I don’t understand the dynamics in the retail sector. If a lot of those online-only merchants are (just as an example) adult services then they may consider that losing a tenth of the revenue is perfectly acceptable. But surely for the typical online merchant it is impossible to continue with these costs. You do have to wonder just how long the cost of fraud can continue to rise, considering that the report also says the merchants are already devoting a fifth of their budgets to fraud prevention.

The card schemes are hoping to see their solution (3D Secure v2) taken up by European merchants in the spring and I’m sure that this will help. But what we really need to do is to roll out what we already know to be a successful roadmap: tokenisation, biometric authentication and a useable customer interface. When I buy a bus ticket on my phone, I pay using Apple Pay which delivers all of these: the W3C “payment request” initiative (already being implemented in the main web browsers) provides a means to extend this solution to the web. Let’s get on with this in the UK and leave the fraud trophy to the French!

Comments

Popular posts from this blog

new survey results from USA Technologies (USAT) suggest. The payments technology company, which enables electronic payments for self-service machines, compared consumer spending activity at 35 of its vending machines in urban areas with a high concentration of iPhone users between week one and week four of the installation of new digital signage promoting Apple Pay. Consumers made more contactless purchases: The vending machine providers saw an average contactless transaction revenue increase of 89%, implying that consumers are making more mobile payments. This was likely driven by the clear advertisement of Apple Pay. Total transactions increased: Consumers made more purchases overall. This was probably driven by an uptick in mobile payments, given the major increase in contactless transaction revenue. And the vending machines may have attracted many first-time users who were drawn in by the digital advertising of Apple Pay. Boosting awareness is key to unlocking pent-up demand amon...

David | LinkedIn

Alex Todd rather kindly called this a “most lucid explanation of digital identity management” I would highly recommend this presentation to anyone interested in understanding prospective blockchain based identity architectures From David | LinkedIn This is very kind, but as I said in the link, this is thinking out loud and far from a fully-developed solution. We’re working on parts of this for different clients and I can see that there is something there - a genuinely new way of solving some old problems - but it’s early days.

We could fix mobile security, you know. We don't, but we could

Earlier in the week I blogged about mobile banking security , and I said that in design terms it is best to assume that the internet is in the hands of your enemies. In case you think I was exaggerating… The thieves also provided “free” wireless connections in public places to secretly mine users’ personal information. From Gone in minutes: Chinese cybertheft gangs mine smartphones for bank card data | South China Morning Post Personally, I always use an SSL VPN when connected by wifi (even at home!) but I doubt that most people would ever go to this trouble or take the time to configure a VPN and such like. Anyway, the point is that the internet isn’t secure. And actually SMS isn’t much better, which is why it shouldn’t really be used for securing anything as important as home banking. The report also described how gangs stole mobile security codes – which banks automatically send to card holders’ registered mobile phones to verify online transactions – by using either a Trojan...