Understanding the Card Fraud Lifecycle : A Guide For Private Label Issuers

Understanding the Card Fraud Lifecycle : A Guide For Private Label Issuers The Problems, Tools, Techniques and Technologies Christopher Uriarte Chief Technology Officer & Head of International Development Retail Decisions PLRT Conference May 1, 2009 Philadelphia, PA

About Retail Decisions: A Market Leader One of the leading global providers of transactional card fraud prevention and payment services Touched approx.16 billion card transactions per year for blue chip clients around the globe; 160 billion card transactions per annum worldwide (2007) 20+ years experience in card fraud prevention Fully-managed Fraud Prevention and Payment Services focused only on large and blue-chip customers: Merchants, Issuers and Acquirers Blue-chip client base of more than 300 companies Best-of-breed, unique proprietary technology and databases, including patented neural network technologies Strong service offering throughout all pieces in the payment value chain: merchants, processors and banking institutions Retail Decisions (ReD) is a London-based specialty provider of transaction and card issuing service to banks, retailers, oil companies and telcos worldwide

Sample of ReD’s Clients and Focus Sectors Travel Telephony Retail Oil Banking Europe America Asia Pacific Other

Where We Sit & Where the Data Comes From Fraud Prevention & Gateway Services (CP&CNP) ReDShield TM ReD1Gateway TM CardExpress TM Fraud Prevention for Acquirers & Processors PRISM TM Fraud Prevention for Issuers PRISM TM Fraud Prevention for Merchants Fraud Prevention for Banking Institutions

Fraud Control Life Cycle Solutions implemented to reduce fraud Time lag for solutions to take affect New solution is implemented to reduce fraud Familiarity with weaknesses in cards and technology increases fraud Fraud begins to rise as new technologies are cracked and new weaknesses are found 2002 2009 ??? ??? Are We Here Now??? Implies Innovation Time Value of fraud

Counterfeit fraud driven by growth of plastic Increasing examples of large, sophisticated counterfeit card manufacturing operations 170,000 cards seized in Taipei, Taiwan

Regular Occurrences of Organized & Social Engineering Efforts Arrests in card scam Wednesday, February 28, 2007 By Paul Grimaldi Journal Staff Writer Arraigned yesterday in the thefts of credit-card and debit-card information — and more than $100,000 The men allegedly stole the information by switching out checkout lane keypads with one of their own machines and then retrieving the units a few days later so they could copy the account data. To achieve this, they took shelf stocking positions at the supermarket, which gave them legitimate access to the facility during late hours in the evening. They recorded the stolen information on blank bank cards that they used to get money from ATMs in the area, the police said.

Implanted chips Criminals implant a chip directly into Point of Sale equipment The chip holds up to 1,000 account numbers Major occurrences in Taiwan, Malaysia and Brazil

Purpose Built Skimmer – Old Technology, But Still Popular Small battery operated skimmers can hold up to 1 million account numbers at a time Devices are mainly produced in Malaysia and China Manually manufactured from standard POS equipment The skimmers were introduced to US in 1998

Personalizing the Card Low tech: Embossing only “ Higher tech”: Transplanting Skimmed Card Data 3712 345XX8 95004

The Trend: No Longer a Low-Tech Crime Large groups of individuals work together A real example 128 flights were successfully purchased in the names of 92 passengers to 3 destinations over 12 weeks with 33 different cards Over $300,000 in total

What This Means In Regards to Fraud Credit card fraud continues to become more of an organized, professional crime – the case studies prove it CNP fraud continues to aggressively increase. As more countries adapt Chip and PIN solutions, fraud will continue to migrate from CP to CNP channels APACS 2007 Fraud Study: For the first time, more than 50% of fraud was CNP fraud. As other countries implement Chip and PIN solutions, both CP and CNP fraud will increase in non-Chip and PIN geographies ID Theft continues to increase, replacing counterfeit schemes, which are no longer valid in Chip and PIN geographies Since fraud is aggressively expanding, legacy fraud prevention techniques are becoming less and less effective

Typical Merchant Fraud Assessment Process Merchant Order System, Storefront, Website, etc. ACCEPT ORDER DENY ORDER CHALLENGE ORDER (Manually Review) Fraud Prevention System and Tools (Proprietary or Outsourced) 90%+ Of All Orders ~2% Of All Orders 2%-8% Of All Orders (Where Applicable) Key Points: Challenges or outright Deny categories may not work for all types of merchants Merchants must find the balance: Too many manual reviews = too much staffing cost Too many outright denies = too many false positives No Fraud Prevention system is perfect: You will have false positives. You will require manual review. Today’s strategy is to let the Fraud Prevention system identify ~95% of all good and bad orders and manually review the rest Examples:

Finding the Balance Between Key Metrics Key Metrics Merchants Must Track: Manual Review Rate (“Outsort Rate”) - % of orders reviewed by a person before shipped or cancelled Outright Deny Rate - % of orders rejected by the fraud system without performing a manual review Fraud Rate – Overall percentage of fraud, usually measured in % of overall transactions and % of $ value Customer Insult Rate – Falsely identifying good customers as fraudulent OR degrading service to good customers as a result of slow/cumbersome fraud processes (e.g. manual reviews take so much time to complete that shipping windows are missed) Revenue at Risk – How a particular fraud strategy could affect revenue Highlighted in red : The most typical and critical results in each respective category When This Happens: This Could Happen: Manual Review Rates Increase  Fraud Rates - Decrease Staffing Costs - Increase Revenue at Risk - Decrease Customer Insult Rate – Potential to increase (slower order turnaround) Scalability – becomes challenging (Double my orders = Double my staff??) Manual Review Rates Decrease  Fraud Rates - Increase Staffing Costs - Decrease Revenue at Risk – Potential to increase Customer Insult Rate – Potential to increase (due to higher deny rates) Hard Deny Rates Increase  Fraud Rates - Decrease Staffing Costs - Decrease Revenue at Risk – Increases (Much more false positives) Customer Insult Rate – Increase

Fraud Prevention Systems: Real-Time or Batch Real-Time Fraud Prevention Immediate response at the time of purchase, usually at the time of card authorization: “in line with the purchase” Applicable for all types of retailers The only option for merchants who require an instant response: Digital download, content providers, point-of-sale, telephony services, etc. Provides the opportunity for additional review after the real-time response Screening focus is on current transaction and all prior transactions Batch Fraud Prevention Screening performed after the transaction takes place. Goal is to stop the “next fraud” or to screen before goods/services must be delivered Has no impact on response to customer at time of purchase Does not work for retailers who require an immediate response Ability to assess prior transactions and some transactions that occur after this transaction took place (historical and forward-looking view) Merchants must first decide whether they require a Real-Time or Batch (non-real-time) fraud prevention system: Sophisticated Systems Can Combine BOTH Techniques

Fraud Prevention Systems: Tools and Technologies There are a number of tools and technologies on the market today which address different aspects of fraud. Merchants may choose to assemble a suite of these tools themselves, or use more advanced fraud prevention solutions from outsourced providers Examples of Tools and Technologies Used Today: Business Rules Engines Negative Databases Address Validation Tools Personal/Identity Validation Tools I.P. Geo-location Device Identification / PC Fingerprinting Neural Networks and Statistical Models Public Records Validation Pattern Detection (Tumbling & Swapping, etc.) Other types of “transaction intelligence”: Card BIN analysis, Customer history analysis (Time-on-file, etc.), etc. Generally-available Internet Tools (Google Maps, Whitepages.com, etc.) There are many different flavors and levels of sophistication for each of these tools Many of these have a cost associated (flat fee or per-use cost) Many return data elements and responses that require additional analysis in order to be useful. Many of these techniques are used in conjunction with each other.

Tool Example: IP Geolocation Instantly compare an online customer's registered address with his real-world location to flag potential fraud Pre-emptively block web site access to certain locales or IP origination points known to be frequent sources of fraud Real-world location

Technique Example: Combining IP Geolocation with Additional Transaction Analysis Unusual combinations of location details I.P. address in California Billing and/or Delivery address in London Card issued in Poland

Technique Example: Tumbling & Swapping

Technique Example: Email Tumbling & Swapping and Pattern Detection John1 John2 John3 John4 John5 John6 John7 John8 John9 John10 @hotmail.com [email_address] [email_address] [email_address] [email_address] [email_address] [email_address] [email_address] [email_address] [email_address] [email_address] Up to10% fraud rate on free email domains

Technology Example: Neural Networks Advanced mathematical models which “think” in dimensions that the human brain cannot Models are created based on large volumes of historical “good” transactions and fraudulent “bad” transactions New transactions are screened against the model, which generates a score indicating the probability that the transaction is fraudulent Used successfully for many years in issuer fraud detection systems, mortgage/card application fraud, etc. Using it to detect card fraud for merchants is relatively new and requires different approaches to be successful Outsourced by merchants to specialist providers Neural Model Transaction Details Where does this fall?? GOOD?? BAD?? Score: 743 Scale: 0 to 999 0 = Good, 999=Fraud Transaction Details (Required fields varies depending on features & purpose of neural model) Score: 0 Score: 999 Good (Non-Fraud) Historical Transactions Bad (Confirmed Fraud) Historical Transactions Model Building And Training

The "More Tools Create Greater Complexity" Challenge No Matches Negative Data Device ID Check Address Validation Proxy Detection Neural Score Transaction Data Everything’ s OK; First time buyer Business Rules No History Address is Good; No match of Name to Address Could be behind a University proxy Score: 362 NOW WHAT? Should you accept it? Should you outright deny it? Should you manually review it? Challenge: Not just managing the individual components, but the sum of the parts!

The Real World Challenge Using fraud tools & technologies effectively is not easy! Fraud does not occur within neat, well-defined spaces Individual tools can only detect certain types of fraud “ Islands of Fraud in a Sea of Good Transactions” Suspicious AVS Order Amount

The Real World Challenge: Example Example: Defining “bad” transactions using business Rule(s) If Order Amount is Greater than $X then Manually Review Suspicious AVS Order Amount

The Real World Challenge: Example Example: Defining “bad” transactions using business Rule(s) If AVS Result is Suspicious then Manually Review or hard decline Suspicious AVS Order Amount

The Real World Challenge: Example Example: Layering multiple business rules and Other Technologies If Order Amount is Greater than $X then Manually Review If AVS Result is Suspicious then Manually Review or hard decline Use I.P. Geolocation Screening to find Location/Shipping Mismatches Problem: Strong Detection at the Cost of High False Positives! Rule 1 Rule 2 IP Geolocation Coverage Suspicious AVS Order Amount

The Real World Challenge: What a Fraud Prevention System Should Do A good, multi-dimensional fraud prevention system must seamlessly integrate many different tools and technologies to: Accurately Detect Fraud Minimize False Positives Return a Sensible Response Suspicious AVS Order Amount

New Tools and Techniques Can Bring New Challenges Some technologies don’t fit our existing paradigms Some technologies are expensive Some address very specific fraud scenarios More tools and technologies can actually make decision making more difficult Some may require additional customer data, such as SSN/last 4 or ask personal validation questions Cost per transaction increases when more techniques and technologies are added to the suite of fraud tools Fraud Evolves. Will these be valid in 2 years? 1 year? 6 Months? Could lead to increased manual review costs, false positives and customer dissatisfaction

Merchant vs. Issuer Fraud Prevention Merchant Fraud Prevention Screening is transaction-centric Primary goal is to protect loss of goods while staying out of compliance programs (e.g. Visa RIS) Primary focus on CNP channels Historical perspective on cardholder is relatively limited Transaction Data set is very robust – Who? What? When? How? More focus on real-time screening Many more detection tools exist due to robust CNP data set Issuer Fraud Prevention Screening is more account- centric Primary goal is to protect losses within issuing portfolio Not primarily focused on CNP – in fact, CNP is often removed from some screening models Historical perspective on cardholder is comprehensive Transaction Data set is limited: Basic account and transaction details Less focus on real-time screening (although this is changing) Certain tools can be deployed much more effective (e.g. neural networks) Private Label transactions offer a unique “Issuer/Merchant” perspective, but consolidated Merchant / Issuing fraud prevention systems do not exist today!

Private Label Card Fraud Examples Merchant sample includes 3 very large, established major retailers with significant transaction volumes and private label portfolios Includes CNP Fraud rates for transactions taken place in 2008, with the exception of Retail “B”, whose statistics are from July to December 2008 Base on Retail Decisions merchant assessments, April 2009 (delay introduced to allow for confirmed fraud/chargeback resolution window) “ Fraud Rate” is defined as known-fraud, but not necessarily chargebacks. Some fraud is detected and denied before a chargeback occurs. Actual chargeback rates for Other Card Types is significantly lower than reflected above Private Label Cards Other Cards Types Fraud Rate: % of Transactions % of Overall $ Value % of Transactions % of Overall $ Value Large Retailer “A” (Apparel, Home Goods) 0.08% 0.23% 0.16% 0.34% Large Retailer “B” (Mixed Retail) 0.44% 1.56% 0.41% 1.30% Large Retailer “C” (Mixed Retail) 0.50% 0.98% 1.5% 3.2%

Private Label Fraud: So What Does This Mean? The Good Existing fraud prevention systems and techniques can be used to help prevent PL fraud – no special investment necessary PL merchants have a full historical perspective of a consumer’s spending, which is valuable in fighting fraud (merchant/issuer perspective vs. a merchant only perspective with bankcards) No association regulations/governance regarding chargeback rates, so balance between revenue and fraud rates can be adjusted such that chargeback rates can exceed 1% for extended periods of times The Bad & The Ugly Yes, Private Label Fraud exists! …and at relatively high levels Private label card fraud has more of a negative impact on merchant from a consumer “trust” perspective vs. bankcard fraud (losing trust in the merchant vs. losing trust in the system) Lack of consortium-based technology solutions in Private Label space from, both, an application and transactional perspective: i.e. negative files, consortium neural/statistical models, etc. PL issuer/acquires have not traditionally focused on offering merchant fraud services and CNP fraud is still increasing at an alarming rate

Latest Trends: Private Label Gift Card and Stored Value Card Fraud on The Rise Gift Card Fraud: Defined as the fraudulent purchase of a virtual or plastic gift card Extremely Dangerous for a number of reasons: Allows for easy monetization using fraudulent credit cards as the acquisition mechanism. Even if the compromised credit card is stopped by the issuer, the value on the gift cards usually persists and the merchant continues to be defrauded. The purchase of the gift cards and the use of the actual gift card can occur across multiple channels, so the link is usually lost due to a lack of multi-channel fraud prevention systems (e.g. purchase the gift card online, use the gift card in-store) Gift cards are highly fencible and a mature, legitimate resale market exists. In many cases the actual user of the gift card is not a criminal. Key: June – December 2008 [January-February 2009] Virtual Gift Cards Plastic Gift Cards Other Cards Types (Non-PL) Fraud Rate: % of Transactions % of Overall $ Value % of Transactions % of Overall $ Value % of Transactions % of Overall $ Value Large Retailer “A” (Apparel, Home Goods) 0.80% [1.50%] 1.00% [1.70%] 0.03% [0.60%] 0.03% [0.90%] 0.16% 0.34% Large Retailer “B” (Mixed Retail) 4.10% 10.6% 2.10% 3.05% 0.41% 1.30% Large Retailer “C” (Mixed Retail) 1.70% [6.70%] 2.60% [5.5%] 0.70% [2.7%] 2.80% [2.6%] 1.5% 3.2%

What can be accomplished? Customer Case Study – Top 10 Retailer Prior to implementation of ReDShield (January 2007), Retailer had a charge-backs rate of 0.5% by value, with revenues growing by $3 million per month As at December 2007, Retailer average charge-back rate was 0.08% by value Total value and volume continue to grow (~200% in value in 2007) charge-backs continue to decrease and the decline rate remains low at 3.8% 23 Retailer Chargeback Data

Customer Case Study – Top 5 Digital Download / Gaming 24 Top 5 online gaming merchant with over 12 million active customers ReD Shield helped to significantly reduce Digital Merchant’s deny rate from 14% in May 07 to 3% in March 08 Total of 8,646 chargebacks received for a total volume of 2.5 million transactions Chargeback rate reduced from 1.64% in May 2007 to less than 0.02% in March 2008

Customer Case Study – Top 5 Global Travel Site (£ ‘000) 25 In January 2007 Travel Site began to make use of ReD Shield – after six months, 90% of the total fraud losses were stopped Country Total Fraud Total Fraud stopped by ReD Percentage Stopped UK 1,356 1,186 88% Germany 356 330 93% France 504 476 95% Italy 6 4 60% TOTAL 2,221 1,996 90%

Day 1 Customer Case Study – Fraud Ring for Top 5 Jeweller Individual IP address, phone numbers, email address, card numbers & shipping addresses all shared and used in one attack 26

Day 3 Customer Case Study – Fraud Ring for Top 5 Jeweller Individual IP address, phone numbers, email address, card numbers & shipping addresses all shared and used in one attack 27

Day 7 Tried to get £30,000 worth of goods in just 7 days Customer Case Study – Fraud Ring for Top 5 Jeweller Individual IP address, phone numbers, email address, card numbers & shipping addresses all shared and used in one attack 55 delivery addresses, 30 computers, 64 email addresses, 55 credit cards and 50 telephone numbers 28

Customer Case Study – ReD Shield Consistent Results UK Top 5 High-Street Retailer began using ReD Shield in August 2007 International Mobile Phone Operator began using ReD Shield in June 2002 Total Chargeback Rate Total Chargeback Rate 29 Mobile Phone Operator Major High Street Retailer (Pharmacy/Cosmetics, etc.)

Christopher Uriarte [email_address] US: +1 732.452.2440 UK: +44 (0) 1483 728700 Thank You! Please feel free to contact me with any questions!

Understanding the Card Fraud Lifecycle : A Guide For Private Label Issuers

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Understanding the Card Fraud Lifecycle : A Guide For Private Label Issuers (20)

Recently uploaded (20)

Understanding the Card Fraud Lifecycle : A Guide For Private Label Issuers

Editor's Notes