Online Fraud Report

Embed Size (px)

Citation preview

  • 8/8/2019 Online Fraud Report

    1/24

  • 8/8/2019 Online Fraud Report

    2/242

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    Report & Survey MethodologyThis report is based on a survey of U.S. and Canadian online

    merchants. Decision makers who participated in this surveyrepresent a blend of small, medium and large-sized organizations

    based in North America. Merchant experience levels range from

    companies in their first year of online transactions to some of the

    largest e-retailers and digital distribution entities in the world.

    Merchants participating in the survey reported a total estimate of

    more than $60 billion for their 2009 online sales. Survey respondents

    include both non-CyberSource and CyberSource merchants.

    The survey was conducted via online questionnaire by Mindwave

    Research. Participating organizations completed the survey

    between September 10th and October 7th 2009. All participantswere either responsible for or influenced decisions regarding risk

    management in their companies.

    Get Tailored Views of Risk Management Pipeline MetricsTo obtain customized fraud management benchmarks for your companys size and industry please contact CyberSource at

    1.888.330.2300 or online at www.cybersource.com/contact_us.

    For additional information, whitepapers and webinars, or sales assistance:

    Contact CyberSource: 1.888.330.2300 or www.cybersource.com/contact_us Risk Management Solutions: visit www.cybersource.com/products_and_services/risk_management/

    Global Payment & Security Solutions: visit www.cybersource.com/products_and_services/global_payment_services/

    Summary of Participants ProfilesOnline Fraud Survey Wave 2004 2005 2006 2007 2008 2009

    Total number of merchants participating 348 404 351 318 400 352

    Annual Online Revenue

    Less than $500K 34% 50% 37% 29% 31% 38%

    $500K to Less than $10M 39% 24% 30% 35% 28% 23%

    Over $10M 27% 26% 33% 37% 41% 39%

    Duration of Online Selling

    Less than One Year 12% 14% 11% 5% 11% 5%

    1-2 Years 14% 19% 11% 13% 12% 16%

    3-4 Years 30% 23% 18% 18% 13% 14%

    5 or More Years 44% 45% 61% 67% 64% 65%

    Risk Management ResponsibilityUltimately Responsible 50% 60% 54% 55% 58% 54%

    Influence Decision 50% 40% 46% 45% 42% 46%

    http://www.cybersource.com/contact_ushttp://www.cybersource.com/products_and_services/risk_management/http://www.cybersource.com/products_and_services/global_payment_services/http://www.cybersource.com/products_and_services/global_payment_services/http://www.cybersource.com/products_and_services/risk_management/http://www.cybersource.com/contact_us
  • 8/8/2019 Online Fraud Report

    3/243

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    32010 CyberSource Corporation. All rights reserved.

    EXECUTIVE SUMMARY.....................................................................................................4

    STAGE 1: AUTOMATED SCREENING ...................................................................................7

    Fraud Detection Tools Used During Automated Screening.........................................7

    Planned Automated Screening Tool Usage 2009 .......................................................9

    Automated Decision/Rules Systems ........................................................................10

    STAGE 2: MANUAL REVIEW ............................................................................................11

    Manual Order Review Rates ....................................................................................11

    Review Tools & Practices.........................................................................................13

    Review Operations Efficiency ..................................................................................13

    Final Order Disposition............................................................................................14

    STAGE 3: ORDER DISPOSITIONING (ACCEPT/REJECT).......................................................15

    Post-Review Order Acceptance Rates......................................................................15

    Overall Order Rejection Rates .................................................................................15

    International Orders Riskier ....................................................................................16

    STAGE 4: FRAUD CLAIM MANAGEMENT ...........................................................................17

    Fighting Chargebacks .............................................................................................17

    Chargeback Management Tools...............................................................................17

    ChargebacksAccount for Only Half the Problem .................................................18

    Fraud Rate Metrics..................................................................................................18

    TUNING & MANAGEMENT ...............................................................................................21

    Maintaining and Tuning Screening Rules................................................................21

    Global Fraud Portals................................................................................................21

    Merchant Budgets for Fraud Management ..............................................................21

    Budget Allocation....................................................................................................22

    RESOURCES & SOLUTIONS ............................................................................................23

    CyberSource Payment Management Solutions.........................................................23

    ABOUT CYBERSOURCE ..................................................................................................24

    For More Information ...............................................................................................24

    Table of Contents

  • 8/8/2019 Online Fraud Report

    4/244

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    Managing online fraud continues to be a significantand growing cost for merchants of all sizes. To betterunderstand the impact of payment fraud for online

    merchants, CyberSource sponsors annual surveysaddressing the detection, prevention and management ofonline fraud. This report summarizes findings from oureleventh annual survey.

    OverviewFrom 2006 to 2008 the percent of online revenues lost topayment fraud was stable. Merchants consistently reportedan average loss of 1.4% of revenues to payment fraud.However, total dollar losses from online payment fraud inthe U.S. and Canada steadily increased during this periodas eCommerce continued to grow. Revenue losses reached

    a peak in 2008 with an estimated $4 billion in onlinerevenues lost to payment fraud. As the U.S. economyexperienced its longest post war recession, expectationswere that online payment fraud activity would increaseleading to even higher fraud losses. Based on the resultsof this years survey it appears that past investments andexperience have allowed many online fraud mangers to notonly weather the current economic downturn but also helptheir online businesses bottom line performance during a

    period of slower online sales. For the first time since 2003,total estimated online revenues lost to fraud declined yearon year, falling 18% from $4B to $3.3B, and the average

    percent of online revenues lost to payment fraud droppedto 1.2%, the lowest level we have recorded in the elevenyear history of the survey (see chart #1). At the same time,fraud managers were able to once again increase orderacceptance rates for the second year in a row.

    Key Fraud MetricsThe percent of accepted orders which are later determinedto be fraudulent also fell in 2009. In 2009, merchantsreported an overall average fraudulent order rate of 0.9%,down from 1.1% in 2008 for their U.S. and Canadianorders. Over the past six years the average percent of

    accepted orders which turn out to be fraudulent hasvaried from 1.0% to 1.3%. 2009 represents the first timethis rate has dropped below the 1% threshold. Amongindustry sectors, Consumer Electronics reported the highestfraudulent order rate, averaging 1.5%, but this was downfrom 2.0% in 2008.

    The share of incoming orders merchants declined to acceptdue to suspicion of payment fraud continued the downwardtrend started in 2008. Put more simply, merchants are

    Executive Summary

    2.0%

    1.0%

    0.5%

    1.5%

    2.5%

    3.5%

    3.0%

    4.0%

    0%

    $4.5

    $0.0

    % Revenue Lost to Online Fraud

    %O

    nlineRevenueLost

    3.6

    %

    3.2

    %

    1.7%

    1

    .8%

    1.6%

    1.4

    %

    2.9

    %

    2000n=132

    2002n=341

    2001n=220

    2003n=333

    2004n=348

    2005n=404

    2006n=351

    1.4

    %

    2007n=294

    1.4

    %

    2008n=399

    1.2

    %

    2009n=317

    $3.0

    $3.5

    $4.0

    $2.0

    $1.5

    $1.0

    $0.5

    $2.5

    Online Revenue Loss Due to FraudEstimated $3.3B in 2009

    $LossinBillions

    The rate of revenue loss due to online payment fraud declined in 2009 and total dollars lost to fraud declined by an estimated $700 million the first drop since 2003.

    $1.5 $

    1.7 $1.9

    $2.6 $

    2.8

    $3.1

    $3.7

    $4.0

    $2.1

    2000 20022001 2003 2004 2005 2006 2007 2008

    $3.3

    2009

    1

  • 8/8/2019 Online Fraud Report

    5/245

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    52010 CyberSource Corporation. All rights reserved.

    accepting a higher percentage of orders. Since 2007, thepercent of orders rejected due to suspicion of fraud hasfallen from 4.2% to 2.4% in 2009, a decline of more than

    40% in order rejection, representing a 1.8% increase intotal orders accepted.

    As the growth of online sales has slowed over the past twoyears, it appears merchants are continuing to focus theirefforts on sales conversion and reducing order rejectionrates due to suspicion of fraud. The survey results indicatemany merchants have successfully increased their orderacceptance rate with little or no increase in fraud rates.

    Chargebacks Understate Fraud Loss by asMuch as 50%

    This years survey again probed the percent of fraudlosses accounted for by chargebacks. Overall, merchantscontinue to report that chargebacks accounted for lessthan half of fraud losses. The remainder occurred whenmerchants issued credit to reverse a charge in response toa consumers claim of fraudulent account use.

    International Order Risk Falls but RemainsHigher Than Domestic OrdersOn average, merchants now say the rate of fraud associatedwith international orders is over two times as high asdomestic orders. In 2009 merchants report dramatic

    improvement in managing fraud risk on international orderswith those fraud rates falling from a 2008 average of4.0% to 2.0% this year. However, merchants continued toreject international orders at a rate three times higher thandomestic orders.

    Manual Review RatesOver the past five years the overall percent of online ordersthat enter manual fraud review has fluctuated between

    20% and 27%, about 1 out of 4, on average. In somesegments, fraud risk is low enough for merchants to relyentirely on automated review, which lowers the aggregatereview ratio. But most merchants do manually reviewsome of their orders for fraud risk. Over the past fiveyears these merchants review, on average, 1 out of every3 orders. Large online merchants that typically employmore automation, continue to have much lower manualreview rates. Over the past three years, large merchants($25M+ in online sales) performing manual order reviewhave, on average, reviewed approximately 15% of orders.Looking back over the past several years of survey data, we

    conclude that most merchants have made little progressin reducing their reliance on manual review and are likelyreviewing more orders today than they were just a few yearsago.

    Efficiency Gains RequiredAs eCommerce sales continue to grow and budgets andresources remain relatively fixed, merchants face thechallenge of screening more online orders while keepingorder rejection and fraud rates as low as possible tomaximize sales and profits. Continued reliance on manualreview presents a serious challenge to scalability. Can

    merchants grow their review staffing sufficiently to keeppace with fraud? Similar to 2008, in 2009 only 13%of online merchants expect to increase manual reviewstaff in the coming year and 9% anticipate decreasingstaff levels. These are the lowest levels of planned staffincreases we have seen in the 11-year history of thesurvey. At the same time, merchants report that improvingtheir automated dectection and sorting capability is a keyarea of focus for 2010.

  • 8/8/2019 Online Fraud Report

    6/246

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    Total Pipeline View

    Businesses that concentrate solely on minimizingchargebacks may not be seeing the complete financialpicture. Online payment fraud impacts profits from onlinesales in multiple ways. Besides direct revenue losses,the cost of stolen goods/services and associated delivery/fulfillment costs, there are the additional costs of rejectingvalid orders, staffing manual review, administration of fraudclaims, as well as challenges associated with businessscalability. Merchants can gain efficiency by taking a totalpipeline view of operations and costs. While the fraud rateis one metric to monitor (and contain within industry andassociation limits), an end-to-end view is required to arriveat the optimum financial outcome.

    In 2009, these profit leaks in the Risk ManagementPipeline impact as much as 36% of orders for mid-sizedmerchants and as much as 20% of orders for largermerchantsrestricting profits, operating efficiency andscalability. This report details key metrics and practices ateach point in the pipeline to provide you with benchmarksand insight. Custom views of these benchmarks andpractices are available through CyberSourcesee end ofreport for contact information.

    PROFIT LEAKSStaffing &Scalability

    LostSales

    Fraud Loss &Administration

    2.4% Avg. Reject Rate

    for US/Canadian orders

    (all merchants)

    7.7% Avg. Reject Rate

    for Non-US/Canadian

    orders (merchants who

    accept these orders)

    73% of merchants review

    orders. These merchants

    review 28% of orders, on

    average.

    51% of fraud management

    budget is spent on review

    staff costs

    78% of these merchants

    have no plans to change

    manual order review

    staffing during 2010

    1.2% Average Fraud Loss

    49% from chargebacks

    51% from issued credits

    Risk Management Pipeline

    AutomatedScreening

    ManualReview

    Accept /Reject

    Retained

    RevenueOrder

    Fraud ClaimManagement

  • 8/8/2019 Online Fraud Report

    7/247

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    72010 CyberSource Corporation. All rights reserved.

    Fraud Detection Tools Used DuringAutomated ScreeningWe define detection tools as those used to identify theprobability of risk associated with a transaction or to validatethe identity of the purchaser. Results of tests carried outby detection tools are then interpreted by humans or rulessystems to determine if a transaction should be accepted,rejected or reviewed. A wide variety of tools are available tohelp merchants evaluate incoming orders for potential fraud.

    Merchants handling large online order volumes typicallyemploy an initial automated order evaluation to determine if anincoming order might represent a fraud risk. Some merchantswill allow this initial automated screen to cancel orders withoutfurther human intervention. 47% of all merchants cancelledsome orders as a result of their automated screening processand 54% of large merchants indicated they cancelled some

    orders at this stage (see chart #2).

    In 2009, 70% of merchants reported using three or morefraud detection tools for automated screening, with 4.7tools being the average. Larger merchants dealing withhigher order volumes reported using 7.3 detection tools,on average.

    The most popular tools used to assess online fraud risk areshown in chart #3, which shows the current and plannedadoption of different tools. Note that the tool usage profilefor merchants over $25M in online sales is different thanthe overall average. These larger merchants generally usetools across all four dimensions of detection, and more oftenuse their customer history and proprietary data during theautomated order screening process. They have a higher use ofcompany-specific risk scoring models, negative and positivelists, and sophisticated order velocity monitoring tools.

    Overall, 97% of merchants use one or more validation

    tools. These tools are often provided by the cardassociations to help authenticate cards and card holders.The tools most often mentioned by merchants arethe Card Verification Number and the AddressVerification Service (AVS). AVS compares numericaddress data with information on file from thecardholders card issuing bank. AVS is generallyavailable for U.S. cardholders and for limitednumbers of cardholders in Canada and the UK. AVSis subject to a significant rate of false positiveswhich may lead to rejecting valid orders, as wellas missing fraudulent orders. If the cardholder hasa new address or a valid alternate address (such

    as seasonal vacation home), this information maynot be reflected in the records of the cardholdersissuing bank, so the address would be flagged asinvalid. Merchants typically do not rely solely on AVSto accept or reject an order.

    The Card Verification Number (CVN - also knownas CVV2 for Visa, CVC2 for MasterCard, CID forAmerican Express and Discover) is the second mostcommonly used detection tool. The purpose of CVNin a card-not-present transaction is to attempt to

    Stage 1: Automated Screening

    47%

    Yes34%

    13%

    53%

    No

    18%

    36%

    54%

    Yes No

    46%

    Base: Those using automated services/technologies

    Are Inbound Orders RejectedBased Solely On Automated Screening?

    n=269 n=96

    No, generally all suspicious orders are out-sorted for manual reviewYes, if automated tests indicate too much risk OR customer is on our negative listYes, but generally ONLY if customer is on our negative list

    All Merchants Merchants $25M+ Online Revenue

    2

    Automated

    Screening

    Manual

    Review

    Accept /

    Reject

    Retained

    RevenueOrder

    Fraud Claim

    Management

    Tuning & Management

  • 8/8/2019 Online Fraud Report

    8/248

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    verify that the person placing the order has the actual cardin his or her possession. Requesting the card verificationnumber during an online purchase can add a measure ofsecurity to the transaction. However, CVN numbers can

    be obtained by fraudsters just as credit card numbers areobtained. CVN usage by online merchants has significantlyincreased in the last five years, rising from 44% in 2003 to77% today.

    Large merchants were asked to identify the three mosteffective tools they use. To eliminate the bias that couldstem from more commonly used tools receiving morementions, we normalize the data by looking at the percentof merchants using a particular tool who cite that tool asone of their top three choices.

    Company specific fraud screens received the highesteffectiveness rating by merchants who use this tool. Overhalf of large merchants use custom fraud models and37% of these merchants rated them as one of their three

    most effective tools. These fraud screens are risk scoringmodels which are tuned using an individual merchantshistorical data on factors associated with online orders.Since fraudsters learn over time and vary their strategies,we typically find most risk scoring models need regulartuning with new analysis and data in order to maximizetheir effectiveness.

    Half of larger merchants also employ IP geolocationtools in their fraud management process. In 2009, thesetools were ranked second in effectiveness with 36% of

    Automated Fraud Detection Tool Current Usage and Plans

    All Merchants Merchants $25M+ Online Revenue

    VALIDATION SERVICES

    Address Verification Service

    Paid for public records service

    Out-of-wallet or in-wallet challenge/response

    Telephone number verification/reverse lookup

    Credit history check

    CVN (Card Verification Number)

    Postal address validation services

    Verified by Visa/MasterCard SecureCode

    YOUR PROPRIETARY DATA/CUSTOMER HISTORY

    Fraud scoring model company specific

    Customer order history

    Order velocity monitoring

    Positive lists

    Customer website behavior analysis

    Negative lists (in-house lists)

    PURCHASE DEVICE TRACING

    Device fingerprinting

    IP geolocation information

    MULTI-MERCHANT DATA/PURCHASE HISTORY

    Multi-merchant purchase velocity

    Shared negative lists shared hotlists

    Other

    Currently usePlanning to implement (next 12 months)

    Current n=308; Future Plans n=166 Current n=99; Future Plans n=58

    77% 14%

    76% 10%

    34% 12%

    29% 20%

    24% 12%

    13% :8%

    5% :5%

    5% :7%

    44% 16%

    40% 8%

    35% 14%

    28% 13%

    19% 16%

    21% 10%

    9% :27%

    27% 22%

    16% :13%

    12%:11%

    4% :7%

    80% 9%

    86% 3%

    35% 14%

    16% 12%

    33% 12%

    24% 17%

    4% :5%

    10% :5%

    61% 10%

    75% 5%

    66% 12%

    53% 17%

    19% 19%

    41% 14%

    52% 26%

    18% :45%

    23% 19%

    12%

    6% :9%

    19%

    3

  • 8/8/2019 Online Fraud Report

    9/249

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    92010 CyberSource Corporation. All rights reserved.

    large online merchants using these tools selecting IPgeolocation as one of their three most effective tools.IP gelocation tools attempt to identify the geographiclocation of the device from which an online order wasplaced. It provides an additional piece of informationto compare against other order information and orderacceptance rules to help assess the fraud risk of an order.In some cases, only an internet service providers addressis returned so the ultimate geographic location of the

    device remains unknown. Fraudsters mayalso employ anonymizers/proxy servers tohide their true IP address and location.

    Planned Automated ScreeningTool Usage 2009

    Device Fingerprinting Highest on

    Plan to Buy Lists

    Almost half (47%) of the surveyedmerchants planned to add one or morenew fraud detection tools into theirautomated screening process over thenext twelve months. Three tools had 20%

    or more of merchants planning to adoptthem in 2009. These tools are DeviceFingerprinting, IP Geolocation and PayerAuthentication Services provided by thecard associations.

    Device Fingerprinting examines andrecords details about the configuration ofthe device from which the order is beingplaced. This can aid in flagging fraudattacks where a variety of fraudulentorders are launched from a commondevice or set of devices. Overall, 27%

    of merchants report plans to add DeviceFingerprinting in the next twelve monthsand 45% of large online merchantsindicated they were planning to addDevice Fingerprinting.

    IP geolocation tools also showed a highlevel of merchant interest. Currently,27% of merchants say they employ IPgeolocation and another 22% plan to addthis capability.

    As in the past several years, card associationpayer authentication services (e.g. Verified

    by Visa, MasterCard SecureCode) figureprominently in merchants future plans. 2009 survey resultsshow that 29% of merchants currently use one or more ofthe available payer authentication services. Currently, 20%of respondents say they are interested in deploying thesesystems in the next twelve months as a new tool to managefraud. However, despite significant interest in implementingpayer authentication systems over the past few years, we haveseen relatively slow actual adoption of payer authenticationsince we started tracking this tool in 2003.

    Most Effective Fraud Management Tools% merchants using tool that selected it as one of their top three most effective*

    (Merchants $25M+ Online Revenue)

    * Base: Those using specified tool

    Paifd for public records searches 32%

    Verified by Visa or MasterCard SecureCode 19%

    Telephone number verification/reverse lookup 15%

    Credit history check 20%

    Address Verification Service (AVS) 16%

    Postal address validation services 9%

    CVN (Card Verification Number) 16%

    Fraud-scoring model company specific 37%

    Customer website behavior analysis 22%

    Negative lists (in-house lists) 31%

    Contact customer to verify order 26%

    Customer order history 16%

    Out-of-wallet or in-wallet challenge/response 10%

    Order velocity monitoring 14%

    Positive lists 7%

    IP geolocation information 36%

    Device fingerprinting 22%

    Multi-merchant purchase velocity 21%

    Shared negative lists shared hotlists 11%

    Contact card issuer/Amex CVP 2%

    VALIDATION SERVICES

    SINGLE MERCHANT PURCHASE HISTORY

    PURCHASE DEVICE TRACING

    MULTI-MERCHANT PURCHASE HISTORY

    4

  • 8/8/2019 Online Fraud Report

    10/2410

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    Implementing payer authentication should reduce exposure

    to card-not-present fraud loss either by authenticating

    the buyers identity or by shifting fraud liability back to

    the card issuing bank (interchange incentives also apply).Further, certain card types in some countries are beginning

    to require that payer authentication solutions be used as a

    condition of accepting the associated cards (e.g. Maestro

    Cards in the United Kingdom). But, if merchants have a

    sufficiently high direct fraud loss rate, the card association

    may not permit the merchant to shift liability, even if the

    merchant has implemented a payer authentication system.

    These systems may help reduce the incidence of online

    credit card fraud if a critical mass of consumers register

    their cards and accept the new checkout procedures.

    Successful adoption of payer authentication will require

    merchants to put procedures in place to handle customerswho have not adopted verification services or who

    use cards or payment types which are not supported.

    International expansion and the growing popularity of

    online payment types such as electronic checks, PayPal,

    Bill Me Later, etc. also drive the need for alternative

    fraud management techniques.

    Automated Decision/Rules Systems

    Automated Order Screening

    Automated order decisioning/screening systems continue

    to grow in use and are now used by 67% of merchants (upfrom 25% in 2005) and 87% of large online merchants.

    These tools help companies automate order screening

    by applying a merchants business rules in the real-time

    evaluation of incoming orders.

    Decision and rules systems automate the evaluation of test

    results generated by fraud detection tools and determine

    whether the transaction should be accepted, rejected, or

    suspended for review. As the number of tools used grows,it is becoming increasingly important for merchants to

    employ automated systems to interpret and weigh the

    multiple results for each product or transaction profile

    (versus a one size fits all screen) to optimize business

    results. Because fraud patterns are dynamic, and the

    introduction of new products, services or markets often

    requires a unique set of acceptance rules, it is imperative

    that these systems also quickly adapt to the changing

    environment. Forty-five percent of large merchants say their

    screening system allows business managers to create and

    modify screening rules without assistance from external

    experts or internal information technology staff.

    Results of Automated Screening

    The automated order screening process generates three

    outcomes: 1) order acceptance without further review, 2)

    orders flagged for further review and 3) automatic order

    rejection. 47% of merchants indicated they reject some

    orders based on automated screening tests and 54% of

    large merchants indicated doing so.

  • 8/8/2019 Online Fraud Report

    11/2411

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    112010 CyberSource Corporation. All rights reserved.

    Orders which do not pass the automated order screeningstage typically enter a manual review queue. Duringthis stage, additional information is often collected todetermine if orders should be accepted or rejected due toexcessive fraud risk.

    Manual review represents a critical area of profit leakage.It is expensive, limits scalability, and can impact customersatisfaction. For many merchants it represents half of theirfraud management budget. Only 13% of merchants saythey have budget available to increase review staff nowor in the next twelve months. This presents significantchallenges to profit growth since even at a stable percentof orders sent to review, the total number of orders thatmust be reviewed increases in step with the total increaseof online sales.

    Manual Order Review RatesIn what should be a highly automated sales environment,most merchants are manually checking orders. In fact,during the past six years overall, 1 out of every 4 orders

    transacted online have been manually reviewed (see chart#5). Over the same period, merchants who conduct manualreview typically reviewed 1 out of 3 orders they received.

    Merchants of all sizes use manual review to managepayment fraud. Chart #6 shows smaller merchants reviewa higher percentage of orders (perhaps because lowerorder volumes permit such practice) but even largermerchants review a significant percentage of onlineordersand likely devote more resources to this task thanis operationally scalable.

    Stage 2: Manual Review

    35%

    15%

    5%

    25%

    30%

    10%

    20%

    40%

    45%

    50%

    55%

    0%

    Average % of Orders Manually Reviewed(for merchants engaged in review)

    200720082009

  • 8/8/2019 Online Fraud Report

    12/2412

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    One consequence of using more fraud detectiontools during automated screening is a greaterchance of one or more flags being raised,

    resulting in an order being selected for manualreview. Adding more tools to detect fraud mayresult in downstream impacts and costs ifthese tools are not carefully integrated intoa merchants review process and tuned to amerchants specific situation.

    Merchants expecting increased online saleswill need to take at least one of the followingactions: 1) divert more staff time to the orderreview process; 2) increase staffing levels;3) allow more time to process orders and shipgood ones; or 4) improve accuracy of initialautomated sorting and make the subsequentreview process more efficient.

    Fraud Detection Tool Usage During Manual Review

    All Merchants Merchants $25M+ Online Revenue

    66% 11%

    55% 7%

    46% 16%

    41% 9%

    26% 7%

    9% :13%

    % currently using% planning to begin use (in 2009)

    Current n=245; Future Plans n=95 Current n=87; Future Plans n=34

    VALIDATION SERVICES

    Telephone number verification/reverse lookup

    Credit history check

    Paid for public records service

    Contact customer to verify order

    Contact card issuer/Amex CVP

    Postal address validation services

    75% 6%

    70% 6%

    55% 9%

    38% 0%

    51% 3%

    5% :15%

    69% 16%

    45% 9%

    27% 16%

    20% 18%

    YOUR PROPRIETARY DATA / CUSTOMER HISTORY

    Positive lists

    Customer order history

    Customer website behavior analysis

    Negative lists (in-house lists)

    79% 12%

    63% 9%

    23% 15%

    29% 29%

    34% 26%

    PURCHASE DEVICE TRACING

    IP geolocation information 55% 32%

    13% :27%MULTI-MERCHANT DATA/PURCHASE HISTORY

    Shared negative lists shared hotlists 17% 38%

    4% :11%Other 8% :3%

    8

    Currently usePlan to implement in 2010Do not use or plan to implement

    Use or Plan to Implement Case Management Systemto Support Manual Order Review Process

    16%

    54%30%

    n=211

    All Merchants

    34%

    49%

    17%

    n=76

    Merchants $25M+

    Base: Those conducting manual review

    7

  • 8/8/2019 Online Fraud Report

    13/2413

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    132010 CyberSource Corporation. All rights reserved.

    Review Tools & PracticesGiven the reported limitations on hiring additional manualreview staff, there is increased focus on investing in toolsand systems to increase the productivity and effectivenessof review staff. While the primary focus should be onimproving initial automated sorting accuracy to decreaseneed for review, attention to streamlining the reviewprocess is also warranted.

    Use of Case Management Systems

    Currently, 1 out of 3 merchants report having a casemanagement system that supports their manual reviewprocess and staff. Almost half of merchants either currentlyuse a case management system or plan to implementone in 2010. For large online merchants, half report

    they currently use a case management system and 66%report currently using or planning to implement a casemanagement system.

    Merchants using a case management system are alsomore likely to be able to track fraud rates on orders whichhave gone through manual review. 66% of merchantsusing case management systems report tracking fraudrates for manually reviewed orders, vs. only 44% beingable to do so when not using a case management system.Surprisingly, 46% of merchants performing manual orderreview say they do not track the fraud rates of orderswhich have been manually reviewed, and one-third of

    large merchants say they do not have this information.Without knowing the fraud rate on orders going throughmanual review, and who reviewed them, it is difficult todetermine training needs or other actions to improve theeffectiveness of manual review.

    Tools Used/Planned During Manual Review

    While many of the tools or detector results used duringautomated screening can also be used during manualreview, several additional tools and processes areemployed by manual reviewers. Attempting to validatean order by reviewing past customer order history andcontacting the customer is standard practice for 7 out of10 merchants overall, and 8 out of 10 large merchants.However, most organizations have policies regarding howquickly they must clear orders through manual reviewand how long they will wait for customers to respond torequests for additional information. Most merchants tryto clear orders through manual review in one businessday and say they will not wait more than three businessdays for a customer to respond to a request for moreinformation. Another practice used only in manualreview is to contact the card issuer. This action is taken

    by almost half of merchants overall and 55% of largemerchants. Telephone number validation/reverse lookupis the third most popular tool with 55% of merchants

    using it during manual review vs. 24% during automatedscreening. Large online merchants are more likely tomaintain and use negative lists and use them during bothautomated screening and manual review processes.

    In 2009, over half of merchants reported using 4 or morefraud detection tools for manual review, with 4.6 toolsbeing the average. Larger merchants reported using 5.9detection tools, on average.

    The most popular tools currently used in the manual reviewprocess are shown in chart #8, including the percent ofmerchants planning to add each tool in 2009.

    Review Operations EfficiencyReviewer Efficiency

    The median number of orders a reviewer processed in aday ranged from 5 for small merchants to 150 for largemerchants with an overall median of 60 orders per day(see chart #9). Large merchants who typically have casemanagement systems achieve a 2.5X higher throughputper reviewer in the manual review stage, possibly due togreater use of review systems and detection tools duringmanual review. Typically, reviewers spent 8 minutesreviewing an order in 2009.

    Overall $500K

  • 8/8/2019 Online Fraud Report

    14/2414

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    Merchants reported that, on average, reviewers wererequired to invoke and input data to 3.7 systems to reviewan order. The ability to integrate or automate interfacing

    with these multiple systems represents an opportunity tofurther streamline the review process.

    Staff Tenure

    Given the cost and time required to recruit and trainnew staff, merchants need to focus on staff retention.Fraud rates or order rejection rates can increase if highlyexperienced review staff leave an organization and are eithernot replaced or replaced by less experienced reviewers.

    Final Order DispositionAutomated screening and manual order review ultimatelyresult in order acceptance or rejection. A relatively highpercentage of orders manually reviewed are ultimatelyaccepted (see next section)highlighting the need formerchants to improve automated screening accuracy andreduces the need for review. A look at order reject andacceptance rates follows in Stage 3 of the pipeline review.

  • 8/8/2019 Online Fraud Report

    15/2415

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    152010 CyberSource Corporation. All rights reserved.

    Post-Review Order Acceptance RatesOver the past few years, merchants who manually revieworders indicated they ultimately accepted over 70% ofthe orders they manually reviewed (see chart #10). In

    2009, the average rate of acceptance for orders goingthrough manual review hit a new high of 77%. Fifty-seven percent of merchants report they accept 90% ormore of orders they manually review. These merchants areincurring significant expense to find the 10% of the reviewqueue they believe to be too risky to accept. Clearly, mostmerchants require better methods to determine whichorders are to be outsorted for manual review, so only trulysuspicious orders receive human attention.

    Overall Order Rejection RatesOrder reject rates can reflect true fraud risk or signalprofit leaks in terms of valid order rejection orunnecessarily high rates of manual review. In 2008, for the

    first time in several years, merchants participating in thesurvey reported a significant drop in their order rejectionrates from 4.2% in 2007 to 2.9% (see chart #11).

    In 2009, many merchants continued to make progress inreducing rejection rates and increasing order acceptancerates in their fraud management process. Overall, theaverage order rejection rate in 2009 dropped to 2.4%down from 2.9% in 2008. Order rejection rates droppedin 2009 for very small and medium size merchants,(see chart #11) but returned to 2007 levels for large

    merchants. While orderrejection due to suspicion

    of fraud decreased formost types of merchantsthey increased noticeablyfor Consumer Electronicssellers and Health & Beautycategories (see chart #12).

    It is likely that as online salesgrowth slows and merchantsseek to sustain revenue levels,merchants will look for waysto accept more orders andreduce orders rejected due to

    suspicion of fraud. In 2009,some merchants were ableto successfully reduce orderrejection rates and fraud rates.It remains to be seen if orderrejection rates can be reducedfurther in 2010 without anincrease in fraud rates ormanual order review.

    Stage 3: Order Dispositioning (Accept/Reject)

    % of Merchants ReportingThis Level of

    Post-Review Acceptance

    10%80% 89%

    46%90% 99%

    11%100%

    6%70% 79%

    3%60% 69%

    11%50% 59%

    1%40% 49%

    1%30% 39%

    3%20% 29%

    3%10% 19%

    3%1% 9%

    1%0%

    57% accept 90%+

    77%

    Post-ReviewAcceptance Trends

    70%

    30%

    10%

    50%

    100%

    60%

    20%

    40%

    80%

    90%

    0%

    Most orders that entermanual review are accepted

    2003

    66%

    2004

    71%

    2005

    69%

    2006

    66%

    2007

    75%

    2008

    73%

    2009

    % of Orders Accepted in Review

    10

    Automated

    Screening

    Manual

    Review

    Accept /

    Reject

    Retained

    RevenueOrder

    Fraud Claim

    Management

    Tuning & Management

  • 8/8/2019 Online Fraud Report

    16/2416

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    Order rejection rates also vary by type of product andmerchant profile. Chart #12 shows that segments whichhave high cost of goods sold and/or lower gross margins,tend to have higher order rejection rates. Each fraud lossin this arena has a large negative profit impact. Consumerelectronics and jewelry/apparel are two examples of onlinesegments that tend to have higher-than-average orderrejection rates.

    Yet even within similar groups of onlinemerchants, we see that some merchantsachieve low order rejection rates while stillkeeping fraudulent order rates under control.

    Examining the large consumer electronicsmerchants in the sample, we find that half ofthese merchants report order rejection ratesof 3% or less while maintaining fraudulentorder rates at or even below the average fortheir segment.

    International Orders RiskierMerchants consistently report a much higher level oforder rejection on international orders due to suspicion ofpayment fraud. In 2009, merchants report their rejectionrate on these orders is over 3 times that of domestic orders

    as shown in chart #13. The actual fraud rate experiencedon international orders supports this cautious approach, asmerchants report the fraud risk on international orders issignificantly higher than that of domestic orders.

    Order Rejection Rates by Selected Online Segment20082009

    Media &Entertainment

    3.4

    %

    2.2%

    Apparel/Jewelry

    2.6

    %3.2

    %

    Health &Beauty

    3.0

    %

    1.8%

    Digital Goods/Services

    2

    .4%3

    .2%

    Overall

    2

    .4%2

    .9%

    ConsumerElectronics

    6.6

    %

    4.2

    %

    Household &General

    Merchandise

    1.4

    %2.2%

    12

    Order Rejection Trends

    % of orders rejected due to suspicion of fraud (originating from US/CAN)% of international orders rejected

    International order rejection rates are typicallythree times higher than U.S./Canadian rates

    7.7

    %

    2.4

    %

    2009

    6%

    4%

    2%

    1%

    3%

    5%

    7%

    8%

    9%

    12%

    11%

    10%

    13%

    14%

    15%

    2007

    4.2%

    11.1

    %

    2008

    10.9

    %

    2.9

    %

    2006

    12.7

    %

    4.1%

    0%

    13Average % Orders RejectedDue to Suspicion of Fraud

    Overall $500K

  • 8/8/2019 Online Fraud Report

    17/2417

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    172010 CyberSource Corporation. All rights reserved.

    Fighting ChargebacksThis years survey once again examined online merchantspractices associated with reviewing and contestingchargebacks (re-presentment). Over the past 4 years

    the share of fraud-coded chargebacks merchants contesthas averaged 47% to 53%, with the 2009 average at53%. Medium and large merchants report contesting 48%and 49% respectively of their fraud-coded chargebacksin 2009. However, when we look at the distribution ofmerchants answers to this question we find that over onethird of merchants are disputing 90% or more of their fraudchagebacks, while 1 out of 5 merchants are disputing lessthan 10% of their fraud chargebacks (see chart #14).

    Merchants report that they win, on average, 42% of thechargebacks they dispute. Over the past four years theaverage chargeback win rate has ranged from 40% to 44%of chargeback represented by merchants. Simply using theaverage percent of chargebacks that are disputed (53%)

    times the average win rate of 42% results in a net recoveryrate of 22% (meaning 22% of all fraud-coded chargebacksare recovered). However, given the wide disparity in thechargeback re-presentment rate, when these are calculatedon a merchant-by-merchant basis and then averaged, there-presentment win rate rises to 24% (see chart #15). Thisis down slightly from the 28% average recovery rate foundin 2008. Disputing most fraud chargebacks and having anefficient re-presentment process can enhance profitabilityand reduce fraud loss.

    Chargeback Management ToolsOf course, disputing chargebacks is not an easyor cost-free process. Merchants must manageand organize all order, delivery and paymentinformation to successfully dispute fraudulentorders with financial institutions. Merchantsare beginning to adopt automated systemsfor handling this aspect of the pipeline. In2009, reported use of chargeback managementtools more than doubled rising from 1 outof 5 merchants in 2008 to 49% in 2009.This year, 63% of large merchants reportedusing these tools. In previous surveys, we

    asked merchants to provide estimates of howmany hours it takes on average to handle afraud chargeback. The average time spentoverall was 1.8 hours with a median time of1 hour to handle a fraud chargeback (totaltime consumed for research, documentation,submission). The largest merchants reporteda median time of 30 minutes per fraudchargeback. Clearly, fraud chargebackmanagement is a significant expense formerchants. However, having automated

    Stage 4: Fraud Claim Management

    % of Merchants ReportingThis Re-presentment Rate

    50% 5

    3%

    5%80% 89%

    12%90% 99%

    22%100%

    5%70% 79%

    1%60% 69%

    12%50% 59%

    3%40% 49%

    5%30% 39%

    12%20% 29%

    3%10% 19%

    12%1% 9%

    9%0%

    Average % Total Fraud-CodedChargebacks Re-presented

    53%

    47%

    % of Orders Accepted in Review

    2006 2007 2008 2009

    14

    Automated

    Screening

    Manual

    Review

    Accept /

    Reject

    Retained

    RevenueOrder

    Fraud Claim

    Management

    Tuning & Management

  • 8/8/2019 Online Fraud Report

    18/2418

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    chargeback tools that facilitate contesting fraud chargebackscan pay off as merchants often win a significant portion offraud chargebacks when correctly re-presented.

    ChargebacksAccount for Only Halfthe ProblemHow a fraudulent order is handled can have a significantimpact on bottom line profits. Fraudulent orders arepresented to the merchant via two main routes: as achargeback or as a direct request from a consumerfor credit (they claim fraudulent use of their account).Although chargebacks are the most often cited metric,merchants report that chargebacks actually account for lessthan half of all fraud claims.

    In 2009, medium ($5M to $25M online sales) and large($25M+ online sales) merchants reported that just overhalf of their fraud was presented in the form of a fraud-coded chargebacks (see chart 16). This increase inchargeback fraud share from 2008 may reflect merchantsefforts to fight friendly fraud during tough economictimes. Merchants may be less inclined to reverse chargesif friendly fraud is suspected, and instead direct thecustomer to follow the formal chargeback process.

    Considering the financial impact of both fraud claim routes(chargebacks and credit issuance/reversal) some merchantsencourage direct consumer contact to address fraud claimsand thus avoid the additional chargeback fees levied bythe merchant bank/processor. If a consumer contacts themerchant first, then the decision is in the merchants controlto either handle the dispute directly with the consumer orto advise them to initiate a fraud chargeback process. Inany event, if merchants are evaluating fraud losses solely onthe basis of chargebacks, the actual rate of fraud loss thebusiness is experiencing may be as much as 2 times higherdue to direct credit issuance/charge reversal.

    Fraud Rate MetricsWhen monitoring the level and trend of online fraud loss,we focus on three key metrics: 1) Overall revenue lost asa percent of total online sales; 2) percent of acceptedorders which turn out to be fraudulent (domestic andinternational); and 3) the average value of a fraudulentorder relative to a valid order. Fraud rates vary widely bymerchant and depend on a variety of factors such as onlinesales volume, type of products or services sold online, andhow such products/services are delivered and paid for. It isimportant that merchants track key fraud metrics over timeand evaluate their performance relative to their peer group(both size and industry).

    Overall $500K

  • 8/8/2019 Online Fraud Report

    19/2419

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    192010 CyberSource Corporation. All rights reserved.

    Note: this report provides benchmarks on total fraud

    rates (chargebacks + credits issued directly to

    consumers by merchants). As such, these metrics

    tend to be higher than those reported by banksand credit card associations, which generallybase reported rates on chargeback activity only.

    Depending on which products or services arebeing sold online, fraud loss risk tolerancesand order rejection rates can vary significantly.Merchants selling high cost goods withrelatively low gross margins, like most consumerelectronics products, tend to err on the side ofrejecting more orders to avoid expensive fraudlosses. Merchants who are less subject to fraudattacks can achieve similar fraud loss rateswhile rejecting relatively few orders. Over thepast few years, as fraud rates have remainedrelatively stable, we have compiled data onfraud practices and benchmarks by industry.

    Direct Revenue Loss Rates

    Very large merchants typically use more toolsand have more experience and resources tomanage online fraud, so their fraud rates tendto be lower than the overall rate. Revenue lossmeasurement includes not only the value oforders on which fraudulent chargebacks arereceived, but also the cost of any credits issued

    to avoid such chargebacks. Figures includeboth chargebacks and credits issued directly bythe merchant in response to fraud claims. In2009, medium size online merchants sufferedthe highest percent of revenues lost to paymentfraud (see chart 17). Fraudsters often targetmedium size merchants since these merchantshave enough online order volume to allowmultiple fraud attempts but may not yet havethe fraud management experience, or dedicatedpeople or systems in place to defend againstprofessional fraudsters.

    Fraudulent Order Rate for Accepted Orders

    Another key metric is the number of acceptedorders that later turn out to be fraudulent.Expressed as a percent of total orders, thismetric is typically lower than the revenue losspercent since the average value of fraudulentorders tends to be greater than the average value ofvalid orders. This causes the fraud rate as measuredby revenues to be higher. Chart 18 shows the averagefraudulent order rates by online revenue size. Overall,

    30% of merchants reported a fraudulent order rate of 1%or more in 2009, which is lower than the 38% percent whoreported experiencing a 1% fraud rate in 2008 and 2007

    20082009

    Average % of Online Revenue Lost to Payment Fraud(chargebacks & fraud-related credits)

    Overall $500K

  • 8/8/2019 Online Fraud Report

    20/2420

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    International Orders Carry Higher Risk

    Significant progress was noted in selling internationallythis year. Fifty-four percent of merchants surveyedaccepted orders from outside the U.S. & Canada in 2009.

    International sales accounted for an average of 21% oftotal orders for these merchants, an increase from 17% oforders in 2008. This same group reported that the actualdirect fraud rate on international orders fell from 4% in2008 to an average of 2% in 2009, so many merchantsare hitting their stride as they expand internationally.

    Of course, online merchants must still make sure thattheir fraud detection and management systems are robustenough to handle the additional risk involved. Despiteprogress made, international orders still have twicethe overall fraud rate of domestic online orders. Somemerchants say theyve even stopped accepting orders fromsome countries in order to manage international fraud. Ofthe merchants who accepted international orders in 2009,one out of five stopped accepting orders from one or morecountries in the past year due to high fraud levels.

    Merchants who sell online outside of the U.S. & Canadareport that they reject international orders due to suspicionof fraud at a rate that is over 3 times the U.S. andCanadian average rate of 2.4% rejecting approximately 1out of every 13 international orders received (see chart #13)

    Average Value of Fraudulent Order Higher than a

    Valid Order

    Historically, fraudulent orders tend to have higher valueson average than valid orders. In 2009, the median value ofa fraudulent order was $200 compared to a $115 medianvalue reported for valid orders (see chart #20). Sincefraudulent orders tend to be somewhat higher in value thanvalid orders, merchants will tend to outsort more high valueorders for manual review and verification. Large onlinemerchants reported that the median value of an orderflagged for manual review was $250.

    2006 20082007 2009

    Domestic vs. InternationalFraud Rate Trends

    Fraudulent order rate, domestic ordersFraudulent order rate, international orders

    1.1

    %

    2.7

    %

    1.3

    %

    3.6

    %

    0.9

    %

    2.0

    %

    1.1

    %

    4.0

    %

    0%

    4.5%

    4.0%

    3.5%

    3.0%

    2.5%

    2.0%

    1.5%

    1.0%

    0.5%

    19

    Valid vs. Fraudulent Order Value

    Valid orderFraudulent order

    Median used to minimize impact of outliers

    Overall $500K

  • 8/8/2019 Online Fraud Report

    21/2421

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    212010 CyberSource Corporation. All rights reserved.

    Tuning & Management

    Maintaining and Tuning Screening RulesHalf of the merchants surveyed reported that the fraudulentorders they experienced in 2009 were cleaner than thosethey experienced just 12 months before. By cleaner we

    mean they have fewer anomaliesthey look more like validorders than ever before. Fraudsters growing use of botnetsmay be a key factor in cleaner fraud. Botnets allowfraudsters to even more deftly mimic the identity of a truecustomer and mask their own identity. Therefore it will beincreasingly important for merchants to deploy technologiesto identify botnet attacks and operate systems that rapidlyrespond to new fraud patterns and trends. Thirty-five percentof merchants say they have an automated order screeningsystem in place that allows business managers to modifydecision rules without assistance from internal IT staffor external parties (up from 16% found in 2006). Theability to adjust automated order screening systems

    quickly helps manage the order review flow, tailor rulesto new products, and adapt to new fraud trends as theyare encountered. Without this ability, merchants cannoteasily minimize reject rates, review costs, or fraud rates.Additionally, giving business managers the capability ofadjusting business rules on-the-fly reduces the costs andburden of IT support.

    Global Fraud PortalsSome online merchants are integrating fraud toolsand strategies via fraud management portals. Theseportals employ a combination of flexible rules systems

    that interact with a portfolio of truth services aroundthe globe, allowing business managers to set paymenttype, product type and market-specific screens.Case management systems are being integrated withthese portals with accompanying enhancements tostreamline workflow. Global fraud portals typicallyinclude hierarchical management, as companies striveto centralize fraud management across multiple lines ofbusiness and geographies.

    Merchant Budgets for Fraud ManagementHow much are online merchants spending to mitigate fraudrisk? In 2009, survey results show that 37% of merchantsspend 0.5% or more of their online revenues to manage online

    payment fraud, while 63% spend less than 0.5%. In 2009,across all merchants the median ratio of fraud managementexpense to sales was 0.3%, up from 0.2% in 2008, althoughsome merchants in high risk categories are spendingsignificantly more. These spending estimates focus on thecost of managing fraud risk (internal and external systems andservices, management development, and review staffs). Directfraud loss (chargebacks, lost goods and associated shippingcosts), as well as the opportunity cost associated with validorder rejection, are not included here (see chart #21).

    35%

    15%

    5%

    25%

    30%

    10%

    20%

    40%

    45%

    50%

    55%

    0%

    How Much Merchants Spendon Fraud Management

    (percent of merchants operating at defined expense level)

    2007 n=972008 n=1082009 n=104

    41% 4

    4%

    0%

  • 8/8/2019 Online Fraud Report

    22/24

    title (title)

    22

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    Budget AllocationFor the past four years, merchants have consistently spentjust over half their fraud management budgets on reviewstaff (see chart #22). The remainder is allocated as follows:24% for third party tools or services and 26% on internallydeveloped tools and systems.

    Clearly, review staff costs are the dominant factor andonly 13% of merchants cite plans to increase reviewstaffing in 2010. The same percentage planning to expandstaffing was also seen in last years survey. However, thisyear slightly more merchants say they are expecting to

    reduce fraud review staff in 2010 (9% ofmerchants vs 6% in the prior survey). Fivepercent of merchants expect budget cuts

    in 2010 averaging 37% (see chart #23)and nearly three-quarters expect budgets toremain flat.

    Reducing the need for manual review andincreasing the efficiency and effectiveness ofreviewers is key to growing online businessprofits and managing the total cost of onlinepayment fraud. One place to start is byimproving the automated detection of riskyorders so as to reduce manual order reviewvolumes. When asked what their top priority

    strategy or area of focus for process improvement was for

    2010, 60% of merchants said improving the automateddetection and sorting capabilities of their systems was theirkey area of focus (see chart #24).

    Clearly, the continued reliance on manual review we haveseen in the data over the last few years is not an optimallong term strategy for managing online fraud. As budgetscome under increasing pressure, merchants will needto redouble their efforts to automate more of the fraudmanagement process while keeping validorder conversion high and fraud loss low.

    Average % Spending Allocationfor Fraud Management 2009

    n=352

    Planned ReviewStaffing Levels

    Base: Those with 1 or more full-time manual review staff

    2010

    2009

    Increase

    13%

    13%

    Decrease

    9%

    6%

    Same

    78%

    81%

    n=248, 194

    26%Internal

    Tools & System

    3rd PartyTools

    24%

    OrderReviewStaff

    51%

    22

    Expected Budget Changefor Fraud Management 2010

    n=257

    74%No Change

    21%Increase

    5%

    Decrease

    Average % Fraud ManagementBudget Expected to INCREASE

    29%

    Average % Fraud ManagementBudget Expected to DECREASE

    37%

    23

    Top Priority Strategy /Area of Focus

    2010

    60%Automateddetection

    16%Streamline

    manualreview

    20%Processanalytics

    2%Outsourcing

    2%Other

    Improving automated detection and sorting capabilityStreamlining the tasks/workflow occurring during the manual review processImproving process analyticsOutsourcing portions of your review/screening operationOther

    24

  • 8/8/2019 Online Fraud Report

    23/2423

    C Y B E R S O U R C E 1 1 T H A N N U A L O N L I N E F R A U D R E P O R T

    232010 CyberSource Corporation. All rights reserved.

    Resources & Solutions

    To find information on CyberSources industry-leading risk

    management solutions, self-paced webinars on decision

    management, and other whitepapers on electronic payment

    management, visit our Resource Center at

    www.cybersource.com. For sales assistance phone:

    1-888-330-2300; or e-mail: [email protected].

    CyberSource Payment ManagementSolutionsCyberSource offers a comprehensive portfolio of modular

    services and tools to help your company manage your entire

    payment pipeline to optimize business results. All are

    available via one connection to our web-based services.

    Accept All Popular Payment Types in 190+

    CountriesAccept payments worldwide using a merchant account

    from your preferred provider or CyberSource: worldwide

    credit and debit cards, regional cards, direct debit, bank

    transfers, electronic checks and alternative payment types

    such as Bill Me Later and PayPal. CyberSource also provides

    professional services to help you integrate payment with

    front-end and back-office systems.

    CyberSource processes your payments in our high

    availability datacenters located in the U.S., Europe, and

    Japan. All datacenters are certified PCI-compliant and

    include sophisticated processing management logic to help

    prevent payment failures and rate downgrades.

    A full array of online and exportable payment reporting

    capability is available to streamline reconciliation activity.

    Depending on your merchant account provider, our

    reporting systems can help you automate nearly 100% of

    your reconciliation workflow.

    Risk Management/Order Screening

    Global Fraud Management Portal with CyberSource Intelligent

    Review Technology. A hosted rules and case management

    system that provides on-demand access to over 200

    validation tests and services across all four dimensions ofdetection. Detectors include: multi-merchant transaction

    history checks, worldwide delivery address and phone

    verification, Device Fingerprinting with deep packet

    inspection, IP geolocation, purchase velocity, identity

    morphing and custom data from your systems. Case

    management system provides consolidated data review,

    workflow management and built-in callouts to validation

    services to streamline review.

    Managed Services. CyberSource provides client services to

    help you analyze, design and manage your order screening

    and fraud detection processeseverything from screening

    strategies and risk threshold optimization analysis

    to ongoing monitoring, order review and chargeback

    management/recovery. Our managed services include

    business performance guarantees.

    Payment Security

    Remove Payment Data From Your EnvironmentTokenization

    and More. CyberSource provides payment tokenization with

    remote secure storage and hosted payment acceptance

    services that let you capture and process payments without

    storing or transmitting payment data. A great way to

    streamline PCI compliance and mitigate security risk. Ouroutsourced screening management and chargeback recovery

    services can help you further eliminate staff contact with

    payment data.

    Payment System Centralization. Our team of experts will help

    you consolidate multiple payment systems into a single,

    easy to manage system. Optionally, CyberSource will also

    host, support and manage these systems in our secure

    datacenters.

    Professional Services

    CyberSource maintains a team of experienced payment

    consultants to assist with payment systems planning,system and process design, and implementation and

    integration. Our client services team is additionally

    available to help you monitor, tune, or fully outsource

    portions of your payment operations.

    3 Managed Services

    With Performance

    Guarantees

    2 Design & Installation

    1 Systems & Services

    PAYMENT SECURITY

    ORDER

    OrderScreening

    Collection &Reconciliation

    ProcessingManagement

    Global PaymentAcceptance

    L A S E R

    Bank

    TransferDirect

    Debit

    http://www.cybersource.com/mailto:[email protected]:[email protected]://www.cybersource.com/
  • 8/8/2019 Online Fraud Report

    24/24

    CyberSource Corporation is a leading provider of electronicpayment, risk and security management solutions.CyberSource provides payment management solutions forelectronic payments processed via Web, call center, kiosk,

    mobile and POS environments. Services include hostedsystems to help you manage electronic payments, as wellas professional services to help design, integrate andfully manage parts or all of your payment operations. Over284,000 businesses worldwide use CyberSource solutions,including half the companies comprising the Dow JonesIndustrial Average and leading Internet brands. The companyis headquartered in Mountain View, California, and has salesand service offices in Japan, the United Kingdom, and otherlocations in the United States.

    For More Information

    Call 1.888.330.2300

    Email [email protected]

    Visit www.cybersource.com

    Get Tailored Views of Risk Management

    Pipeline MetricsTo get a view crafted for your companys size and industry,

    please contact CyberSource at 1.888.330.2300 or online at

    www.cybersource.com/contact_us .

    For additional information, whitepapers and webinars,

    or sales assistance:

    Contact CyberSource: 1.888.330.2300 or

    www.cybersource.com/contact_us

    Risk Management Solutions: visit www.cybersource.com/

    products_and_services/risk_management/

    Global Payment & Security Solutions:

    visit www.cybersource.com/products_and_services/global_payment_services/

    About CyberSourceNorth AmericaCyberSource Corporation1295 Charleston RoadMountain View, CA 94043T: 888.330.2300T: 650.965.6000F: 650.625.9145

    Email: [email protected]

    EuropeCyberSource Ltd.The Waterfront300 Thames Valley Park DriveThames Valley ParkReading RG6 1PTUnited KingdomT: +44 (0) 118.929.4840F: +44 (0) 870.460.1931Email: [email protected] Fraud Report:www.cybersource.co.uk/ukfraudreport

    JapanCyberSource KK (Japan)3-11-11 Shibuya, Shibuya-kuTokyo, 150-0002 Japan

    T: +81.3.5774.7733F: +81.3.5774.7732Email: [email protected]

    SingaporeCYBS Singapore Pte LtdLevel 25, One Raffles QuaySingapore, 048583T: +65 6622 5623F: +65 6622 5999

    Email: [email protected]

    mailto:[email protected]://www.cybersource.com/http://www.cybersource.com/contact_ushttp://www.cybersource.com/contact_ushttp://www.cybersource.com/products_and_services/risk_management/http://www.cybersource.com/products_and_services/risk_management/http://www.cybersource.com/products_and_services/global_payment_services/http://www.cybersource.com/products_and_services/global_payment_services/mailto:[email protected]:[email protected]://www.cybersource.co.uk/ukfraudreportmailto:[email protected]:[email protected]://www.cybersource.com/products_and_services/global_payment_services/http://www.cybersource.com/products_and_services/global_payment_services/http://www.cybersource.com/products_and_services/risk_management/http://www.cybersource.com/products_and_services/risk_management/http://www.cybersource.com/contact_ushttp://www.cybersource.com/contact_ushttp://www.cybersource.com/mailto:[email protected]:[email protected]:[email protected]://www.cybersource.co.uk/ukfraudreportmailto:[email protected]:[email protected]