PAYMENT RESEARCH WHITEPAPER Will Todays Emerging … · the reality is not living up to the promises in Europe where the technology was first adopted. In fact, payment fraud is just

Will Today’s Emerging Payment Trends Lower Fraud—or Increase Risk?

PAYMENT RESEARCH WHITEPAPER

EMV chips, CNP transactions, and mobile payments are creating new opportunities—but also new challenges fraud prevention. Feedzai introduces a new way to fight fraud across every existing and emerging payment method using machine learning and behavioral profiling technology.

TABLE OF CONTENTS

3 Reports From Today’s Payment Landscape

4 Executive Summary—The Bad News and Good News About Today’s Leading Payment Trends

7 Trend #1 — EMV Payment Risks – Expanding into the U.S.

9 Trend #2 — CNP Payment Risks — Compounding Online Fraud

11 Trend #3 — Mobile Payment Risks — MoreOnline Sales. More Online Fraud.

13 Tools to Boost Your Fraud Department’sDetection Rate

14 Attack New Fraud Challenges with a FocusedPre-Emptive Strike

15 The Feedzai Fraud Solution—How Machinelearning Helps Fight Fraud Easier, Faster, and Smarter

16 Feedzai’s Five-Step Machine learning Process

17 Learn Why Feedzai is Today’s Leading MachineLearning Fraud Detection Software

3

“ In some cases, fraud can be 15 times higher in card-not-present transactions, versus when the card is present”

— CEB TowerGroup’s Retail Banking

Reports From Today’s Payment Fraud Landscape“ The worse news is that the fraudsters are well aware of the coming use of cards with EMV chips, and will change their focus to online merchants and to financial institutions that have not made the change to the new cards.”

— “70 Percent of U.S. Credit Cards to Include EMV Chips by 2015,” eWeek, June 2014

“ Organized crime rings aren’t going to sit and watch their bottom line go away. We’ll see a shift to card-not-present and application fraud.”

— Julie Conroy, research director for the Retail Banking and Payments Practice, The Aite Group

“ In some cases, fraud can be 15 times higher in card-not-present transactions, versus when the card is present”

— CEB TowerGroup’s Retail Banking

“ The rising cost of fraud is accompanied by a concurrent rise in mobile payments.”

— The Aite Group

“ Fraud has simply shifted to different products (from credit to debit), other channels (from card-present to card-not-present, or CNP), or other geographies (cross-border fraud).”

— The Retail Payments Risk Forum

PAYMENT RESEARCH WHITEPAPER:Will Today’s Emerging Payment Trends Lower Fraud—or Increase Risk?

4 PAYMENT RESEARCH WHITEPAPER:Will Today’s Emerging Payment Trends Lower Fraud—or Increase Risk?

THE BAD NEWS

New payment trends have not lowered the incidents of payment fraud—they’ve just changed it.

THE GOOD NEWS

Now you can fight fraud better on all fronts with a smarter fraud detection solution that uses machine learning and behavior profiling intelligence.

EXECUTIVE SUMMARY

The Bad News and Good News About Today’s Leading Payment Trends The Bad News New payment trends have not lowered the incidents of payment fraud—they’ve just changed it.

The Good News Now you can fight fraud better on all fronts with a smarter fraud detection solution that uses machine learning and behavior profiling intelligence.

The advent of new payment trends, like EMV chips, holds the potential for eradicating payment fraud. But the reality is not living up to the promises in Europe where the technology was first adopted. In fact, payment fraud is just taking a different form—and it’s on the rise. For example, in the United Kingdom, where EMV chip cards are widely used, card fraud levels are increasing. Consumers—and criminals—are moving to online channels. In the UK, in 2002, CNP fraud accounted for 26% of fraud. By 2012, CNP fraud had climbed to 63%.1

The fact is that fraud perpetrators never rest. As soon as new payment methods launch, clever new fraud tricks emerge to circumvent them.

“If and when a new approach is introduced, which is very effective at detecting one kind of fraud, instead of abandoning their life of crime, fraudsters change

1 “Fraud the Facts 2013,” Financial Fraud Action UK, July 2013


The agency estimates that fraudulent payment card transactions increased 8.5 percent in quantity and 9.8 percent in value every year from 2009 to 2012—for a total of $82.3 trillion in 2012.

their modus operandi,” stated David Hand, senior research investigator with Imperial College of London’s Department of Mathematics.

Fraudsters have been keeping up with every new credit card fraud detection system that has been created, according to the Federal Reserve. The agency estimates that fraudulent payment card transactions increased 8.5 percent in quantity and 9.8 percent in value every year from 2009 to 2012—for a total of $82.3 trillion in 2012.

The most recent Nilson Report stated that during 2012 credit card and debit card fraud resulted in losses totaling $11.27 billion. Figures for 2012 credit card and debit card gross fraud losses accounted for roughly 5.22 per $100 in total volume, up from 5.07 per $100 in 2011.

For merchants, the past year was one of the most difficult on record, as a number of factors conspired to challenge their fraud prevention efforts. A combination of several massive data breaches flooding the black market with stolen card numbers, expansion into unknown territory in terms of mobile and alternative payments and virtual currency, and fraudsters’ last-ditch effort to make use of counterfeit cards before the implementation of EMV left merchants the worse for wear. Merchants lost, on average, 0.68% of revenue—a 33% greater proportion than the previous year. Merchants also incurred more costs in addition to their fraud losses, with each dollar of fraud costing them $3.08, compared to $2.79 last year.2

In today’s increasingly frustrating and costly fraud prevention arena, fraud managers are left with only

2 “Post Recession Revenue Growth Hampered by Fraud as All Merchants Face Higher Costs,” 2014 LexisNexis True Cost of Fraud Study, LexisNexis, August 2014


Become smarter than the criminals. Be proactive, not reactive. Employ a solution that anticipates threats, speeds up fraud detection, reduces fraud, lowers false alarms, and makes Fraud Departments more effective and efficient.

one option. Become smarter than the criminals. To be proactive, not reactive. To employ a solution that anticipates threats, speeds up fraud detection, reduces fraud, lowers false alarms, and makes Fraud Departments more effective and efficient.

This ebook provides an overview of the three leading payment fraud risks impacting today’s Fraud Departments—and the one solution designed to overcome them all.


About 70 percent of cards in the U.S. will have EMV chips by 2015

TREND #1 EMV Payment Risks – Expanding into the U.S. After a 20-year head start in Europe, the chip-based EMV (Europay, MasterCard, and Visa) credit card is poised to launch across the U.S. The Aite Group that determined that about 70 percent of cards in the U.S. will have EMV chips by 2015, with most card issuers sending out such cards in the fourth quarter 2014 or first quarter 2015. (Today the EMV standard is managed by EMVCo, LLC, which is equally owned by American Express, JCB, MasterCard and Visa.)

As a result of these payment changes, financial institutions, merchants, acquirers/processors, card brands, and hardware and software vendors are all interested in learning what the EMV card brings to the table—both the good and the bad.

Europe’s use of the technology since 1994 does not portend a great outcome across the ocean. The early-adopters exposed the problems with the chip—namely, it only provides fraud prevention for in-person purchases, but does not protect mobile or CNP purchases. It took online fraudsters very little time to figure this out—and exploit this weakness by moving their fraud operations online.

Criminals will often go after the weakest link in the chain. Many countries that have implemented EMV chip payments have reported fraudsters shifting their attention away from the physical POS to e-commerce channels where it’s much easier to make fraudulent


“ Even with EMV in place, a portion of the card-related data can still be unencrypted, or transmitted in plain text.”

— Anthony Genovese:

purchases. It’s important that the U.S. payments industry be proactive and evaluate ways to strengthen the security of CNP channels at the same time as the payments industry migrates to higher levels of security in-store with EMV chip technology.3

The problems are widespread, according to vice president of Consulting Services, Anthony Genovese: “Even with EMV in place, a portion of the card-related data can still be unencrypted, or transmitted in plain text.”

Fixes of many forms are being considered to tackle the fraud risk created by EMV chip cards, such as near-term adoption of encryption and tokenization, and, in the long term, new techniques like biometric authentication. However, despite the best intentions and best efforts of credit card corporations and agencies, innovations in payment processing like the EMV chip have not lowered the risk of total fraud.

Instead of making life easier for fraud managers, the EMV cards seem only to increase the complexity for managing fraud. Rather than getting the promised relief, managers have had to boost their resources to manage new breaches. Yet, in a survey of online retailers from Cybersource, 77% of survey participants indicated that both fraud staffing levels and budgets would remain the same or lower for 20144 — adding to the already intensifying challenges.

Alliance Payments Council, February 2014

3 “Card-Not-Present Fraud: A Primer on Trends and Authentication Processes,” Smart Card4 Survey: Cybersource 2013 Online Fraud Report, Online Payment Fraud Trends, Merchant Practices and Benchmarks, 14th annual edition. Respondents included a blend of small, medium and large-sized organizations based in North America.


Criminals may turn their attention to committing card-not-present (CNP) fraud via online or telephone channels

TREND #2 CNP Payment Risks — Compounding Online FraudA second trend on the fraud payment horizon is Card-Not-Present (CNP) payments. In fact, as the U.S. moves to EMV chip technology to significantly curb counterfeit card fraud at the retail point of sale (POS), criminals may turn their attention to committing card-not-present (CNP) fraud via online or telephone channels, according to the Smart Card Alliance Payments Council.

Further, as e-commerce continues to grow, exposure to CNP fraud will also continue to grow. As experience in other countries demonstrates, fraudsters consistently focus their efforts on e-commerce transactions once EMV is implemented at the physical POS.5

In some cases, fraud can be 15 times higher in CNP transactions versus when the card is present. In the next few years, more and more transactions will be without a payment card present and by 2016 an estimated $2 trillion-plus transactions could come from CNP transactions.

Based on the sales estimates, over $200 billion of additional spending could flow through CNP transactions, according to the Smart Card Alliance Payments Council. Recently issued data by FICO shows that CNP fraud is growing faster than counterfeit fraud. Statistics from different sources may vary, but there is clearly a large—and increasingly real—potential for losses due to CNP fraud.

5 “Card-Not-Present Fraud: A Primer on Trends and Authentication Processes,” Smart Card Alliance Payments Council, February 2014


Fraud managers’ only defense has been to try to add resources, improve their systems, and automate their systems, so they can give accounts the right amount of attention, while making decisions faster.

Some companies are creating workarounds to thwarting this type of fraud, for example, having consumers use a small EMV-compliant card reader to authenticate the card for online purchases or banking. However, at $50 per reader, this has not been a widely implemented solution.

Fraud managers’ only defense has been to try to add resources, improve their systems, and automate their systems, so they can give accounts the right amount of attention, while making decisions faster. But the reality is that fraud department budgets often don’t increase in concert with the rise in risk.


In 2010, the total gross dollar volume of mobile payments in the U.S. alone was $16 billion; some experts expect this volume to rise to $214 billion by 2015.

TREND #3 Mobile Payment Risks — More Online Sales. More Online Fraud.Today mobile commerce is growing rapidly—as people make more of their purchases from their smart phones and other mobile devices. Online retail spending grew 14% in 2013, according to a report released today from comScore. For comparison, total consumer retail spending in the U.S. grew by mere single-digits. Although the majority of e-commerce spending still occurs on PCs, mobile’s share is growing significantly faster.6

Further evidence of the rapid growth is Apple’s launch of Apple Pay, which is a clear sign of consumer movement toward e-commerce. “Apple Pay is a win for e-commerce companies. It’s another low-friction way for people to buy things without having to enter payment details again and again,” according to Business Insider.7

The growing opportunity to grow sales online has also opened doors to a concurrent rise in online purchasing fraud opportunities. In 2010, the total gross dollar volume of mobile payments in the U.S. alone was $16 billion; some experts expect this volume to rise to $214 billion by 2015.

Though online merchants prospered from a rebounding economy to the tune of a nearly $30 billion increase

6 “U.S. E-Commerce Growth Is Now Far Outpacing Overall Retail Sales,” Business Insider, April 20147 “How Apple Pay Impacts The Different Parts Of The Payments Industry,” Business Insider, September 2014


Of the fraudulent transactions mobile merchants face, 38% go through undetected.

in online spending this year, large eCommerce and mCommerce merchants are still among the hardest-hit by rising fraud losses and associated costs.8

As mobile payments grow, companies are attempting to fight fraud with standard systems such as EMV, because they require similar behind-the-scene infrastructures for several portions of payment transactions. But these efforts haven’t been effective enough.

According to Javelin Strategy and Research, of the fraudulent transactions mobile merchants face, 38% go through undetected, because even with “various fraud-mitigation tools in place, fraudsters can still steal a consumer’s card account.”

On the front line of this ongoing battle, fraud managers experience the blowback on a daily basis. Their e-commerce reality is this: Increased manual payment review volume, higher insult rates, greater friction with honest customers, and ongoing challenges writing the rules that will automatically capture the true fraud before it gets processed.

8 “Post Recession Revenue Growth Hampered by Fraud as all Merchants face Higher Costs,” 2014 LexisNexis True Cost of Fraud Study, LexisNexis, August 2014


Power Foresight

Intelligence

New Tools to Boost Your Fraud Department’s Detection Rate Rather than wait for the payment industry to deliver a multi-layered approach to fortify EMV cards, CNP transactions, and mobile commerce, fraud managers need real solutions now that include the following capabilities.

POWER — Fraud managers need a powerful way to deflect fraud at the strongest point of fraud detection—the point of the attempted felonious transactions.

FORESIGHT — Fraud managers need a way to take fraud detection and prevention into their own hands, constantly identify ever-changing and fast-evolving threats, and shield their companies’ from fraud—no matter what form payment processing takes today or in the future.

INTELLIGENCE — Fraud managers need an intelligent system that evolves faster than the criminals’ tactics, so they can proactively identify true fraud from genuine customers and take action based on up-to-the minute transaction data.


With machine learning and behavioral profiling technology, fraud managers can achieve goals by launching a pre-emptive full-on attack to detect fraud before it breaches their payment walls.

Attack New Fraud Challenges with a Focused Pre-Emptive StrikeToday fraud managers don’t have to sit by and wait until the downside of new payment trends’ plays out in their departments. Instead, they can achieve their goals by launching a pre-emptive full-on attack to detect fraud before it breaches their payment walls—with machine learning and behavioral profiling technology.

The arsenal implemented to fight payment fraud should help achieve the following results:

Speed Up Fraud Detection — become proactive instead of reactive.

Anticipate Threats — be prepared for every new form of payment fraud.

Reduce Fraudulent Transactions — catch fraudulent charges before they process.

Reduce False Alarms — eliminate the high cost of chasing non-fraudulent transactions.

Eliminate Blind Spots — keep a 360-degree watch over the accounts you manage.

Boost Customer Friction — give good customers an expedient purchasing experience.

Attain a Higher ROI — gain the ability to point to your department’s bottom-line results.


Machine learning models can detect fraud up to 30% earlier than traditional methods.

How Machine Learning Helps Fight Fraud Easier, Faster, and SmarterArtificial intelligence—machine learning—is the use of data to do behavioral analysis. This use of modern data science techniques and technology gives you an intelligent fraud early-warning capability—that helps proactively identify true fraud before transactions are processed, and keeps your department running efficiently.

Unlike conventional rules-based systems, artificially intelligent systems actually learn, predict and react instantly and automatically to minute changes in the fraud landscape. In other words, it allows your fraud department to move from broad segment-based scoring to very fine-grained individual scoring—so you have a more realistic and pro-active way to identify fraud before it hits.

Machine learning models can detect fraud up to 30% earlier than traditional methods.9 The technology can detect risky behavior and block more bad transactions during the instance of first intrusion—before damage occurs. When benchmarked at a standard 20% false positive rate, Feedzai’s machine learning models detect up to 80% of fraudulent activity—two-thirds more than traditional systems.

9 Based on Feedzai internal data totaling $600 billion in consumer purchase volume using electronic payment methods, both ecommerce, mobile and in-store channels.


STEP 1 — Create Baseline Behavioral Profiles

STEP 2 — Create Detection Algorithms

STEP 3 — Apply Detection Algorithms

STEP 4 — Constantly Update Machine Models STEP 5 — Apply Decision Algorithms

Five-Step Machine learning Process Step 1 — Create Baseline Behavioral ProfilesFeedzai’s risk and fraud engine creates baseline profiles by aggregating historical data gathered for up to three years on each customer, payment token, merchant, location, POS device, etc., including fraudulent transactions. If the data exists, it can be streamed into the engine to create baselines for any data point—in a matter of hours, not days.

Step 2 — Create Detection AlgorithmsDetection algorithms are then created from baseline profiles (up to billions), which are maintained for each individual customer and data point.

Step 3 — Apply Detection AlgorithmsNext, as live production transactions stream in from ATMs, POS, and the Internet, machine learning models take over and calculate hundreds of thousands of KPIs for each customer—in under 100 milliseconds.

Step 4 — Constantly Update Machine ModelsWith each and every live transaction, the models rebuild the baseline profiles.

Step 5 — Apply Decision AlgorithmsLastly, decision algorithms, using weighted scores from the models, determine composite topline risk scores for each incoming transaction. With this intelligence, Feedzai: Scores fraudulent transactions Blocks fraudulent transactions Tracks fraud automatically


Learn Why Feedzai is Today’s Leading Machine Learning Fraud-Detection Software

“ Feedzai is preventing $9.5 million per year in credit card fraud losses for us by uncovering fraud in real-time.”

— Credit card fraud prevention manager at a major European payment processor organization

“ We improved detection by over 60% with Feedzai’s machine learning models.”

— Top-20 U.S. payment service provider

“ Feedzai received the Cool Vendor Award for its innovative way of delivering real time operational intelligence applications.”

— The Gartner Group

ABOUT FEEDZAI Feedzai believes every business can unlock the power of big data and machine learning. We deliver enterprise software to make management of risk and fraud better. Companies that rely on Feedzai include Celfocus, Coca-Cola, Logica, Vodafone, Ericsson, SIBS Payment Solutions, Horizon Wind Energy, and Servebase Credit Card Solutions.

Documents

PAYMENT RESEARCH WHITEPAPER Will Todays Emerging … · the reality is not living up to the promises in Europe where the technology was first adopted. In fact, payment fraud is just