E-commerce / Retail

What is the true fraud cost? We must be vigilant and keep our acceptable fraud rate at zero

Experian data shows consumers are more confident managing their credit since the recession. The Q3 2015 Experian Market Intelligence Brief was released today featuring data that highlights consumer credit card debt has now reached its highest level since Q4 2009. Credit card debt levels reached $650 billion in Q3 2015, the highest it has been since Q4 2009 when it was $667 billion. Credit card delinquency rates on outstanding balances 60 or more days past due have decreased 71 percent during the same time period. Combining those indicators with the national unemployment rate dropping 50 percent during the same span illustrates a positive economic outlook on credit card trends among lenders and consumers. “Overall credit card limits have increased 102 percent since Q4 2009 with $82 billion originated in Q3 2015,” said Kelly Kent, vice president of Experian Decision Analytics. “The increase in limits from lenders and the steady climb in credit card debt combined with exceptional delinquency rates signals greater confidence among consumers as they are showing more assurance in managing their credit since the recession. We expect to see credit card debt increase in Q4 based on historical seasonal trends driven by the holiday shopping season especially with the early positive holiday sales as a sign.” The Q3 2015 Experian Market Intelligence Brief report is now available.

It’s official. Millennials have surpassed Baby Boomers in population size, according to the US Census. And while they are quick to adopt the “selfie” and all things social, they have been slow to embrace the world of credit. Sure, there’s been increased regulation over the past decade, and coming into adulthood in the midst of the Great Recession hasn’t helped. But don’t count Millennials out of the credit game just yet. A deeper, more segmented view of this digital-dependent generation shows a very diverse population with plenty of opportunity for lenders. Plus, their sheer size in numbers and $200 billion in annual buying power demand financial institutions evolve to accommodate this massive market. As Gen Y comes of age, there is growing evidence they are open to building and growing their personal credit history. But if financial institutions wish to capture the attention and business of this demographic, they must adapt, leveraging deeper segmentation insights with more effective prospecting strategies to reach them. Experian's data reveals key trends in terms of how this generation is utilizing credit, tips and tools to find the most credit-ready individuals, and strategies to grow the thin-file Millennials as they come of age. “Given the significance millennials play in financial services and the credit marketplace, it is crucial to understand this influential consumer segment and how they use credit as a tool,” said Michele Raneri, vice president of analytics and business development. “While this generation may not look like they are on the right track financially, it’s important to keep in mind that credit scores are built on credit experiences, and while this generation has been slower to use credit, they have plenty of opportunities to build a positive credit history.” To learn more about Millennials and credit, visit Experian.com/millennials.

To improve the customer experience during the busy holiday shopping season many businesses loosen their fraud criteria.

Hello from the other side ... While Adele scores big on the Billboard Hot 100 by crooning of coming to terms with a lover from the past, a new Experian “State of Credit” reveals we are officially on the “other side” of the recession – at least if you’re looking at the nation’s credit scores. While the bottom of the Great Recession was reached in the second quarter of 2009, steady job growth was not seen until 2011, and even since, some economists claim it has been a "Tortoise Recovery.” But key findings from Experian’s 6th annual study, ranking top and bottom cities across the nation in regards to credit, suggests the U.S. is strong. “If I were to give a grade to the overall picture of credit in the United States, I would give it an A minus,” said Michele Raneri, Experian’s vice president of analytics and new business development. “I’m optimistic about the state of credit as we are seeing more loans being extended, late payments are decreasing and consumers are continuing to gain more confidence in originating loans. There definitely is growth and momentum — we’re back to prerecession levels in nearly every category, which means lenders are in a prime position to capitalize on this market and foster business growth.” Which states topped the credit charts? As in previous years, Minnesota continues to shine with three of its cities — Mankato, Rochester and Minneapolis — leading with credit scores of 706, 705 and 704, respectively. Greenwood, Miss. and Albany, Ga. ranked the lowest with scores of 612 and 622. While still at the bottom of the list with a score of 612, Greenwood, Miss., residents did improve their score by three points, more than any other city in the bottom 10. Overall, the report reveals the national credit score increased by three points over the last year (and by five points since 2013) and the 10 cities with the highest credit scores in the nation increased their scores by an average of 1.8 points. Additionally, bankcards, retail cards and mortgage lending showed significant growth, making this year’s study an indicator of the nation’s confidence in the credit market. Just in time for the election year, this year’s study includes insight into how residents of these top and bottom metropolitan statistical areas (MSAs) identify politically. The study found that half of the highest-scoring cities have residents whose views skew more middle of the road, while residents of lower-scoring cities are more likely to lean conservative. The full lists of the top 10 and bottom 10 cities are featured (scores are rounded to the nearest whole number). Detailed study highlights include the following changes over the last year: The national VantageScore® credit score is up by three points, from 666 to 669. Bankcard lending continues to increase, with new bankcards up 7.7 percent. The average number of bankcards per consumer is up 2.8 percent to 2.24 cards. Retail card lending also is on the rise, with a 10.8 percent increase in new originations. The average number of retail cards per consumer is up 0.3 percent to 1.55 cards from last year and up by 7 percent since 2013. Instances of late payments (includes bankcard and retail) decreased by 4.4 percent over the last year and by 17.3 percent since the height of the recession in 2010. Average debt2 is up 2.1 percent to $29,093 per consumer. Mortgage originations increased by 42.5 percent. For a more complete look at the above cities as well as the other MSAs studied, visit http://www.livecreditsmart.com to view a fully interactive map and infographic. Purchase The Experian Market Intelligence Brief, a quarterly report that includes more than 70 charts and data trends on loan originations, outstanding loans and delinquency performance metrics spanning three years.

I recently read a study about the profile of an online Fraudster. One may jump to conclusions about what is a good indicator for catching cybercriminals.

The themes of the game of Risk are relevant to the world of real-life fraud risk prevention. The difference is that the stakes are real and much higher.

If Commerce is a conversation between a merchant and a consumer then it has become contorted and clustered around payments and point of sale.

Surveillance and fraud staging are the seemingly benign and often-transparent account activities that fraudsters undertake after an account has been compromised but before that compromise has been detected or money is moved.

Apple eschewed banks for a retailer focus onstage at their Worldwide Developers Conference (WWDC) when it spoke to payments. I sense this is an intentional shift – now that stateside, you have support from all four networks and all the major issuers – Apple understands that it needs to shift the focus on signing up more merchants, and everything we heard drove home that note. That includes Square’s support for NFC, as well as the announcements around Kohls, JCPenney and BJ’s. MasterCard's Digital Enablement Service (MDES) - opposite Visa’s Token Service - is the tokenization service that has enabled these partnerships specifically through MasterCard’s partners such as Synchrony – (former GE Capital) which brought on JCPenney, Alliance Data which brought on BJ’s, and CapitalOne which enabled Kohls. Within payments common sense questions such as: “Why isn’t NFC just another radio that transmits payment info?” or “Why aren’t retailer friendly payment choices using NFC?” have been met with contemptuous stares. As I have written umpteen times (here), payments has been a source of misalignment between merchants and banks. Thus – conversations that hinged on NFC have been a non-starter, for a merchant that views it as more than a radio – and instead, as a trojan horse for Visa/MA bearing higher costs. When Android opened up access to NFC through Host Card Emulation (HCE) and networks supported it through tokenization, merchants had a legitimate pathway to getting Private label cards on NFC. So far, very few indeed have done that (Tim Hortons is the best example). But between the top two department store chains (Macy’s and Kohls) – we have a thawing of said position, to begin to view technologies pragmatically and without morbid fear. It must be said that Google is clearly chasing Apple on the retailer front, and Apple is doing all that it can, to dig a wider moat by emphasizing privacy and transparency in its cause. It is proving to be quite effective, and Google will have to “apologize beforehand” prior to any merchant agreement – especially now that retailers have control over which wallets they want to work with – and how. This control inherits from the structures set alongside the Visa and MasterCard tokenization agreements – and retailers with co-brand/private label cards can lean on them through their bank partners. Thus, Google has to focus on two fronts – first to incentivize merchants to partner so that they bring their cards to Android Pay, while trying to navigate through the turbulence Apple has left in its wake, untangling the “customer privacy” knot. For merchants, at the end of the day, the questions that remain are about operating costs, and control. Does participation in MDES and VEDP tokenization services through bank partners, infer a higher cost for play – for private label cards? I doubt if Apple’s 15bps “skim off the top” revenue play translates to Private Label, especially when Apple’s fee is tied to “Fraud Protection” and Fraud in Private Label is non-existent due to its closed loop nature. Still – there could be an acquisitions cost, or Apple may plan a long game. Further, when you look at token issuance and lifecycle management costs, they aren’t trivial when you take in to context the size of portfolio for some of these merchants. That said, Kohls participation affords some clarity to all. Second, Merchants want to bring payments inside apps – just like they are able to do so through in-app payments in mobile, or on online. Forcing consumers through a Wallet app – is counter to that intent, and undesirable in the long scheme. Loyalty as a construct is tangled up in payments today – and merchants who have achieved a clean separation (very few) or can afford to avoid it (those with large Private label portfolios that are really ‘loyalty programs w/ payments tacked on’) – benefit for now. But soon, they will need to fold in the payment interaction in to their app, or Apple must streamline the clunky swap. The auto-prompt of rewards cards in Wallet is a good step, but that feels more like jerry rigging vs the correct approach. Wallet still feels very v1.5 from a merchant integration point of view. Wallet not Passbook. Finally, Apple branding Passbook to Wallet is a subtle and yet important step. A “bank wallet” or a “Credit Union wallet” is a misnomer. No one bank can hope to build a wallet – because my payment choices aren’t confined to a single bank. And even where banks have promoted “open wallets” and incentivized peers to participate – response has been crickets at best. On the flip side, an ecosystem player that touches more than a device, a handful of experiential services in entertainment and commerce, a million and a half apps – all with an underpinning of identity, can call itself a true wallet – because they are solving for the complete definition of that term vs pieces of what constitutes it. Thus – Google & Apple. So the re-branding while being inevitable, finds a firm footing in payments, looks toward loyalty and what lies beyond. Solving for those challenges has less to do with getting there first, but putting the right pieces in play. And Apple’s emphasis (or posturing – depending on who you listen to) on privacy has its roots in what Apple wants to become, and access, and store on our behalf. Being the custodian of a bank issued identity is one thing. Being a responsible custodian for consumer’s digital health, behavior and identity trifecta has never been entirely attempted. It requires pushing on all fronts, and a careful articulation of Apple’s purpose to the public must be preceded by the conviction found in such emphasis/posturing. Make sure to read our perspective paper to see why emerging channels call for advanced fraud identification techniques

Gift cards are the most requested gift item and have been for the last eight years. Merchants love gift cards because they take up very little space and the recipient often ends up spending more than the value of the gift card.

Cont. Understanding Gift Card Fraud By: Angie Montoya In part one, we spoke about what an amazing deal gift cards (GCs) are, and why they are incredibly popular among consumers. Today we are going to dive deeper and see why fraudsters love gift cards and how they are taking advantage of them. We previously mentioned that it’s unlikely a fraudster is the actual person that redeems a gift card for merchandise. Although it is true that some fraudsters may occasionally enjoy a latte or new pair of shoes on us, it is much more lucrative for them to turn these forms of currency into cold hard cash. Doing this also shifts the risk onto an unsuspecting victim and off of the fraudster. For the record, it’s also incredibly easy to do. All of the innovation that was used to help streamline the customer experience has also helped to streamline the fraudster experience. The websites that are used to trade unredeemed cards for other cards or cash are the same websites used by fraudsters. Although there are some protections for the customer on the trading sites, the website host is usually left holding the bag when they have paid out for a GC that has been revoked because it was purchased with stolen credit card information. Others sites, like Craigslist and social media yard sale groups, do not offer any sort of consumer protection, so there is no recourse for the purchaser. What seems like a great deal— buying a GC at a discounted rate— could turn out to be a devalued Gift card with no balance, because the merchant caught on to the original scheme. There are ten states in the US that have passed laws surrounding the cashing out of gift cards. * These laws enable consumers to go to a physical store location and receive, in cash, the remaining balance of a gift card. Most states impose a limit of $5, but California has decided to be a little more generous and extend that limit to $10. As a consumer, it’s a great benefit to be able to receive the small remaining balance in cash, a balance that you will likely forget about and might never use, and the laws were passed with this in mind. Unfortunately, fraudsters have zeroed in on this benefit and are fully taking advantage of it. We have seen a host of merchants experiencing a problem with fraudulently obtained GCs being cashed out in California locations, specifically because they have a higher threshold. While five dollars here and ten dollars there does not seem like it is very much, it adds up when you realize that this could be someone’s full time job. Cashing out three ten dollar cards would take on average 15 minutes. Over the course of a 40-hour workweek it can turn into a six-figure salary. At this point, you might be asking yourself how fraudsters obtain these GCs in the first place. That part is also fairly easy. User credentials and account information is widely available for purchase in underground forums, due in part to the recent increase in large-scale data breaches. Once these credentials have been obtained, they can do one of several things: Put card data onto a dummy card and use it in a physical store Use credit card data to purchase on any website Use existing credentials to log in to a site and purchase with stored payment information Use existing credentials to log in to an app and trigger auto-reloading of accounts, then transfer to a GC   With all of these daunting threats, what can a merchant do to protect their business? First, you want to make sure your online business is screening for both the purchase and redemption of gift cards, both electronic and physical. When you screen for the purchase of GCs, you want to look for things like the quantity of cards purchased, the velocity of orders going to a specific shipping address or email, and velocity of devices being used to place multiple orders. You also want to monitor the redemption of loyalty rewards, and any traffic that goes into these accounts. Loyalty fraud is a newer type of fraud that has exploded because these channels are not normally monitored for fraud— there is no actual financial loss, so priority has been placed elsewhere in the business. However, loyalty points can be redeemed for gift cards, or sold on the black market, and the downstream affect is that it can inconvenience your customer and harm your brand’s image. Additionally, if you offer physical GCs, you want to have a scratch off PIN on the back of the card. If a GC is offered with no PIN, fraudsters can walk into a store, take a picture of the different card numbers, and then redeem online once the cards have been activated. Fraudsters will also tumble card numbers once they have figured out the numerical sequence of the cards. Using a PIN prevents both of these problems. The use of GCs is going to continue to increase in the coming years— this is no surprise. Mobile will continue to be incorporated with these offerings, and answering security challenges will be paramount to their success. Although we are in the age of the data breach, there is no reason that the experience of purchasing or redeeming a gift card should be hampered by overly cautious fraud checks. It’s possible to strike the right balance— grow your business securely by implementing a fraud solution that is fraud minded AND customer centric. *The use of GC/eGC is used interchangeably

Gift cards have risen in popularity over the last few years both for consumers and for fraudsters, causing a huge increase in gift card fraud

Identity verification techniques have been evolving over the past few years to meet business priorities beyond fraud prevention

The news of the latest breach last week reported that tens of millions of customer and employee records were stolen by a sophisticated hacker incursion. The data lost is reported to include names, birth dates, Social Security numbers, and addresses. The nature of the stolen data has the potential to create long-term headaches for the organization and tens of millions of individuals. Unlike a retailer or financial breach, where stolen payment cards can be deactivated and new ones issued, the theft of permanent identity information is, well, not easily corrected. You can’t simply reissue Social Security numbers, birth dates, names and addresses. What’s more, the data likely includes identity data on millions of dependent minors, who are prime targets for identity thieves and whose credit goes frequently unmonitored. According to the Identity Theft Resource Center’s 2014 Data Breach Report, a record 783 breaches, representing 85 million records, occurred from January through September 2014 alone. The breaches have ranged across virtually every industry segment and data type. So where does all this breached data go? It goes into the massive, global underground marketplace for stolen data, where it’s bought and sold, and then used by cybercriminals and fraudsters to defraud organizations and individuals. Like any market, supply and demand determines price, and the massive quantity of recent breaches has made stolen identities more affordable to more fraudsters, exacerbating the overall problem. In fact, stolen health credentials can go for $10 each, about 10 or 20 times the value of a U.S. credit card number, according to Don Jackson, director of threat intelligence at PhishLabs, a cyber crime protection company. The big question: So what now? The answer: Assume that all data has been breached, and act accordingly. Such a statement sounds a bit trivial, but it’s a significant paradigm shift. It’s a clear-headed recognition of the implications of the ongoing, escalating covert war between cybercriminals and fraudsters, on one side, and organizations and consumers on the other. For individuals, we need to internalize this fact: our data has likely been breached, and we need to become vigilant and defend ourselves. Sign up for a credit monitoring service that covers all three credit bureaus to be alerted if your data or ID is being used in ways that indicate fraud. Include your children, as well. A child’s identity is far more valuable to a fraudster as they know it can be several years before their stolen identity is detected. Many parents do not check their child’s credit regularly, if at all. For organizations, it’s a war on two fronts: data protection and fraud prevention. And the stakes are huge, bigger than many of us recognize. We’re not just fighting to prevent financial theft, we’re fighting to preserve trust — trust between organizations and consumers, at the first level, and ultimately widespread consumer trust in the institutions of finance, commerce, and government. We must collectively strive to win the war on data protection, no doubt, and prevent future data breaches. But what breaches illustrate is that, when fundamental identity data is breached, a terrible burden is placed on the second line of defense — fraud prevention. Simply put, organizations must continually evolve their fraud prevention control and skills, and minimize the damage caused by stolen identity data. And we must do it in ways that reinforce the trust between consumers and organizations, enhance the customer experience, and frustrate the criminals. At 41st Parameter, we are at the front lines of fraud prevention every day, and what we see are risks throughout the ecosystem. Account opening is a particular vulnerability, as consumer identity data obtained in the underground will undoubtedly be used to open lines of credit, submit fraudulent tax returns, etc. unbeknownst to the consumer. Since so much data has been breached, many of these new accounts will look “clean,” presenting a major challenge for traditional identity-based fraud and compliance solutions. But it’s more than new accounts — account takeover, transactions, loyalty, every stage is in jeopardy now that so much identity data is on the loose. Even the call center is vulnerable, as the very basis for caller authentication often relies on components of identity. At 41st Parameter and Experian Fraud & Identity solutions, we advocate a comprehensive layered approach that leverages multiple solutions such as FraudNet, Precise ID, KIQ, and credit data to protect all aspects of the customer journey while ensuring a seamless, positive user experience across channels and lines of business. Read our fraud perspective paper to learn more. Now is the time to take action.  http://www.reuters.com/article/2014/09/24/us-cybersecurity-hospitals-idUSKCN0HJ21I20140924