ONLINE FRAUD BENCHMARK REPORT

Transcription

1 CyberSource ONLINE FRAUD BENCHMARK REPORT 2015 Australia Edition 2015 CyberSource Corporation. All rights reserved. Published December 2015

2 ABOUT CYBERSOURCE CyberSource, a wholly-owned subsidiary of Visa Inc., is a payment management company. Over 400,000 businesses worldwide use CyberSource and Authorize.Net brand solutions to process online payments, streamline fraud management, and simplify payment security. The company is headquartered in Foster City, CA and maintains offices throughout the world, with regional headquarters in Singapore, Tokyo, Miami / Sao Paulo and Reading, U.K. CyberSource operates in Europe under agreement with Visa Europe. For more information, please visit

3 INTRODUCTION As merchants expand into new channels and markets to meet consumer demand for ecommerce, the complexity of online payment and fraud increases as well. To advance the industry s management of online fraud and business optimisation, and take an in-depth look at the online and mobile fraud landscape in Australia, CyberSource commissioned an inaugural report of this market. This report summarises the answers of 197 business professionals in Australia, who make fraud management decisions at companies selling goods or services online. The interviews were conducted via phone by GfK between March and April Respondents were segmented by the amount and source of their annual online revenue. Under size of online revenue there were three groups: less than $5 million (61%), $5M-$24.9M (25%), and $25M and above (14%). As for source of online revenue, the five categories were physical goods (44%), services excluding travel (29%), travel services and event bookings (11%), electronics (9%), and digital goods (7%). In this report, you ll find: Summary of key online fraud benchmarks and operation metrics Top strategic priorities for online fraud management Overview of mobile commerce and mobile fraud risks About GfK GfK is the trusted source of relevant market and consumer information that enables its clients to make smarter decisions. More than 13,000 market research experts combine their passion with GfK s long-standing data science experience. This allows GfK to deliver vital global insights matched with local market intelligence from more than 100 countries. By using innovative technologies and data sciences, GfK turns big data into smart data, enabling its clients to improve their competitive edge and enrich consumers experiences and choices. For more information, please visit or follow GfK on Twitter:

4 KEY FRAUD BENCHMARKING AND OPERATIONAL METRICS 01

5 FRAUD CHARGEBACK RATE 1.29 % MODERATE BUT ROOM FOR IMPROVEMENT With a 1.29% fraud chargeback rate, Australian merchants have a lot to gain by making their fraud management more efficient, especially the <$5M and $5M-$24.9M online revenue companies. Their fraud chargeback rate (1.35%) is triple that of $25M+ companies (0.38%), probably because of manpower and budget constrains in fighting fraud. Respondents in online travel services had the highest fraud chargeback rate (1.97%), likely due to the increased fraud risks of overseas transactions. Digital goods (1.83%) had the next highest chargeback rate, followed by electronics (1.79%) and physical goods (1.18%), and services excluding travel (0.85%). BY ANNUAL ecommerce REVENUE < $5M $5M - $24.9M $25M+ BY PRIMARY ONLINE REVENUE SOURCE 1.35% 1.35% 0.38% 1.83% Successfully disputing chargebacks is costly and challenging. Merchants have to gather and organise all order, delivery and payment information to provide to their acquirer, who can also impose penalties on their merchant account. And as cybercriminals use more advanced technologies for malicious purposes, minimising fraud chargebacks is essential in the overall strategy to enhance profitability and reduce fraud loss. Digital Goods Physical Goods Electronics Travel Services Services Excluding Travel 1.18% 1.79% 1.97% 0.85% 02

6 FRAUD RATE BY ORDER: DOMESTIC 0.94 % INTERNATIONAL FRAUD RATE 6X THAT OF DOMESTIC The rate of fraudulent orders made outside Australia (6.16%) was more than six times that of orders made within Australia (0.94%). This stark contrast reveals international orders to be a lot riskier than domestic orders, one reason being that credit checks and public records vary by country. This higher perceived risk is likely a factor causing merchants to reject more overseas orders. VS. 15 BY PRIMARY ONLINE REVENUE SOURCE 2.17% 5.82% 12.56% 13.53% 0.93% 12 FRAUD RATE BY ORDER: INTERNATIONAL % 6.16 % % Digital Goods 0.95% Physical Goods Electronics 1.00% Services Excluding Travel 0.37% Travel Services DOMESTIC (Solid Color) INTERNATIONAL (Patterns Bar) BY ANNUAL ecommerce REVENUE % 3.91% 11.36% Perhaps owing to the span of their business, $25M+ online revenue companies topped the domestic (1.6%) and overseas (11.36%) fraud rates. These were much higher than $5M-$24.9M companies (1.18% domestic, 3.91% overseas) and <$5M companies (0.79% domestic, 6.32% overseas) % 1.18% 1.60% $5M - < $5M $25M+ $24.9M DOMESTIC (Solid Color) Since cross-border online transactions are common for travel services, this group had the highest international fraud rate (13.53%) while its domestic fraud rate was just 1%. Electronics vendors also had high overseas fraud rate (12.56%), but their domestic fraud rate (2.39%) topped the survey. This might be tied to the strong demand for electronic gadgets in a highlyconnected society like Australia s, which makes it attractive and easy for individuals to buy and resell units for a tidy sum. INTERNATIONAL (Patterns Bar) 03

7 ORDER REJECTION RATE 2.23 % BY ANNUAL ecommerce REVENUE < $5M $5M - $24.9M $25M+ 1.89% 2.18% 5.98% EVIDENCE SHOULD BE THE RULE, NOT SUSPICION Australian companies on average reject 2.23% of orders based purely on suspected fraud, that is, without any investigation or verification. In fact, companies with $25M+ online revenue (5.98%) reject twice as many orders compared to $5M-$24.9M companies (2.18%), and almost five times that of <$5M companies (1.89%). Travel services had the highest order rejection rate (6.22%), which could be related to the perceived fear around overseas transactions, as tracing and recouping losses from fraud will be arduous and long-drawn. Order rejection rates were much less for electronics (2.92%), physical goods (2.01%), digital goods (1.32%), and other services besides travel (0.93%). BY PRIMARY ONLINE REVENUE SOURCE 1.32% 2.01% An order rejection rate does not reflect true fraud risk, but rather a knee jerk reaction that can undermine potential profits. Going only with suspicion can lead to erroneous rejection of genuine orders. The solution is to maximise the number of automated screening and decisions, so investigative efforts are applied only on truly questionable orders, keeping customer satisfaction levels intact. 2.92% 6.22% 0.93% Digital Goods Physical Goods Electronics Travel Services Services Excluding Travel 04

8 FALSE POSITIVE RATE 8.83 % BY ANNUAL ecommerce REVENUE < $5M $5M - $24.9M $25M+ 7.03% 10.38% 19.00% NEARLY 1/10 OF REJECTED ORDERS ARE ACTUALLY VALID Practically a fifth (19%) of Australian merchants do not track false positives. For the 81% who do, they had an average false positive rate of 8.83%. These results are cause for concern because seen another way, one in every 10 customers payment the amount notwithstanding gets mistakenly turned down by business owners. The highest false positive rate belonged to travel services (20.23%), more than twice that of physical goods (9.08%) which came second. Next was services excluding travel (7.17%), electronics (6.14%), and digital goods (2.4%). Different online industries will face different fraud challenges which can also vary by geography, so it is important to get both industry-specific and region-specific fraud risk expertise to ensure safe business expansion. BY PRIMARY ONLINE REVENUE SOURCE Digital Goods Physical Goods Electronics Travel Services Services Excluding Travel 2.40% 9.08% 6.14% 20.23% 7.17% The massive gap between the first and second highest false positive rates got repeated when respondents were segmented by online revenue $25M+ companies (19%), $5M-$24.9M companies (10.38%) and <$5M companies (7.03%). This would suggest that the higher a company s online revenue, the higher the false positive rate. But it also underscores how extra potential revenue gets missed simply due to misplaced judgement. Merchants thus should use automated fraud detection and accurate sorting to wean off relying on intuition, as that can cause erroneous rejection of valid orders and oversight of actual fraud. Reducing the number of wrongly rejected valid orders is paramount and achievable with the right tools. Because from a broader business perspective, unbridled false positives is a sure way to dent the customer experience and discourage repeat visits. These ultimately affect not only a merchant s revenue, but reputation too. 05

9 MANUAL REVIEW RATE % HEAVY RELIANCE ON MANUAL REVIEWS PROVES BURDENSOME Around 73% of Australian companies carry out manual fraud screening for nearly half (43.05%) of all orders, proving that manual review is both a common and heavy burden. The manual review rate was highest for the <$5M revenue group (47.03%), possibly from inefficient fraud management operations such as a lack of automated screening. Whereas $5M-$24.9M companies (37.64%) and $25M+ companies (26.57%) were less dependent on manual reviews. Online sellers of physical goods manually screen 52.23% of all their orders, with electronics (43.15%) a close second. That could be because these two business types have more to lose from fraud given the higher expenses associated with certain tangible goods, which other businesses are not as exposed to. It would also explain the smaller manual review rates of those selling services besides travel (34.4%), digital goods (27.56%), and travel services (27%). All that time and labour to manually check several orders is arguably in vain since two thirds (64.76%) get accepted in the end; effort which would be more wisely spent on the 35.24% of orders that were eventually rejected. This shows Australian merchants lack accuracy and confidence in battling fraud. To screen more orders and keep manual review rates low, merchants can adopt automated fraud detection to increase accuracy in spotting fraud so less orders join the manual queue, and implement case management systems to help review teams operate more efficiently. BY ANNUAL ecommerce REVENUE BY PRIMARY ONLINE REVENUE SOURCE 47.03% 27.56% 52.23% 37.64% 43.15% 27.00% 26.57% 34.40% < $5M $5M - $24.9M $25M+ Digital Goods Physical Goods Electronics Travel Services Services Excluding Travel 06

10 FRAUD MANAGEMENT BUDGET Same or Bigger Fraud Budgets Expected Considering the high manual review rate, and how a significant portion of fraud expenditure goes to manual reviews, it is no surprise most respondents plan to either maintain (57%) or increase (28%) their fraud budget in the next 12 months. The average increase in fraud budgets came up to 20.29%. Larger $25M+ companies expectedly planned the biggest jump (28.75%). However, smaller <$5M companies also wanted a significant increase (22.28%), exceeding the middle $5M-$24.9M group (14.59%). A vast majority of budgets increasing or staying the same signals the necessity for efficient and cost-effective fraud management, since fraud impacts both profits and productivity. Sustainably growing revenue needs to come from not just selling more, but also saving more on expenses including fraud management costs. Businesses can tap on a single holistic management platform like CyberSource Decision Manager to optimise detection, rules and data analytics. This allows the manual review team to concentrate only on orders that justify a manual evaluation, and finish that in the shortest time possible so genuine customers are not kept waiting. Average Budget Increase for Fraud Management BY ANNUAL ecommerce REVENUE 22.28% 14.59% 28.75% < $5M $5M - $24.9M $25M+ 07

11 CyberSource DECISION MANAGER The World s Largest Fraud Detection Radar Business Rule Console to Set Policies / React on Demand ORDERS Accept Reject 1 Detection Radar and Rules System REPORTING AND ANALYTICS TOOLS 2 Case Management System 3 Advanced Analytics Package Our global fraud management system has all the capabilities you need to automate and streamline fraud operations. Decision Manager is a hosted fraud management portal that paves the way for a preemptive approach to fraud management stopping fraud closer to its inception while increasing the speed of good orders to pass through your system, so you maximise revenue. Decision Manager accesses the world s largest fraud detection radar based on over 68 billion transactions Visa and CyberSource process annually, along with a rules engine, a case management system as well as reporting and analytics. 08

12 TOP STRATEGIC PRIORITIES FOR ONLINE FRAUD MANAGEMENT 09

13 TOP PRIORITIES FOR FRAUD MANAGEMENT Presented with a list of five strategic goals, respondents had to rank each goal as a high, medium or low priority for the next 12 months. The results showed that Australian merchants are more concerned with improving their fraud operations than overall fraud management strategy. This is not unexpected since companies, particularly smaller ones, tend to view fraud mitigation as expenses on the balance sheet. But fraud is a dynamic problem, compounded by the additional sales channels and payment methods merchants take on as part of ongoing business expansion. Not to mention, fraudsters keep inventing new ways to discover and exploit security loopholes. Therefore merchants should regularly evaluate and adjust their fraud strategies to maintain optimal fraud defences. With well-integrated fraud management, businesses can stay one step ahead of fraudsters, and securely grow their online profits while keeping fraud operations costs under control. CYBERSOURCE DECISION MANAGER REPLAY The first real-time what-if rules analysis tool A revolutionary new fraud tuning and analytics feature on CyberSource s flagship Decision Manager platform, Decision Manager Replay lets you test and compare various whatif fraud strategies and scenarios against your own historical data, producing a real-time report of the likely impact on transactions and fraud rates. You no longer have to rely on guesswork or wait three months for data to mature to visualise the changes you make to fraud rules. Now you can quickly and continually perfect your rules and only activate them once they meet your desired goals. This means you can refine fraud management strategies more effectively in less time, and increase the overall bottom line. 39 % Capture and analyse the right data and use it effectively 32 % Streamline manual review tasks and workflow 31 % Improve automated detection and sorting accuracy 29 % Optimise fraud strategies and detection tools for every channel we operate 24 % Track ecommerce fraud and fraud metrics more effectively across all channels including mobile By having the relevant data readily available, merchants gain more insightful correlations to pinpoint sophisticated fraud and fine-tune screening rules. The payoff? Greater efficiency and cost-effectiveness from higher acceptance of good orders, lower fraud rates, and less orders sent to manual review. Manual review is an effective but expensive tool against fraud that can lead to wasted resources and employee productivity. If a reviewer s accept rate is too high, genuine orders can end up stuck in the anti-fraud checks and delay transaction times. This can cause higher drop-off rates and lost sales. Automating fraud detection reduces the manual review volume and rate. As a company s business and orders grow over time, the scope and vigour of fraud detection will have to increase, making automated screening and sorting all the more imperative. Insufficient resources perhaps stopped merchants from prioritising fraud strategies, but that has a direct impact on sustainable business expansion. The good news is there are measurement tools to check a strategy s effectiveness, so merchants can determine which fraud rules give the desired results with minimal waste of time and overheads. More customers are doing their online shopping across multiple devices, bringing new sales opportunities and fraud risks. So the importance of omnichannel fraud monitoring will only rise over time, especially since merchants may be more vulnerable on certain channels than others. 10

14 OVERVIEW OF MOBILE COMMERCE AND MOBILE FRAUD RISKS 11

15 BY 2019 mcommerce MARKET TO HIT $ 54B MOBILE CHANNEL PRESENCE IN AUSTRALIA Multi-channel, multi-device and mobile-optimised are becoming the default standards for digital commerce globally. In Australia, the mobile commerce market is expected to go up from $22B in 2014 to $54B in , at a compound average growth rate (CAGR) of 19%. Despite this trend, current mcommerce adoption by Australian businesses is largely nascent. The majority (44%) do not have a mobile-optimised website or app, while just 21% have both. A relative handful (28%) run a mobile website, and even less (5%) have a mobile app. The remainder (2%) do not know if their organisation had any mobile presence. Over half (56%) of the <$5M online revenue companies had no mobile adoption. In contrast, 30% of the $5M-$24.9M companies and 38% of $25M+ companies have both a mobile site and app. Having mobile website was also more common for $5M-$24.9M (36%) and <$5M merchants (26%). 44% 28% MOBILE COMMERCE CHANNELS USED 2% 21% 5% Neither - We do not have a mobile optimised website or mobile app Mobile Commerce Website App Don t Know 1 Frost & Sullivan: Australia s mobile commerce market hits $22 billion in Sep 10, com/news/press-release/frost-sullivanaustralias-mobile-commerce-markethits-22-billion-2014/ Both - Mobile Commerce Website and App 12

16 mcommerce FRAUD SCREENING MERCHANTS NEED BETTER UNDERSTANDING OF MOBILE FRAUD Screening online fraud is a longstanding practice for ecommerce merchants. But as more consumers turn to mobile channels such as tablets and smartphones to shop, it is only a matter of time that mcommerce fraud screening becomes a standard industry practice, even if most businesses have not caught on yet. Respondents were split equally (31% each) between those who do not track mcommerce fraud and those who do using ecommerce screening tools. Those who screen mobile orders with both ecommerce tools and other tools were the minority (10%) a sign that Australian businesses currently perceive the mobile channel as either too insignificant or too daunting to screen for fraud. Merchants use ecommerce tools (41%) more than other tools (27%) to monitor mobile fraud. The key thing to note is not the pros and cons of certain tools, but how fraud complexities vary across different channels This understanding is critical if merchants want to leverage the ubiquity of smartphones and tablets to increase overall sales revenue. Us of ecommerce TOOLS VS. OTHER TOOLS 41 % 27 % Screen mcommerce with ecommerce fraud tools (includes respondents using both) Screen mcommerce with other tools (includes respondents using both) 13

17 mcommerce SUSCEPTIBILITY TO FRAUD UNCERTAINTY OVER DISTINCTION BETWEEN MOBILE AND ONLINE FRAUD RISKS Australian merchants are generally unaware or uncertain on how mobile presents different fraud risks than online. Almost a third (32%) believe there is no difference between ecommerce and mcommerce fraud risks. Another 19% said they don t know. Most who recognise a distinction are themselves not entirely sure. Some 21% felt mobile has somewhat higher fraud risk, while 15% deemed it somewhat lower. Just a few expressed some degree of certainty, saying mobile has significantly higher (10%) and significantly lower risk (3%). Unlike PCs, mobile interfaces are often streamlined to make it easier for customers to browse and pay. The technological changes at the backend that enable mcommerce do not just alter customer buying behaviour, it could also unearth new security gaps for fraudsters to exploit. Typical online fraud tools may not be as effective for the mobile platform, hence fraud screening should be configured accordingly, or else genuine orders via mobile could get stuck in online-centric fraud rules. 36 % SOMEWHAT DIFFERENT 32 % NO DIFFERENCE 19 % DON T KNOW 13 % SIGNIFICANTLY DIFFERENT 14

18 Given the lack of mcommerce awareness, the revenue fraud loss rate on the mobile channel (1.44%) is unsurprisingly higher than the online revenue fraud loss rate (0.96%). REVENUE MOBILE FRAUD LOSS RATE REVENUE LOSSES TO FRAUD BIGGER ON mcommerce THAN ecommerce Consumers are increasingly using a variety of devices at different times while shopping online their smartphone during morning commute, laptop while in the office, and tablet at night. This omnichannel evolution means that sales generation can start anywhere, anytime on any device. But instead of a mobile-only fraud approach, an integrated fraud management solution that offers a single holistic view of fraud activities to spot abnormal behaviour across all channels is more effective. Seeing as the mcommerce channel is set to grow in Australia despite slow merchant uptake, there are abundant opportunities for businesses to boost their sales and competitiveness. Like venturing into a new market, mobile can seem like unknown territory with its own risks. CyberSource Managed Risk Services has dedicated and experienced fraud analysts to help merchants overcome the challenges, so they can leverage the mobile channel quickly with confidence and minimal risk. CYBERSOURCE MANAGED RISK SERVICES Access a Whole World of Risk Expertise With ever-changing fraud schemes and business conditions, CyberSource Managed Risk Services enables you to scale your expertise and capacity without adding fixed headcount. Our global team of fraud risk analysts and experts across six continents, with over 450 years of combined industry experience in fraud management, can back your team or even manage complete portions of your operation. We can help you analyse, design and manage your order screening and fraud detection processes everything from screening strategies and risk threshold optimisation analysis to ongoing monitoring, order review and chargeback management/recovery. All our services are backed by business performance guarantees. CYBERSOURCE SCREENING MANAGEMENT SERVICES Outsource Your Fraud Operation to Us Available 24/7, our Screening Management Service manages all your screening and review operations, enabling you to optimise results without adding staff as your business grows. CyberSource will constantly monitor and tune your fraud management system, and coordinate with other departments in your organisation to maximise revenue and reduce overhead, while maintaining a positive customer experience. 15

19 CONCLUSION What stands out in this inaugural report is that merchants in Australia are very focused on managing fraud, but have a long way to go in making it more effective, especially on the mobile channel. Manual review rates are extremely high, but judging by their priorities over the next 12 months, merchants are aware and keen to reduce this. In the face of ever-changing fraud threats, keeping a positive customer experience and the fraud rate and expenses low is a delicate balance. Fraud can never be eliminated completely, but a shrewd fraud strategy with well-integrated operations will empower merchants to reach their business objectives in a sustainable and secure manner. DISCLAIMER Case studies, statistics, research and recommendations are provided AS IS and intended for informational purposes only and should not be relied upon for operational, marketing, legal, technical, tax, financial or other advice. You should consult with your legal counsel to determine what laws and regulations may apply to your circumstances. The actual costs, savings and benefits of any recommendations or programs may vary based upon your specific business needs and program requirements. By their nature, recommendations are not guarantees of future performance or results and are subject to risks, uncertainties and assumptions that are difficult to predict or quantify. Visa is not responsible for your use of the information contained herein (including errors, omissions, inaccuracy or non-timeliness of any kind) or any assumptions or conclusions you might draw from its use. Visa makes no warranty, express or implied, and explicitly disclaims the warranties of merchantability and fitness for a particular purpose, any warranty of non-infringement of any third party s intellectual property rights. To the extent permitted by applicable law, Visa shall not be liable to a client or any third party for any damages under any theory of law, including, without limitation, any special, consequential, incidental or punitive damages, nor any damages for loss of business profits, business interruption, loss of business information, or other monetary loss, even if advised of the possibility of such damages.

20 CONTACT US ASIA PACIFIC Australia & New Zealand EUROPE, MIDDLE EAST & AFRICA Reading, United Kingdom LATIN AMERICA & THE CARIBBEAN Miami, FL, United States t (Australia) t (New Zealand) e. t e. europe@cybersource.com t e. lac@cybersource.com Southeast Asia t (Singapore/Thailand) t (Malaysia) t (India) t (Philippines - Globe) t (Philippines - PLDT) e. ap_enquiries@cybersource.com JAPAN Tokyo, Japan t e. sales@cybersource.co.jp NORTH AMERICA Foster City, CA, United States t t e. sales@cybersource.com Greater China e. gc_enquiries@cybersource.com 2015 CyberSource Corporation. All rights reserved.