EMV IN THE U.S. HOW FAR HAVE WE COME AND WHERE ARE WE GOING? Andy Brown

Transcription

1 EMV IN THE U.S. HOW FAR HAVE WE COME AND WHERE ARE WE GOING? Andy Brown

2 MAC is an organization comprised of members from Banks, Acquirers, ISOs, Card Associations, Law Enforcement and others involved in risk management and compliance of the electronic payment processing industry. The purpose of MAC is to educate members in the electronic payment industries regarding the compliance with electronic payments regulations along with the detection, prevention and prosecution of those involved in electronic payment fraud. In the context of fulfilling MAC s ongoing educational obligations to its members, this webinar is being presented by the MAC Education Committee in support of the MAC mission regarding the exchange of information and continuous education of its members. 3/25/2014 3/27/2014 2

3 Agenda The move to EMV why and when Is EMV the silver bullet for fraud prevention? Strategies to adopt for better protection 3/25/2014 3

4 Who is Alaric? Solutions Connect Payments Systems and Participants Product Innovations Respond to Market Opportunity ecommerce ATM Banks / Card Issuers PSPs Cardholders Networks American Express, MasterCard, Visa Devices mpos POS ATM Message Mapper Fractals Text PIMS Cloud, Data feeds Host Systems Processors Acquirers / ISOs Merchant / POS / mpos Authentic MySpend Illustrative Clients Relying On Alaric s Solutions Global Operations and Footprint Alaric Offices: London, Kuala Lumpur, Dallas, Rome, Dubai and Melbourne Countries with Alaric clients 3/25/2014 4

5 THE MOVE TO EMV WHY AND WHEN 5

6 Why the move to EMV? Primary driver is fraud reduction Particularly counterfeit card fraud Mag-stripe inherently risky and pensionable EMV enables enhanced CVM Data authentication, PIN entry, cryptographics Transaction-unique digital seal ensures authenticity Fakes harder to manufacture Fakes harder to use 3/25/2014 6

7 EMV adoption globally 3/25/2014 7

8 11.6 Canada 11.0 Australia 10.5 Spain 8.6 Italy 6.3 Canada 5.2 Australia 4.4 Spain 4.3 Italy 5.7 Brazil 4.8 South Africa 3.9 Canada 3.3 Indonesia 4.9 France 4.4 Luxembourg 3.2 Germany 3.1 Ireland 7.9 France 21.4 USA 16.3 USA 6.9 Luxembourg 5.4 Italy 5.2 Ireland 21.5 USA 23.4 USA 32.6 USA US: top fraud abroad target for UK cards Top Five Countries for Fraud Abroad ( Millions) /25/2014 8

9 US: the fraud experience Fraudsters go for the easy option Easier target for international fraudsters 2012: 31.1 million third-party fraud cases in US worth more than $6.1 billion Cards used in 92% of these fraud cases Credit, debit or prepaid Outnumber and out-value check and ACH fraud Signature debit fraud six times PIN debit fraud By 2015, costs estimated to be $10 billion p.a. Domestic fraud also growing through skimming devices 3/25/2014 9

10 EMV roadmap in the US Amex & Discover liability shifts effective October 2015 Liability Shift: For debit and credit domestic and cross border counterfeit liability shifts at all POS excluding automated fuel dispensers (Oct 2015) Liability Shift: Expanded liability shifts to include automated fuel dispensers (Oct 2017) ADC relief takes effect (100%) Liability Hierarchy takes effect (excluding fuel) (Oct 2015) ATM Liability Hierarchy takes effect (Oct 2016) Liability Hierarchy takes effect for fuel operators (Oct 2017) Typically only about 50% of terminals EMV enabled by liability shift date 3/25/

11 Bumps along the way Durbin: The ruling raised questions about implementation, how payments are to be routed and how standards can be applied fairly. Jane E. Cloninger, senior analyst, Edgar Dunn PIN or Signature? Chip alone solves nothing... The current implementation plan for EMV not only ignores the need for PIN, but continues support for the mag-stripe on the card as a backup mechanism" Mark Horwedel, CEO of the Merchant Advisory Group Target breach changed the dynamics 3/25/

12 IS EMV THE ANTI- FRAUD SILVER BULLET? How fraud changes with EMV 12

13 % % % % % % % % % % % % International experience of EMV UK adopted EMV in 2004 In million loss from counterfeit cards In million loss Pattern repeated in Europe, Canada and Latin America Card Fraud Losses at UK Retailers (Face-to-Face Transactions) ( millions percentages show change on previous year s total) 3/25/

14 International experience After 10 years of EMV in UK Fraud levels about same Transaction volumes grown by 2.5 But moved significantly Lowest levels of fraud with Chip & PIN Highest levels with mag stripe cards Mag stripe fraud twice as large as CNP fraud 40 times greater than Chip & PIN fraud Card Fraud Losses Split By Type (as percentage of total loss) Lost/Stolen Counterfeit Card ID theft 23% 4% k 39% Mail non-receipt Card-not-present 28% 7% 63% 8% k 14% 3% 11% 3/25/

15 Fraud migration Inbound Fraud Foreign Issuer Risk Domestic Card Fraud CNP, Online, MOTO Merchant Risk Key Entered Issuer Risk POS Issuer Risk ATM Financial Institution Risk Identity Theft Internet Banking Corporate Payments Financial Institution Risk Migrate across border Issuer Risk 3/25/

16 EMV: the silver bullet? Back to basics Fraudsters will seek maximum return for minimum effort. If one area is too tough to crack, they simply move on to a softer target. Capture card (and PIN) in post Persuasive telephone calling (vishing) Collect card (and PIN) to replace compromised card Assist with catching a fraudulent merchant Attack business accounts Forged one pound coins - 45m 3/25/

17 Securing the CNP transaction EMV and PCI ties Tokenisation Wallet services Out of band authentication MyPinPad - PIN virtualisation 3/25/

18 STRATEGIES TO ADOPT FOR BETTER PROTECTION 3/25/

19 Multiple sources for fraud analysis Many thin strands around a core is the strongest approach There is no silver bullet No single vendor can be a specialist in everything Jack of all trades, master of none Take advantage of niche specialists Ability to rapidly deploy new approaches/technologies 3/25/

20 score99 risky fraud????????? The Gateway Partner x Partner y Partner z transaction Gateway Core Fraud system intelligent alerts 3/25/

21 Transaction Orchestration 3/25/

22 Fraud and Risk - two sides of the same coin Fraud and Risk are traditionally very separate, however Fraud and Risk are both trying to accomplish the same goal - Protection from loss Different perspectives for both - Merchant loss vs Enterprise loss Traditionally Risk analysis has been performed offline 3/25/

23 Fraud and Risk - two sides of the same coin Unify systems to save cost and improve performance Feed Credit Risk data into your Fraud system - Risk Ratings, Deposit info, Expected Performance, Exposure Thresholds Use this data to evaluate Merchants real time - Current performance compared to expected React to risks real time enabling you to shut off access if necessary Use the Risk Profile of your Merchant to classify for Fraud Risk - Risky businesses tend to be riskier for Fraud as well Ticketing, Gaming, etc 3/25/

24 Make use of your data! Gives you the ability to compare: What you are seeing What you have seen What you expect to see Current transaction Last few minutes/hours Profiled behaviour Previous days/weeks/months Individual limits Class/group levels 3/25/

25 SUMMARY 3/25/

26 Summary EMV is coming Bumps along the way Not all terminals will or need to EMV compliant by the time of liability shift Fraudsters will make use of the Pre-EMV window Fraud will migrate to other sectors overall likely to reduce Fraud systems need to be able to react to change Make use of right data at the right time Don t be the weak spot fraudsters will find you 3/25/

27 THANK YOU 27

28 3/25/