Updated: Mitigating Fraud Risk Through Card Data Verification

Transcription

1 Risk Management Best Practices 30 June 2016 Updated: Mitigating Fraud Risk Thrugh Card Data Verificatin AP, Canada, CEMEA, LAC, U.S. Acquirers, Issuers, Prcessrs Overview: Visa is prviding issuers with updated best practices fr determining transactin fraud risk befre apprving r declining a transactin and encurages issuers t use a cmbinatin f transactin attributes t mitigate fraud. The rise f mbile and clud-based payments allws Visa cardhlders t pay via different devices acrss multiple interfaces. Related Training Frm Visa Business Schl: As payment transactin types diversify, issuers will find it increasingly imprtant t Fraud and Risk take a hlistic apprach t managing risk. Issuers must evaluate each transactin n its wn merits; they can d this by embedding lgic in their authrizatin hsts that uses the pint-f-sale (POS) entry mde and the transactin service cde t evaluate card verificatin values, such as Card Verificatin Value (CVV), CVV2, Integrated Circuit Card CVV (icvv), Dynamic CVV (dcvv) and the Samsung Pay-specific Magnetic Secure Transmissin (MST) verificatin value. An verview f these data elements is prvided, alng with best practices issuers shuld cnsider t ptimize risk management in their prtflis. Card Verificatin Value Types CVV, icvv and CVV2 may be fund n the physical card in the magnetic stripe, in the chip r printed n the back, while MST verificatin value and dcvv are generated at the time f the transactin. Visa includes these unique, distinct cdes in all transactins and requires that all cards, including emergency replacement cards, be encded with them. Card verificatin values are based n the accunt number, expiratin date and service cde and are calculated by applying a cryptgraphic algrithm t the encded accunt infrmatin. Since the card verificatin value used varies accrding t the interface thrugh which the transactin was captured (e.g. magnetic stripe, card-ntpresent, cntact chip and cntactless), issuers can validate the value t blck fraud. Issuers verify card verificatin values nline at the time they authrize a transactin. Incrrect values signal ptentially fraudulent transactins. Card Verificatin Value Types CVV Magnetic-Stripe Interface Descriptin CVV is the unique three-digit number encded in Track 1 and the Track 2 Discretinary Data field f the magnetic stripe. It is calculated by applying an algrithm t the encded accunt infrmatin and verified nline at authrizatin. Issuers shuld always validate the CVV fr magnetic-stripe transactins, even when a PIN is present and verified.

2 CVV2 Card-Absent Envirnment CVV2 is the three-digit number printed n the back f all Visa cards, calculated slightly differently using the same algrithm as the CVV. When merchants submit the CVV2, issuers may check it as part f the authrizatin request fr card-absent transactins (r, in the U.S., when a card cannt be read electrnically in face-t-face transactins). dcvv Magnetic-Stripe Databased Cntactless Interface dcvv is an authenticatin technique fr the magneticstripe data versin f Visa paywave cntactless transactins. The dcvv is calculated using the dynamic cntactless chip data and sent in the transactin t the issuer, reducing data cmprmises and cunterfeiting. icvv Cntact r Cntactless Chip Interfaces icvv is a value encded nt the chip Track 2 equivalent dataset that enables issuers t easily detect and decline cunterfeit magnetic-stripe cards created frm chip card data. Nte: The crrect icvv value shuld nly be present in a chip-read transactin. Chip-read transactins shuld als cntain the strnger EMV authenticatin cryptgram, which shuld be used fr authenticatin instead f icvv. MST Verificatin Value Samsung Pay Cntactless Interface (New) MST verificatin value is an authenticatin technique fr the transmissin f tkenized magnetic-stipe data fr Samsung Pay. The MST verificatin value is generated using the limited-use key (LUK) n the mbile phne and sent in the transactin fr verificatin. Failure f any f these card verificatin value types may expse a cunterfeit card created frm cmprmised magnetic-stripe r chip data. Hwever, such failures may als signal a prblem with a genuine card; issuers shuld therefre investigate repeated card failures t avid repeated declines. Fraudsters may als attempt a brute-frce attack n card verificatin value identificatin r ther authenticatin values by rapidly submitting cnsecutive transactins until they receive psitive authrizatin frm the issuer. Repeated CVV2 failures, in particular, may indicate fraudulent use f an accunt number where fraudsters d nt physically have the card. Additinal Transactin Data Elements Card-generated Online Cryptgram (New) During persnalizatin f the chip card, a Triple Data Encryptin Standard (TDES) key is injected int the chip. At the time f transactin, a unique cryptgram versin number (CVN) CVN 10, CVN 17, CVN 18 r CVN

3 22 is calculated using transactin data and the TDES key. This CVN is sent with the nline authrizatin request. Issuers can then recalculate and cmpare the CVN t determine if the card being used fr the transactin is valid. This prcess detects cunterfeit data and cunterfeit cards. Failure f CVN verificatin alerts issuers f a ptentially fraudulent transactin. POS Entry Mde The POS entry mde (Field 22) sent with each transactin prvides the issuer with infrmatin abut hw the merchant acquired the transactin data. Since the POS entry mde, in cmbinatin with ther authrizatin parameters (e.g., POS cnditin cde), identifies the acceptance channel, POS entry mde verificatin is essential t identify and prevent fraud. The mst cmmn POS entry mdes include: 01 Manual key entry 05 r 95 Chip read 07 Cntactless, using chip data rules 02 r 90 Magnetic-stripe read 91 Cntactless, using magnetic-stripe data rules Service Cde The service cde is a sequence f digits that, taken as a whle, defines varius services, differentiates card usage in internatinal r dmestic interchange, designates PIN requirements and identifies card restrictins. Service cdes apply t all Visa prducts. Typical service cde examples include: 101 Magnetic-stipe card; internatinal use 120 Magnetic-stripe card; internatinal use; PIN is required 121 Magnetic-stripe card; internatinal use; nline authrizatin required fr all transactins 201 EMV chip card; internatinal use 221 EMV chip card; internatinal use; nline authrizatin required fr all transactins 601 Natinal-use EMV chip credit and debit cards Nte: Service cdes 000 and 999 are nt valid identifiers f card capability r use, and they are slely used t calculate CVV2 and icvv. Service cdes 000 and 999 must nt be encded n the card magnetic stripe. Issuers shuld decline transactins with these service cdes. Failure t d s may result in fraud lsses. Service cdes are nly used t indicate cardhlder verificatin methd (CVM) and authrizatin preferences during magnetic-stripe transactins. Fr chip-read transactins, the parameters encded n the chip will be used fr this purpse, and these may nt necessarily match the preferences indicated by the service cde. Using Data Elements t Mitigate Fraud Issuers shuld cnsider card verificatin values, POS entry mde and service cdes tgether t identify lgical cnflicts and mitigate cunterfeit and card-absent fraud. As a prerequisite, issuers shuld check that the POS entry mde identifies a supprted payment interface and that the service cde is valid and matches the ne encded

4 n the card. After reviewing an authrizatin request, issuers shuld incrprate the crrespnding card verificatin value result as part f the decisin prcess. Validatin f the POS entry mde, the apprpriate service cde and the crrespnding card verificatin value can autmatically identify ptential fraud, including: Card-Present Fraud Using Card-Absent Data: Data stlen frm a card-absent transactin shuld nt wrk n a face-t-face interface, as CVV / icvv / dcvv validatin will fail because the fraudster wuld nt have access t genuine values. Issuers shuld identify and investigate these discrepancies and decline crrespnding transactins nce identified as fraudulent. Cunterfeiting a Magnetic-Stripe Card Using Cntactless Chip Data: Fraudsters may steal data frm a cntactless card r a mbile phne and apply it t a magnetic stripe. The magnetic-stripe transactin wuld have a POS entry mde f 90 (magnetic stripe), indicating that CVV shuld be checked, which wuld fail because the fraudster wuld nt have access t the genuine value. Cunterfeiting Skimmed Chip Data: Fraudsters may steal data frm a chip card (cntact r cntactless) and apply it t a magnetic stripe. In this case, the magnetic-stripe transactin wuld have a POS entry mde f 90 instead f 05 / 95 (cntact chip) r 07 / 91 (cntactless), and the service cde wuld nt match the card type. Fr example, a service cde f 000 r 999 is invalid fr a swiped transactin with a POS entry mde f 90. Verifying the CVV fr a magnetic-stripe transactin will reveal the icvv stlen frm a chip card, and issuers shuld decline the transactin as suspected fraud. Cntactless Fraud Using Cmprmised Magnetic-Stripe Data: Fraudsters may cunterfeit magnetic-stripe card data nt a payment applicatin stred n a mbile device. When using the cntactless interface, the issuer shuld recgnize that this transactin has a POS entry mde f 91 r 07, indicating that they shuld check either dcvv (fr 91) r an EMV Cryptgram (fr 07). These shuld fail, as the fraudster wuld nt have access t the genuine value. Cntact Fraud Using Cmprmised Magnetic Stripe Data (New): Fraudsters may cunterfeit magneticstripe card data nt a cntact chip card. Issuers that d nt issue cntact chip-enabled prducts can immediately identify and decline any transactins with a POS entry mde f 05 / 95 (cntact chip). Issuers that d nt issue cntact chip r cntactless-enabled prducts may nt have develped the capability t validate the card verificatin value types assciated with these newer interfaces (i.e., dcvv / icvv). Visa strngly recmmends that issuers decline transactins with POS entry mdes irrelevant t the prducts they have issued (e.g., an issuer that has nt issued cntactless prducts shuld decline transactins with a POS entry mde f 91 r 07). Issuers that participate in digital wallets shuld ensure that they are in a psitn t manage bth tkenized and nn-tkenized cntactless transactins. Issuers that nly participate in tkenized wallets may either decline all nn-tkenized cntactless transactins at their wn hst r have Visa perfrm this task n their behalf. Clients shuld cntact their Visa representative fr further details. Validating the card verificatin value type may sufficiently identify a fraudulent transactin. Hwever, with the intrductin f different frm factrs fr use acrss multiple interfaces, Visa advises issuers t use additinal data elements in authrizatin decisins. Issuers have card verificatin value prcessing ptins that allw Visa t validate n the issuer s behalf. VisaNet has edits in place that search fr invalid service cdes, POS entry mdes and card verificatin value cmbinatins, and it will decline the transactin and send decline advice t the issuer / prcessr. Hwever, Visa encurages issuers t validate card verificatin values n their wn and perfrm these same checks n all authrizatin requests.

5 Issuer Best Practices Given the issuer capabilities and data elements available, Visa recmmends the fllwing best practices t ptimize prtfli fraud management: Priritize Chip Cryptgram Validatin: Fr chip transactins, validatin f the Applicatin Cryptgram (Cryptgram Versin Number 10 r 17) shuld take precedence ver icvv validatin. icvv validatin shuld nly take place if issuers lack chip data fr validatin, and issuers shuld still view successful validatin as a higher risk transactin. Enable Multi-Part Authrizatin Review: When reviewing an authrizatin request, issuers shuld incrprate the card verificatin value result, the service cde and the POS entry mde as part f the authrizatin prcess. Issuers shuld check fr cnsistency and alignment amng these multiple data elements, including review f chip card authrizatin requests acrss POS and ATM transactins, regardless f CVM (e.g., signature, PIN r n CVM). Decline Invalid Service Cdes: Issuers shuld decline transactins with invalid service cdes, such as 999 r 000. Cnfigure VisaNet fr Failed Scenaris: Issuers shuld review all failed card verificatin value (CVV, CVV2, icvv, dcvv) transactins at the issuer hst-level rather than leaving the decisin t VisaNet stand-in prcessing (STIP). Use ne f the fllwing CVV prcessing scenaris: CVV Always t ensure that if the CVV fails in STIP, the transactin will be switched t the issuer, if available. CVV All Respnd t ensure that the default respnse cde fr invalid CVV transactins is 05 decline. Nte: These are VisaNet-specific cnfiguratins. Activate Sft Blck: Issuers shuld cnsider a sft blck n accunts where transactins are apprved with invalid card verificatin value until they cnfirm accunt activity with the cardhlder. This will lwer the number f declines n genuine transactins and reduce custmer service issues. Decline Questinable ATM Transactins: Issuers shuld cnsider declining cards with invalid card verificatin values when the transactin riginates frm an ATM since invalid card verificatin values are rarely seen in ATM transactins. It is immaterial that PIN verificatin may have been successful in this scenari; the issuer shuld nt rely slely n PIN verificatin. Use CVV2 in Risk Prtectin: In additin t using CVV2 t authenticate cards in the card-absent envirnment, issuers shuld cnsider using the number t enhance risk prtectin in ther authenticatin functins, such as verifying cardhlder address changes requested by telephne r verifying new card activatins. Enact Velcity Rules: These rules help identify and stp a brute-frce attack r testing / prbing attacks (when a fraudster may rapidly submit multiple successive lw-value transactins) until the issuer gives authrizatin t btain a valid card verificatin value fr a specific card. Once the fraudsters btain an authrizatin, they will typically cnduct higher-value fraudulent transactins immediately until the issuer detects the suspicius activity.

6 Leverage Applicatin Transactin Cunter (ATC) Check fr Chip Transactins: Issuers shuld mnitr and track the ATC fr chip cards t identify replay attacks by fraudsters. Fr example, a repeat use f the same ATC fr a transactin may indicate such an attack. Issuers that use prven fraud preventin tls and multiple data elements frm authrizatin requests will be better prepared t mitigate fraud acrss their prtflis. Valid values fr POS entry mde can be fund in the BASE I Technical Specificatins, Vlume 1 V.I.P. System. Fr a full descriptin f service cde values, refer t Sectin A.5 Data Element Descriptins in the Payment Technlgy Standards Manual. Cntact yur Visa representative r InfRisk@visa.cm with "Card Data Validatin" in the subject line. Ntice: This Visa cmmunicatin is furnished t yu slely in yur capacity as a custmer f Visa Inc. (r its authrized agent) r a participant in the Visa payments system. By accepting this Visa cmmunicatin, yu acknwledge that the infrmatin cntained herein (the "Infrmatin") is cnfidential and subject t the cnfidentiality restrictins cntained in the Visa Rules, which limit yur use f the Infrmatin. Yu agree t keep the Infrmatin cnfidential and nt t use the Infrmatin fr any purpse ther than in yur capacity as a custmer f Visa Inc. r a participant in the Visa payments system. Yu may disseminate this Infrmatin t a merchant participating in the Visa payments system if: (i) yu serve the rle f acquirer within the Visa payments system; (ii) yu have a direct relatinship with such merchant which includes an bligatin t keep Infrmatin cnfidential; and (iii) the Infrmatin is designated as affects merchants demnstrated by display f the strefrnt icn ( ) n the cmmunicatin. A merchant receiving such Infrmatin must maintain the cnfidentiality f such Infrmatin and disseminate and use it n a need t knw basis and nly in their capacity as a participant in the Visa payments system. Except as therwise prvided, the Infrmatin may nly be disseminated within yur rganizatin n a need-t-knw basis t enable yur participatin in the Visa payments system. Please be advised that the Infrmatin may cnstitute material nnpublic infrmatin under U.S. federal securities laws and that purchasing r selling securities f Visa Inc. while being aware f material nnpublic infrmatin wuld cnstitute a vilatin f applicable U.S. federal securities laws. This infrmatin may change frm time t time. Please cntact yur Visa representative t verify current infrmatin. Visa is nt respnsible fr errrs in this publicatin.