Invasion of the Payments Snatchers: Strategies for Fighting Payment Fraud

Transcription

1 Invasion of the Payments Snatchers: Strategies for Fighting Payment Fraud Stephanie M Fuoco Director, Risk Payment Office Card Services at Fiserv Richard Maier AVP/Loss Prevention Auditing MIDFLORIDA Credit Union

2 Agenda Understanding Payment Fraud Current market fraud trends EMV and fraud Strategies to Fight Back MidFlorida Credit Union Testimonial

3 CURRENT MARKET FRAUD TRENDS

4 Merchant Processor 7 th largest USA merchant processor Estimated 1.2MM cards at risk Social engineering (spear-phishing) Revoked PCI compliance in response to this breach

5 Other Processor Breach An acquirer processor with a presence in bill payment processing Merchant processor has taken steps to control access to its data Result of poor controls over database SQL injection >250 merchants associated with breach Exposure on confirmed fraud cases from 05/11 02/12, control gap was existent from 2006

6 Force Posted Transactions Pirating POS social engineering attacks spear-phished credentials replacing legitimate acquiring bank with offshore financial institutions Force post transactions at high velocity over short timeframes Illicit funds arriving at acquiring bank are loaded to prepaid cards for cash out at ATMs in Eastern Europe Issuer is not at risk as the transaction has chargeback rights. Merchants must ensure proper employee training to avoid this type of fraud

7 Malware Mobile malware on Android devices is growing at a 472% Modified variant of ZeuS divert post-transaction verification phone calls Ice IX manipulates content and injects rogue forms into online banking websites Cridex, similar to ZeuS, bypasses security controls to send out s Fraud as a Service Fraud call centers, money mules, proliferation of malware custom tailored to your spec

8 Skimming $1.5 million ATM skimming scheme targeted top banks in New York, Chicago and Miami. In 2011 debit fraud outpaced credit fraud. The reason - ATM skimming. In 2010, ADT Security Solutions estimated losses $30K per ATM skimming incident In 2011, this average jumped to nearly $50K per incident 2012 fraud losses are expected to increase ATMs are usually the last to be upgraded

9 Number of Victims and Incidence Rate of Fraud, Source: Javelin Strategy and Research, 2012 Identity Fraud Report: Social Media and Mobile forming the New Fraud Frontier, February 2012

10 How Information Was Obtained by the Perpetrator, 2011 Source: Javelin Strategy and Research, 2012 Identity Fraud Report: Social Media and Mobile forming the New Fraud Frontier, February 2012

11 Information Available on Social Network Profiles by Privacy Setting, 2011 Source: Javelin Strategy and Research, 2012 Identity Fraud Report: Social Media and Mobile forming the New Fraud Frontier, February 2012

12 Cases Resolved by Fraud Type, Source: Javelin Strategy and Research, 2012 Identity Fraud Report: Social Media and Mobile forming the New Fraud Frontier, February 2012

13 EMV AND FRAUD

14 EMV Impact on European ATM Fraud Migration UK Post-EMV Card Fraud by Type 350 UK Post EMV Card Fraud by Type Euros (Millions) Card-not-present Counterfeit Lost/stolen Mail Non-receipt Card ID Theft Source: E.A.S.T. ATM Fraud Analysts Report 2011 Source: UK CARDS Association, Financial Fraud Action UK, 2010 EMV significantly reduced card-present lost/stolen/counterfeit card fraud in Eurozone s predominantly offline environment EMV rollout in Europe begins in % increase in mitigation of fraud losses in ATM channel However fraud migrated to Card-not-Present channels (online, phone)

15 Fraud Implications for U.S. EMV significantly reduced card-present lost / stolen / counterfeit fraud in U.K. Card payments in U.K. have historically been offline vs. U.S. s almost 100% online approach U.K. card fraud reached as high as $5 billion before EMV UK Cards Association reports that card fraud fell to about $571 million in 2010 U.S. stands to gain less from fraud reductions U.S. card fraud losses totaled $3.56 billion in 2010 an average of $2.40 per card Plus $8-$12 average dispute processing expense per case Analysts warn that the U.S. may become the primary target for card-present fraud

16 August 2011: Announced incentives, mandates and dates for U.S. acquirer support of EMV and NFC contactless Requires U.S. acquirer processors and service providers to support merchant acceptance of chip transactions no later than April 1, 2013 U.S. liability shift for counterfeit card-present POS transactions, effective October 1, 2015 (October 1, 2017 for automated fuel dispensers) September 2011: Announced extension to U.S. of existing liability shift program active in many regions for Maestro ATM transactions Effective April 19, 2013, EMV liability shift program for inter-regional Maestro ATM transactions will include both U.S. and Asia-Pacific regions

17 STRATEGIES TO FIGHT FRAUD

18 R.E.A.C.T Respond Effectively Against Criminal Transactions A comprehensive product base of essential risk products to help financial institutions implement and manage an effective card fraud risk program for debit, prepaid and credit portfolios Fiserv Risk Solutions Transaction Case Management Real-Time Decisioning Transaction Blocking Case Management Compromised Card Management EnFact SM Case Management RuleManager SM Transaction Blocking CaseTracker SM CardTracker SM Enhanced Chargeback Enhanced Services Full Service Call Center

19 EnFact SM (Case Management) EnFact Real-Time TranBlocker SM RuleManager SM CardTracker SM CaseTracker SM Enhance Chargebacks Full Service Call Center (Chargeback) Risk Management Tools (Electronic Decision) Real Time (Decision) Authorize/ Deny Risk Office SM (Human Decision)

20 FISERV PERFORMANCE MIDFLORIDA CREDIT UNION

21 MIDFLORIDA Credit Union Headquartered in Lakeland, Fla., MIDFLORIDA serves more than 150,000 members with assets over $1.6 billion through a network of 32 branches, 40 ATMs, and through its website, midflorida.com. MIDFLORIDA Credit Union provides banking services to anyone who lives, works, worships or attends school within their service area of 14 Central Florida counties.

22 Orlando Tampa The Triangle Miami

23 I wish I may, I wish I might, Have this wish. I wish No More Reissues No Data Breaches No Fraud

24

25 RISK OFFICE FRAUD TOOLS TranBlocker EnFact Real Time Scoring Compromised Card Tracker CaseTracker

26 BENEFITS OF RISK OFFICE Efficiently manage real time and TranBlocker rules Establish custom rules based on current fraud trends Assist with the investigation of the cause of the fraud

27 MIDFLORIDA s RISK OFFICE SUCCESS

28 RETURN ON INVESTMENT

29 IN SUMMARY

30 Fraud Attacks are more rapid and targeted with higher chance of success EMV will take time and fraud already highest in Card Not Present Fraud (virtualization of payment channels) End-to-End Risk Management is yielding 50% better results than national average (people are the best tools to fight against malicious threats) We are saving millions every month in fraud avoidance with our end-to-end management of fraud

31 Average Basis Points Across Clients' Monthly Reported Fraud (Risk Office vs. Non-Risk Office) Average Basis Points of Reported Fraud Non Risk Office Risk Office Industry Average Logarithmic Trend Line of Non Risk Office Fraud Reported Month Clients not utilizing Fiserv Risk Solutions have an average of 6.98 basis points of fraud loss The risk market average of fraud losses to total transaction dollars is 9.0* basis points Clients utilizing the FULL Fiserv Risk Solution suite of products and services have an average of 3.19 basis points *Source Federal Register, 7/11/2011

32 Stephanie Fuoco