- Overview of ATM transactions (cash withdrawals) in credit card fraud (2016)

Transcription

1

2 CONTENTS PG EXECUTIVE SUMMARY QUALIFICATION OF INFORMATION PAYMENTS ASSOCIATION OF SOUTH AFRICA (PASA) OVERVIEW OF CREDIT CARD FRAUD (-) - Credit card fraud distribution - Credit card gross fraud loss in South Africa - Geographical distribution of credit card fraud OVERVIEW OF DEBIT CARD FRAUD (-) - Debit card fraud distribution - Debit card gross fraud loss in South Africa - Geographical distribution of debit card fraud CARD FRAUD IN THE UK ATM CRIME - Overview of ATM transactions (cash withdrawals) in credit card fraud () - Overview of ATM transactions (cash withdrawals) in debit card fraud () BREAKDOWN OF FRAUD TYPES - Lost and/or stolen card fraud - Not received issued card fraud (NRI) - False application card fraud - Counterfeit card fraud - Account takeover card fraud - Card not present fraud (CNP) 2

3 EXECUTIVE SUMMARY The banking industry s gross fraud losses due to South African (SA) issued credit card fraud increased by 13%, from R331.4m in to R374.4m in Gross fraud losses due to fraud perpetrated with SA-issued debit cards increased by 3.1%, from R333.2m in to R343.5m in 48.0% of all credit card fraud losses occurred in South Africa 79.7% of all debit card fraud losses occurred in South Africa Trends per fraud type in respect of credit and debit card fraud are as follows: Fraud Type Credit Card Debit Card Overall Gross Fraud Loss Lost and/or Stolen Counterfeit CNP (Card Not Present) Cards fraudulently obtained by criminals were used to conduct cash withdrawals at ATMs inside South Africa. 3% of these transactions were credit card related and 62%, debit card. Provinces mostly affected by card fraud are Gauteng, Western Cape and KwaZulu Natal. Both credit and debit card fraud losses decreased in the Western Cape. 3

4 QUALIFICATION OF INFORMATION Credit and debit card fraud information utilised in this report was provided by African Bank, albaraka Bank, Bank of Athens, Barclays Africa Group, Bidvest, Capitec Bank, First National Bank, Investec, Mercantile Bank, Nedbank, Postbank, UBank, Sasfin as well as Standard Bank of South Africa. Statistics used in the report cover the period from 01 January to 31 December. For the comparative analysis, the above-mentioned period was compared to similar periods since, with a focus on to. Information set used: All credit and debit card gross fraud losses reported to SABRIC by 28 February (extracted on 8 March 2017). All calculations were based on the date of the fraudulent transaction. All fraud losses mentioned in this booklet refer to gross fraud losses and do not relate to the nett losses suffered by the banking industry. Fraud loss figures are rounded to the nearest R1 million, unless otherwise stated and therefore, the sum of the separate losses (for example per loss category/fraud types/provinces) may differ from the rounded loss shown. This publication reflects on a full year s data and not a nine (9) month period, as was the case in previous publications. The statistics in the booklet will therefore not correspond with those depicted in previous booklets. 4

5 PAYMENTS ASSOCIATION OF SOUTH AFRICA (PASA) Card payments constituted 61% of all payment transactions processed in South Africa during, with over 60 million Debit Cards and nearly 8 million Credit Cards in circulation. The drive to replace magstripe cards with more secure and improved EMV chip and PIN capable cards continues and over 65% of Debit Cards and more than 90% of Credit Cards are currently chipped. As in other jurisdictions such as the USA, Europe and Australia, card payments in South Africa continue to be a popular and trusted means of payment, but brings with it challenges and opportunities. An increase in the number and severity of data breaches worldwide, the ongoing quests to devalue card data and continued focus on improving authentication methods are only some of the examples of the challenges being dealt with. Fortunately, there is also ample opportunity in the card world, and in South Africa specifically there were a number of developments during. The biggest one was a project that facilitated the world s first truly interoperable biometric specification. This specification allows for biometric verification and is now recognised as the third type of Customer Verification Method (CVM) after signature and PIN. Biometric authentication is intended to prevent fraud as well as make it easier to pay securely. A second opportunity in the South African market worth mentioning is the increased adoption of contactless technology during. Whilst the regulatory framework to allow contactless transactions has been in place since, the adoption of this technology only started showing significant signs of increase during. With a number of larger merchants embracing the new trend of contactless payments and increased contactless card issuance, the conversation around increasing the original contactless transaction limit of R200 has prevailed. The fourth quarter saw the decision to increase the limit to R500 and as a result, both usage and fraud trends will be monitored closely during Whilst traditional fraud trends continue to be monitored and addressed, a number of technology developments have introduced new, non-traditional risks that may need a fresh approach to fraud management. Examples of such developments include the use of electronic wallets with the ability to load card information and facilitate payments, new authentication methods by non-traditional players i.e. Applepay, Samsungpay and the increased introduction of payment applications involving non-traditional players. Efforts to secure the card payment system continue to receive priority attention. These include the adoption and use of 3D Secure for e-commerce transactions and enforcing PCI DSS on System Operators and Level 1 Merchants. The formulation of a framework to address data security for smaller merchant categories has also received attention and a final position is expected in In conclusion, we note that the card payment system continues to develop and as we move towards the future with enthusiasm and expectation, we also have to remember that our number one priority will also be to ensure the system is safe, secure and relevant. Our number one priority is to ensure the South African payment system remains safe, secure and relevant. SABRIC would like to acknowledge PASA for their contribution 5

6 CREDIT CARD FRAUD OVERVIEW OF CREDIT CARD FRAUD ( ) Gross fraud losses due to fraud perpetrated with SA-issued credit cards increased by 13.0%, from R331.4m in compared with R374.4m in. The graphs below depict the industry s gross fraud losses on SA-issued credit cards, irrespective of the geographical location of the fraudulent transaction. Gross fraud loss on SA-issued credit cards (all countries to ). All Figures in (R) Millions Percentage distribution per fraud type on SA-issued credit cards during Lost&Stolen NRI FalseApp Counterfeit TakeOver CNP 4.2% 0.8% 0.5% 26.4% 0.8% 66.8% In the % of distribution per fraud type on SA-issued credit cards during CNP was the highest Gross fraud losses due to fraud perpetrated with SA-issued credit cards increased by 13.0% 6

7 CREDIT CARD FRAUD OVERVIEW OF CREDIT CARD FRAUD ( ) SA-issued credit card gross fraud losses per fraud type, all countries. All Figures in (R) Millions Fraud Type Lost and/or Stolen R26.2m R17.3m R10.7m R8.9m R10.7m R11.6m R15.8m NRI (Not Received Issued) R1.7m R1.2m <R1m <R1m <R1m <R1m R3.1m False Application Fraud R2.4m R15.5m R19.4m R13.7m R93.2m R7.3m R1.9m Counterfeit R97.2m R165.5m R90.8m R119.4m R116.9m R99.0m R99.0m Account Takeover <R1m <R1m R1.5m R2.3m <R1m R1.8m R2.9m CNP (Card Not Present) R81.5m R188.7m R213.8m R238.9m R240.7m R210.4m R250.0m CREDIT CARD FRAUD DISTRIBUTION Credit card gross fraud losses on SA-issued credit card ( to ) inside and outside South Africa. All Figures in (R) Millions Transactions outside South Africa Transactions in South Africa 7

8 CREDIT CARD FRAUD OVERVIEW OF CREDIT CARD FRAUD ( ), 48.0% of all credit card gross fraud losses occurred inside South Africa in comparison with the 44.5% in CNP credit card gross fraud losses increased by 18.9% During, 48.0% of all credit card gross fraud losses occurred inside the borders of South Africa in comparison with the 44.5% in. CNP credit card gross fraud losses increased by 18.9% (R210.4m in to R250.0m in ). CNP fraud remained the biggest contributor to gross fraud losses on SA-issued credit cards (66.8%) during. The majority of the losses (65.1%) associated with CNP credit card fraud occurred outside South Africa. Counterfeit credit card fraud accounted for 26.4% of the gross fraud losses on credit cards. These losses remained stable with R99.0m reported in and. The majority of losses (71.1%) associated with counterfeit credit card transactions, occurred within South Africa. Fraudulent spend with lost and/or stolen cards increased by 36.6% with 82.0% of the transactions occurring in South Africa. SA-issued credit cards are frequently used by criminals in African countries such as Zimbabwe, Namibia, Botswana, Kenya and Lesotho. Most of these transactions are fraudulent cash withdrawals at ATM s. An increase is observed in Mauritius where fraudulent CNP transactions are reported. This emerging trend could relate to the increase in merchants registering their businesses in other countries in order to circumvent rules applicable to South Africa. Five cross border countries with the highest recorded financial losses due to CNP and Counterfeit fraud on SA-issued credit cards during were: Canada <R1m United States R13.4m United States R41.4m United Kingdom R33.4m Netherlands R5.9m United Kingdom R1.9m Cyprus R6.7m China R5.2m China R1.2m Counterfeit CNP Indonesia <R1m 8

9 CREDIT CARD FRAUD OVERVIEW OF CREDIT CARD FRAUD ( ) CREDIT CARD GROSS FRAUD LOSS IN SOUTH AFRICA Credit card gross fraud losses on SA-issued cards used in South Africa, increased by 21.9% from R147.5m in to R179.8m in. Lost and/or stolen credit card gross fraud losses increased by 23.5% in from R10.5m () to R12.9m (). Lost and/or stolen credit card gross fraud losses account for 7.2% of the total credit card gross fraud losses in South Africa. Criminals utilised modus operandi like shoulder surfing, card jamming or card swapping and card theft to circumvent fraud risk mitigation measures implemented by the banking industry. Transactions associated with false applications decreased by 1.0% during with the gross fraud loss decreasing from R6.1m () to R1.8m (). Measures deployed in when online application channels were abused and the positive impact of biometric fingerprint verification utilised by the banks, have proven to be effective and the fraud loss associated with false applications is currently at the lowest level since During increases were observed for NRI (Not Received Issued) and account takeovers. Although the losses related to these fraud types are still relatively small, cards are attractive to criminals since legitimate cards and PINs are obtained through these modus operandi. Counterfeit credit card gross fraud losses inside South Africa increased by 22.7% (from R57.3m in to R70.4m in ). Counterfeit credit card fraud is the second biggest contributor (39.2%) to the overall gross fraud loss on SA-Issued credit cards used in South Africa. Although the overall counterfeit loss figure remained constant from to, a change was observed in the fraudulent spend pattern. The total gross fraud loss for counterfeit was R99.0m in. Of that, 71% (R70.4m) occurred in as opposed to 57.9% (R57.3m) in. CNP fraud committed within South Africa increased by 23.3% from R70.8m in to R87.4m in. A total of 48.6% of the overall gross fraud losses on credit cards used inside South Africa, relates to CNP fraud. SA-issued credit card gross fraud loss, inside SA by fraud type ( to ). All Figures in (R) Millions 150 CNP 120 Account Takeover 90 Counterfeit 60 False Applications 30 NRI (Not Received Issued) 0 Lost / Stolen 9

10 CREDIT CARD FRAUD OVERVIEW OF CREDIT CARD FRAUD ( ) Gauteng, Western Cape and KwaZulu Natal accounted for 85.9% of all credit card gross fraud losses in South Africa. All provinces showed increases, except Western Cape with a decrease of 11.8% GEOGRAPHICAL DISTRIBUTION OF CREDIT CARD FRAUD Gauteng, Western Cape and KwaZulu Natal accounted for 85.9% of all credit card gross fraud losses in South Africa. Gauteng accounts for 57.2% of the credit card gross fraud losses, followed by the Western Cape with 16.1% and KwaZulu Natal with 12.7%. All provinces showed increases during with the exception of Western Cape where a decrease of 11.8% was observed. The biggest increases, when comparing and, occurred in the Eastern Cape (148.0% from R3.5m to R8.7m), North West (127.9% from R1.3m to R2.9m), Northern Cape (95.7% from R to R ) and Free State (89.9% from R to R1.4m). Provincial geographical distribution of credit card gross fraud losses. All Figures in (R) Millions Eastern Cape R1.6m R2.4m R3.4m R2.6m R2.1m R3.5m R8.7m Free State R1.4m <R1m R1.2m <R1m <R1m <R1m R1.4m Gauteng R61.5 R105.9m R78.7m R65.6m R94.9m R75.6m R93.1m KwaZulu Natal R17.9m R10.2m R8.9m R9.4m R12.1m R12.1m R20.6m Limpopo R2.2m R2.7m R2.3m R2.0m R3.8m R3.1m R3.9m Mpumalanga R2.1m R1.5m R1.9m R2.1m R2.6m R3.7m R5.7m Northern Cape <R1m <R1m <R1m <R1m <R1m <R1m <R1m North West R1.6m R2.1m R1.7m R2.2m R1.9m R1.3m R2.9m Western Cape R15.4m R45.8m R40.7m R32.8m R39.7m R29.7m R26.2m Provincial geographical distribution during Eastern Cape Free State Gauteng KwaZulu Natal Limpopo Mpumalanga Northern Cape North West Western Cape 5.4% 0.8% 57.2% 12.7% 2.4% 3.5% 0.2% 1.8% 16.1% 10

11 DEBIT CARD FRAUD OVERVIEW OF DEBIT CARD FRAUD ( ) Gross fraud losses due to fraud perpetrated with SA-issued debit cards increased slightly by 3.1%, from R333.2m in to R343.5m in. The graph below depicts the industry s total gross fraud losses on SA-issued debit cards, irrespective of the geographical location of the fraudulent transaction. Gross fraud loss on SA-issued debit cards (All countries to ). All Figures in (R) Millions Percentage distribution per fraud type on SA-issued debit cards during Lost&Stolen NRI FalseApp Counterfeit TakeOver CNP 56.2% 0.5% 0.05% 25.7% 0.7% 16.8% In the % of distribution per fraud type on SA-issued debit cards during lost&stolen was the highest Gross fraud losses due to fraud perpetrated with SA-issued debit cards increased by 3.1% 11

12 DEBIT CARD FRAUD OVERVIEW OF DEBIT CARD FRAUD ( ) SA-issued debit card gross fraud losses per fraud type, all countries. All figures in (R) Millions Fraud Type Lost and/or Stolen R14.2m R16.5m R21.0m R56.0m R106.2m R138.8m R193.0m NRI (Not Received Issued) <R1m <R1m <R1m <R1m <R1m R1.1m R1.7m False Application Fraud <R1m <R1m <R1m <R1m <R1m <R1m <R1m Counterfeit R202.4m R364.5m R286.9m R211.4m R155.8m R136.0m R88.4m Account Takeover <R1m <R1m <R1m <R1m <R1m R1.6m R2.4m CNP (Card Not Present) R7.7m R19.8m R28.6m R46.5m R61.5m R55.1m R57.6m DEBIT CARD FRAUD DISTRIBUTION Debit card gross fraud losses on SA-issued debit cards ( to ) inside and outside South Africa. All figures in (R) Millions Transactions in South Africa Transactions outside South Africa #WiseUpWatchOut 12

13 DEBIT CARD FRAUD OVERVIEW OF DEBIT CARD FRAUD ( ), 79.7% of debit card gross fraud losses occurred within South Africa compared to 78.6% in Gross losses for counterfeit debit card fraud decreased by 35.0% During, 79.7% of debit card gross fraud losses occurred within South Africa compared to 78.6% in. Debit card gross fraud losses related to CNP increased by 4.6% from R55.1m () to R57.6m (). CNP fraud contributed 16.8% of fraud losses on SAissued debit cards in. This category is expected to grow due to the fact that CNP transactions are now allowed on debit cards and criminals will exploit the opportunity. Gross losses for counterfeit debit card fraud decreased by 35.0% (R135.9m to R88.4m). The majority (74.1%) of all counterfeit debit card transactions occurred within South Africa. Counterfeit debit card fraud is currently the second largest contributor to the overall debit card gross fraud losses, accounting for 25.7% of the gross fraud loss. Lost and/or stolen debit card fraud is the biggest contributor to fraud losses on SA-issued debit cards (56.2%). The majority (97.9%) of all losses related to lost and/or stolen cards occurs within the borders of South Africa. Lost and/ or stolen debit card fraud increased by 39.1% from R138.8m () to R193.1m (). Criminals utilised modus operandi like shoulder surfing, card jamming or card swapping and card theft to obtain genuine cards and PINs and in so doing, avoided detection by fraud risk mitigation measures deployed by banks. SA-issued debit cards are frequently being used by criminals in African countries such as Zimbabwe, Namibia, Zambia, Kenya and Mozambique. Similar to credit cards, these transactions mostly relate to fraudulent cash withdrawals at ATMs. The five countries with the highest recorded financial losses due to CNP and Counterfeit card fraud on SA-issued debit cards during are: United States R4.4m United States R8.2m United Kingdom R7.7m United Kingdom >1m China R1.5m China R2.2m Cyprus R2.9m Luxembourg R1.3m Counterfeit CNP Brazil >R1m Indonesia R3.5m 13

14 DEBIT CARD FRAUD OVERVIEW OF DEBIT CARD FRAUD ( ) DEBIT CARD GROSS FRAUD LOSS IN SOUTH AFRICA Gross losses for debit card fraud on SA-issued cards used in South Africa increased by 4.6% from R261.9m in to R273.8m in. Lost and/or stolen debit card gross fraud losses increased by 39.9% in and accounts for 69.0% of the total debit card gross fraud losses inside South Africa. In an attempt to overcome changes in business processes linked to Chip & PIN cards, criminals proceeded with modus operandi such as shoulder surfing, card jamming or card swapping and card theft. Lost and/or stolen card gross fraud losses are currently at the highest level ever reported and amount to R189.0m for. Debit card gross fraud losses related to CNP decreased by 4.6% inside South Africa. CNP fraud contributed 5.5% to the total fraud losses on SA-issued debit cards in. Gross fraud losses associated with counterfeit debit card fraud inside South Africa decreased by 39.3% (from R107.8m in to R65.5m in ). This decrease is attributed to the implementation of EMV chip cards. The expected side effect is a decrease in counterfeit card fraud with an increase in CNP fraud. Gross fraud losses associated with NRI and account takeovers inside South Africa, reflect the largest percentage increases. NRI increased 65.9% from R () to R1.6m (). Account takeovers increased 46.6% from R1.6m () to R2.4m (). Although these increases are substantial, the losses are low when compared to the other fraud types. However, genuine cards and PINs are attractive to criminals and this modus operandi should therefore be monitored. SA-issued debit card gross fraud loss, inside SA by fraud type ( to ). All Figures in (R) Millions CNP Account Takeover 200 Counterfeit False Applications NRI (Not Received Issued) Lost / Stolen 14

15 DEBIT CARD FRAUD OVERVIEW OF DEBIT CARD FRAUD ( ) Gauteng, the Western Cape and KwaZulu Natal accounted for 67.9% of all debit card gross fraud losses in South Africa Except for Western Cape all provinces showed an increase GEOGRAPHICAL DISTRIBUTION OF DEBIT CARD FRAUD Gauteng, the Western Cape and KwaZulu Natal accounted for 67.9% of all debit card gross fraud losses in South Africa. Gauteng accounts for 40.6% followed by KwaZulu Natal with 17.9% and the Western Cape with 9.4%. The remaining provinces accounted for 32.1% of the gross fraud losses. With the exception of Western Cape, all provinces showed an increase during. Losses in KwaZulu Natal increased by 36.9% (from R32.7m to R44.8m), North West increased by 35.9% (from R12.2m to R16.6m) and Northern Cape increased 34.1% (from R2.3m to R3.1m). Provincial geographical distribution of debit card gross fraud losses. All figures in (R) Millions Eastern Cape R15.2m R39.1m R23.3m R15.8m R15.2m R18.4m R21.7m Free State R4.1m R8.1m R9.1m R8.2m R8.4m R7.9m R9.6m Gauteng R58.9m R119.7m R121.5m R93.8m R91.9m R97.5m R101.5m KwaZulu Natal R23.8m R48.3m R49.4m R33.3m R28.7m R32.7m R44.8m Limpopo R3.9m R7.8m R11.2m R11.5m R12.3m R13.1m R13.4m Mpumalanga R5.7m R12.2m R14.9m R11.9m R10.7m R14.1m R15.8m Northern Cape <R1m R1.2m R1.0m R1.3m R2.1m R2.3m R3.1m North West R4.1m R8.6m R13.9m R11.8m R13.5m R12.2m R16.6m Western Cape R9.6m R25.7m R30.2m R25.3m R28.4m R27.4m R23.5m Gauteng accounts for 40.6% of the gross fraud losses on debit cards Gross fraud losses on debit cards decreased in the Western Cape 15

16 CARD FRAUD IN THE UK According to Financial Fraud Action UK, gross fraud losses on UK cards increased by 18% from January to December, when compared to the same period in. These figures include the losses for debit and credit card fraud. Card not present (CNP) fraud accounted for 70.2% of the total losses and increased by 20% when compared to. Lost and/or stolen card fraud increased by 24.1% and is currently at the highest level ever reported in the UK. The gross loss for this fraud type is the second highest loss category, (with only CNP reporting higher figures). Of the total fraud losses 13.1% can be attributed to lost and/or stolen cards. Counterfeit fraud accounted for 8.0% of the total losses and showed a 5.2% decrease. Not received issued (NRI) and false applications/account takeovers showed increases in the figures. South Africa mirrors the UK trend with increases in CNP and lost and/or stolen card fraud. The decrease in counterfeit fraud was also observed in the South African environment. It is worth noting that NRI, false applications and account takeovers showed increases, which was also seen in South Africa. Card fraud losses in UK-Issued cards ( - ). All figures in ( ) pounds Card not present (CNP) fraud in the UK accounted for 70.2% of the total losses Gross fraud losses on UK cards increased by 18% 1. Source: FRAUD THE FACTS - Financial Fraud Action UK 16

17 ATM CRIME 3% of the gross fraud losses on all SAissued credit cards were reported as cash withdrawals at ATMs The majority of transactions occurred in Gauteng (55.5%) Analysis has highlighted that criminals still prefer cash as proceeds of crime in spite of the anonymity of the digital platforms. Cash withdrawals at ATMs have remained prevalent in South Africa in contrast with jurisdictions like Australia 2 where the number and value of ATM withdrawals dropped for the fourth consecutive year. OVERVIEW OF ATM TRANSACTIONS (CASH WITHDRAWALS) PERTAINING TO CREDIT CARD FRAUD () Three per cent (3%) of the gross fraud losses on all SA-issued credit cards were reported as cash withdrawals at ATMs inside South Africa. Of these losses, 16% were in respect of lost and/or stolen cards. An exceptionally high percentage of the losses related to account takeovers (25.6%) and false applications (27.9%). The majority of transactions occurred in Gauteng (55.5%) followed by KwaZulu Natal (15.3%) and Western Cape (12.1%). Gross fraud loss on SA-issued credit cards - ATM compared to other merchants () ATM Other 3% 97% Provincial geographical distribution on SA-issued credit cards during Eastern Cape Free State Gauteng KwaZulu Natal Limpopo Mpumalanga Northern Cape North West Western Cape 5.5% 1.6% 55.5% 15.3% 1.7% 4.4% 0.8% 3.0% 12.1% 2.Source: Connections & Collaboration APCA Annual Review 17

18 ATM CRIME 52% of all fraud on SA-issued debit cards inside South Africa, were reported as cash withdrawals at ATMs. The majority of transactions occurred in Gauteng (34.8%) OVERVIEW OF ATM TRANSACTIONS (CASH WITHDRAWALS) PERTAINING TO DEBIT CARD FRAUD () Of the total gross fraud loss on all SA-issued debit cards inside South Africa, 52% were reported as cash withdrawals at ATMs. Most of the losses (77%) related to lost and/or stolen cards and 21.9% related to counterfeit cards. Gross fraud loss on SA-issued debit cards, ATM compared to other merchants () Provincial geographical distribution on SA-issued debit cards during Eastern Cape 9.9% Free State 4.5% Gauteng 34.8% KwaZulu Natal 17.4% ATM 52% Limpopo 3.9% Other 48% Mpumalanga 6.5% Northern Cape 1.5% North West 7.3% Western Cape 8.8% The majority of transactions occurred in Gauteng (34.8%) followed by KwaZulu Natal (17.4%) and Western Cape (8.8%). Analysis of card fraud activity in the vicinity of ATMs indicates that most of the cash withdrawals at ATMs are in respect of lost and/or stolen debit cards. A similar geographical distribution per province is noted for fraudulent debit and credit card ATM transactions. Gauteng, the business hub of South Africa, reflected the highest number of transactions followed by KwaZulu Natal and Western Cape. This pattern correlates with the prevalence of financial crimes reported overall in the various provinces. 18

19 BREAKDOWN OF FRAUD TYPES LOST AND/OR STOLEN CARD FRAUD LOST AND/OR STOLEN CARD FRAUD DEFINITION Lost card fraud is a fraudulent transaction that occurs on a valid issued card after the cardholder has lost his/her card, and is no longer in possession of it. Stolen card fraud is performed on a valid issued card that has been stolen from a legitimate owner. LOST AND/OR STOLEN CARD FRAUD TREND Lost and/or stolen credit card fraud increased by 36.6% from R11.6m in to R15.8m in and accounted for 4.2% of the total gross fraud losses on credit cards. The majority (82.0%) of fraudulent transactions occurred inside South Africa. The highest gross fraud losses reported on lost and/or stolen credit cards were in respect of fraudulent cash withdrawals and purchases at liquor stores, service stations, toll plazas and grocery stores. Lost and/or stolen debit card fraud increased by 39.1% from R138.8m in to R193.1m in and accounted for 56.2% of the total gross fraud losses on debit cards. Almost all (97.9%) of the gross fraud losses occurred inside South Africa. The highest gross fraud losses in respect of lost and/or stolen debit card fraud were in respect of cash withdrawals followed by purchases at liquor stores, toll plazas, grocery stores and drinking places (bars). Lost and/or stolen cards can be associated with various crime types including house robberies, hijackings and street robberies. However, a frequently used modus operandi is card jamming or swapping and most prominent in was the theft of cards at ATM sites accompanied with shoulder surfing to obtain the PIN. Criminals use distract and confuse methods to obtain the card and PIN. Every effort is made by the criminals to use the card as quickly as possible before it is cancelled by the legitimate cardholder. Not only is the card used at the ATM, but fraudulent purchases are also made to maximise proceeds of crime Lost and/or stolen credit card fraud ( to ). All figures in (R) Millions Lost and/or stolen debit card fraud ( to ). All figures in (R) Millions 0 #WiseUpWatchOut Always block the pin pad when entering the card pin because your PIN is your personal key to secure banking and it is crucial to keep it confidential on your account Should an ATM retain your card, contact your bank and block your card before you leave the ATM If you are not familiar with the screen layout of the ATM or if it appears that, the machine has been tampered with, do not insert your card 19

20 BREAKDOWN OF FRAUD TYPES NOT RECEIVED ISSUED (NRI) CARD FRAUD NOT RECEIVED ISSUED CARD FRAUD (NRI) DEFINITION Not received issued card fraud relates to the interception of a genuinely issued card before it reaches the customer. Imposters then use the intercepted cards fraudulently. NOT RECEIVED ISSUED CARD FRAUD (NRI) TREND Gross fraud losses for not received issued card fraud increased by 324.1%, from R in to R3.1m in. Gross losses for credit card fraud associated with NRI accounted for 0.8% of the overall credit card losses. Although the percentage increase is high, the associated loss is still relatively low. Not received issued credit card fraud ( to ). All figures in (R) Millions 0 0,5 1,0 1,5 2,0 2,5 3,0 3,5 4,0 Not received issued debit card gross fraud losses increased by 57.5%, from R1.1m in to R1.7m in. Debit card gross fraud losses associated with NRI cards accounted for 0.6% of the overall debit card fraud loss. Again, whilst the percentage increase is high, the associated loss is still relatively low. Not received issued debit card fraud ( to ). All figures in (R) Millions ,5 1,0 1,5 2 This modus operandi places criminals in possession of genuine cards and PIN numbers in some instances and therefore Banks are continuously improving their processes in respect of card collections and PIN activations. Prompt action to collect cards and the reporting of replacement cards that were not received within a reasonable time, can further contribute to mitigation. #WiseUpWatchOut Respond as soon as possible to a bank notification to collect an issued card. If you receive any notification about an issued card which you did not apply for, contact your bank immediately, and follow this up. If you are expecting a replacement card and do not receive it in a reasonable time, alert your bank. 20

21 BREAKDOWN OF FRAUD TYPES FALSE APPLICATION CARD FRAUD FALSE APPLICATION CARD FRAUD DEFINITION False application fraud occurs when a fraudulent transaction is carried out on an account where the card was acquired by falsifying a credit application. FALSE APPLICATION CARD FRAUD TREND During, gross fraud losses associated with transactions following a false application decreased by 74.3% from R7.2m to R1.9m and accounted for 0.5% of the overall credit card gross fraud losses. This highlights even further decreases after the mitigation measures rolled out in. False application credit card fraud ( to ). All figures in (R) Million Losses related to false applications accounted for 0.05% of the total gross fraud loss on debit cards. The gross fraud losses associated with the transactions following a false application for a debit card account, increased slightly from R to R This calculates to an increase of 29.6%, although the values are not so significant. False application debit card fraud ( to ). All figures in (R) Million ,1 0,2 0,3 0,4 0,5 0,6 0,7 0,8 The banking industry continuously evaluates fraud detection and prevention strategies to mitigate the risk associated with false application fraud, and the benefits thereof have been renowned after and is still visible in. Traditional identity fraud modus operandi remain prevalent and forged supporting documentation often accompany false applications for cards. #WiseUpWatchOut Personal information must not be shared on social media as criminals can obtain it easily and use it fraudulently If you suspect any suspicious activity on your account or you receive a statement for an account you did not open, ensure that you contact your bank immediately. Verify all requests for personal information and only give it out when there is a legitimate reason to do so 21

22 BREAKDOWN OF FRAUD TYPES COUNTERFEIT CARD FRAUD COUNTERFEIT CARD FRAUD DEFINITION Counterfeit card fraud is perpetrated with a card that has been illegally manufactured using information stolen from the magnetic strip of a genuinely issued card. In some instances, lost and/or stolen cards and/or old cards are re-encoded with information stolen from a genuine card for purposes of committing counterfeit card fraud. The information needed for a counterfeit card is usually stolen through card skimming. COUNTERFEIT CARD FRAUD TREND Counterfeit credit card fraud decreased slightly by 0.03% in (from R99.04m to R99.02m) and contributed 26.4% of the overall credit card gross fraud loss. Most of the counterfeit credit card losses (71.1%) occurred inside South Africa. The percentage of losses occurring outside South Africa decreased by 31.4%, with the losses inside South Africa increasing by 22.8% during compared to. The highest gross fraud losses in respect of counterfeit credit card fraud related to purchases at grocery stores, cash withdrawals at ATMs, purchases at department stores, liquor stores and service stations Counterfeit credit card fraud ( to ) All figures in (R) Million Counterfeit debit card fraud decreased by 35.0% in and the gross fraud loss decreased from R135.9m in to R88.4 in. Counterfeit debit card fraud accounted for 25.7% of the total gross fraud loss on debit cards. The majority of these losses (74.1%) occurred inside South Africa The highest gross fraud losses related to counterfeit debit card fraud relate to purchases at grocery stores, department store, clothing and liquor stores, followed by cash withdrawals. Counterfeit debit card fraud ( to ) All figures in (R) Million Although counterfeit card fraud is no longer the greatest fraud loss category, it remains of concern as it still accounts for a large portion of the gross fraud losses. Criminals are currently abusing the fall back option, resulting in an increase seen in the number of transactions occurring inside South Africa and more so related to POS transactions.this is particularly noteworthy in transactions related to credit cards The skimming of cards to obtain card information remains a prevalent modus operandi, irrespective of the methodology used be it with Point Of Sale (POS), ATM mounted or handheld skimming devices. Card skimming involves the illegal copying of encoded information from the magnetic strip of a legitimate card by means of a card reader with the intention of using the data for encoding counterfeit, lost, or stolen cards to transact fraudulently

23 BREAKDOWN OF FRAUD TYPES COUNTERFEIT CARD FRAUD POINT OF SALE (POS) SKIMMING DEVICES POS skimming devices were retrieved in South Africa for the first time in. In, a total of 30 POS skimming devices were recovered by the South African Police and bank investigators. These devices were retrieved in Gauteng (22) and Western Cape (8) respectively. POS skimming devices retrieved ( to ) Lost&Stolen 4.2% NRI CNP 0.8% % Provincial distribution of POS skimming devices retrieved during Western Cape Gauteng 8 22 Criminals steal legitimate POS devices and then illegally convert them into skimming devices. These POS skimming devices are used to skim bank card information of unsuspecting victims. 23

24 BREAKDOWN OF FRAUD TYPES COUNTERFEIT CARD FRAUD ATM MOUNTED SKIMMING DEVICES For, a total of 15 ATM mounted skimming devices were recovered by the banking industry and law enforcement. ATM mounted skimming devices retrieved ( to ). All figures in (R) Millions ATM mounted skimming devices were retrieved in Gauteng (7), Mpumalanga (6) and North West (2). Provincial distribution of ATM mounted skimming devices retrieved in For, a total of 15 ATM mounted skimming devices were recovered

25 BREAKDOWN OF FRAUD TYPES COUNTERFEIT CARD FRAUD ATM MOUNTED SKIMMING DEVICES ATM clients are encouraged to lookout for foreign objects attached to ATMs and urged to always conceal their PIN when transacting. ATM mounted skimming devices are not easily recognisable as they are manufactured to match the look and feel of the ATM. An increase in detection by consumers has however, been noted and can be correlated to the consistent awareness created by the banking industry. The vigilance of consumers is contributing positively to the detection of ATM mounted skimming devices. The camera captures the PIN, and the ATM card reader captures the card data Pin hole camera CARD SKIMMING WITH HANDHELD DEVICES Fitted ATM card reader A total of 31 handheld skimming devices were recovered in by either the South African Police or bank investigators. Handheld skimming devices retrieved ( to )

26 BREAKDOWN OF FRAUD TYPES COUNTERFEIT CARD FRAUD HANDHELD SKIMMING DEVICES During, the majority (19) of these devices were recovered in Gauteng. Eight in KwaZulu Natal, two in North West and one in Mpumalanga and Western Cape respectively. Provincial distribution of retrieved handheld skimming devices The images below are examples of handheld skimming devices. Despite the exponential evolution of technology, these devices have not changed much in recent years. Criminals are still using handheld skimming devices that fit into the palm of your hand and can easily be concealed. The public is urged to report any individuals known to be importing or using these devices to compromise card data, to the South African Police. #WiseUpWatchOut Do not allow anyone to swipe your card on a small black device unknown to you If you are interfered with whilst transacting at an ATM, your card may have been skimmed by being removed and replaced back into the ATM without your knowledge Ensure that you cancel the transaction immediately Report the incident using your bank s Stop Card Toll free number Always cover the PIN Pad when entering the card pin 26

27 BREAKDOWN OF FRAUD TYPES ACCOUNT TAKEOVER CARD FRAUD ACCOUNT TAKEOVER CARD FRAUD DEFINITION Account takeover fraud takes place when an existing account is taken over by someone posing as the genuine account holder, who then uses the account for their own benefit whilst pretending to be the genuine account holder. The common denominator for both Account Takeover fraud and False Application fraud is the fraudsters access to the personal information of their victims by obtaining personal or client-specific information and pretending to be the client in order to apply for a replacement card which is then, once received, used fraudulently. ACCOUNT TAKEOVER CARD FRAUD TREND Credit card gross fraud losses associated with account takeover fraud increased by 63.0% (from R1.8m in to R2.9m in ). Account takeover fraud accounted for 0.8% of the overall credit card losses. Account takeover credit card fraud ( to ). All figures in (R) Millions 0 0,5 1,0 1,5 2,0 2,5 3 Debit card gross fraud losses associated with account takeover fraud increased by 49.6% (from R1.6m in to R2.4m in ). Account takeover fraud accounted for 0.7% of the total gross fraud loss on debit cards. Account takeover debit card fraud ( to ). All figures in (R) Millions 0 0,5 1,0 1,5 2,0 2,5 These are substantial percentage increases and the fact that the losses are relatively low when compared to the other fraud types, it should not be considered tolerable. Monitoring is essential as the cards are in demand by the criminals, since legitimate cards and PINs are obtained. The rise in account takeover card fraud is in line with increasing identity theft trends. #WiseUpWatchOut Only give 210 out your bank card number or other sensitive information on calls that you initiate to your bank s 180 customer service division Keep your transaction slips and check them against your statement to spot any suspicious transactions which if found, must be queried 50 with your bank immediately Avoid returning calls to a phone number left on your answering services, rather contact the bank via the numbers provided on the card or the website of the bank 3 27

28 BREAKDOWN OF FRAUD TYPES CARD NOT PRESENT FRAUD CARD NOT PRESENT FRAUD DEFINITION CNP fraud is a fraudulent transaction where neither the card nor the cardholder is present whilst conducting transactions. These transactions occur when retailers are unable to check the card or the identity of the cardholder and can be conducted under the following circumstances: orders for goods placed telephonically; purchases conducted via the internet; by mail order or fax. CNP fraud is generally concluded with fraudulently obtained card data and personal information and sourced by various means such as discarded receipts, previous CNP purchases and phishing. 0 0,5 1,0 1,5 2,0 2,5 3 CARD NOT PRESENT FRAUD TREND Gross fraud losses for CNP credit card increased by 18.9% from R210.4m in to R250.0m in and contributed 66.8% of the total credit card gross fraud losses in. This is the highest level of CNP fraud reported to SABRIC, with the second highest being R240.7m gross losses reported in. A total of 65.1% of the gross fraud losses relates to transactions outside of South Africa, with the remaining 34.9% having occurred at South African merchants. The highest gross fraud losses regarding CNP credit card fraud were in respect of tourism and hospitality services including airline tickets, travel agencies, vehicle hire and hotel accommodation as well as direct marketing. During, the gross fraud loss associated with CNP fraud on debit cards amounted to R57.7m, and contributed 16.8% of the total gross fraud loss on debit cards. CNP gross fraud losses increased from R55.1m in to R57.7m in. The majority of these transactions (73.7%) occurred at merchants outside of South Africa, with the remaining 26.3% occurring at South African 300 merchants. 270 The highest gross fraud losses related to CNP debit card fraud, was also linked 240 to the travel industry and included i.e. airline tickets, vehicle hire and hotel accommodation. 210 The increase 180in CNP fraud is a trend noted in EMV compliant countries such as the UK and South Africa is following a similar pattern. The 150implementation of 3D secure at many South African online merchants could be a contributing factor for 120 the move towards the South African cards used at non-south African merchants. 90 CNP fraud on debit cards is expected to increase as CNP transactions are now allowed on debit cards. 60 Criminals source data to perpetrate CNP fraud using various 30 modus operandi including but not limited to phishing scams, vishing, malware 0 and data breaches. CNP credit card fraud ( to ). All figures in (R) Millions ,5 1,0 1,5 2,0 2, CNP debit card fraud ( to ). All figures in (R) Millions #WiseUpWatchOut Ensure that your bankcards are registered for 3D Secure contact your bank for more information on 3D Secure registration. Ensure you only place orders with your card on a reputable and secure website when shopping online s 194that quote card numbers and expiry dates should never be sent nor should this information be disclosed 237 telephonically. 28

29 SabricZA