2020 Foresight: Best Practices in Managing Credit Risk Cycle

Transcription

1 2020 Foresight: Best Practices in Managing Credit Risk Cycle Product Code: VR0913MR Published Date: April

2 TABLE OF CONTENTS TABLE OF CONTENTS 1 Executive Summary Credit Card Fraud Dynamics Global Snapshot of Card Fraud Card fraud hotspots around the world Card fraud in developed and emerging economies Overview of Card Fraud and its Impact Types of card fraud Ramification of card fraud Challenges in Managing Credit Card Risks Macroeconomic challenges Regulatory challenges Operational challenges Emerging Trends in Managing Credit Card Risk Role of Government and Credit Bureaus in Managing Credit Card Risk Global developments Europe North America Asia-Pacific Other key countries Trends in Risk Management at Financial Institutions and Service Providers Issuers and acquirers Network providers Merchants Best Practice Framework in Credit Card Risk Management Risk Management Framework Issuers Acquirers Network providers Merchants Best Practices Case Studies Adoption of modern tools and analytical applications Best practices adoption of innovative products Best practices adoption of EMV Chip-PIN technology Best practices third party expertise to manage delinquencies Appendix Late Payments and Non-Payments Types of delinquency Key reasons for delinquencies Non-payments Methodology Background Foresight: Best Practices in Managing Credit Risk Cycle Page 2

3 TABLE OF CONTENTS 5.4 Contact Us About Timetric Disclaimer Foresight: Best Practices in Managing Credit Risk Cycle Page 3

4 LIST OF FIGURES LIST OF FIGURES Figure 1: Credit Card Fraud Dynamics... 8 Figure 2: High Risk Zones... 9 Figure 3: Card Fraud in Developed Economies (US$ Million), Figure 4: Card Fraud in Developing Economies (US$ Million), Figure 5: Key Challenges in Managing Credit Card Risks Figure 6: Real GDP Growth (%), Figure 7: Unemployment Rates in Developed Economies (%), Figure 8: Unemployment Rates in Emerging Economies (%), Figure 9: Trends in Credit Card Risk Management Figure 10: Key Regulatory Developments Figure 11: Credit Ratings and Requirements Figure 12: Adoption of Risk Management Tools Figure 13: Launch of Contactless Cards Worldwide, Figure 14: Worldwide Contactless Card Market Size, Figure 15: Online Security Device Figure 16: Emergence of Charge Cards (Million), Figure 17: Overview of PCI Data Security Standards Figure 18: PIN Entry Device Security Requirements Figure 19: Payment Application DSS Requirements Figure 20: Verified by Visa and MasterCard SecureCode Figure 21: Best Practice Framework in Credit Card Risk Management Figure 22: Best Practices For Issuers Figure 23: Best Practices For Acquirers Figure 24: Best Practices For Network Providers Figure 25: Best Practices For Merchants Figure 26: The Case of CartaSi Figure 27: The Case of Banco BHD Figure 28: The Case of China Merchants Bank Figure 29: Key SAS Products Figure 30: The Case of Viseca Card Services SA Figure 31: Falcon Fraud Manager Figure 32: The Case of Hong Leong Bank Figure 33: The Case of Intesa Sanpaolo Card Figure 34: BankAmericard Secured Credit Card Features Figure 35: The Case of Bank of America Figure 36: Key Features of izettle s EMV Chip-PIN Card Reader Figure 37: The Case of Visa and izettle Figure 38: Key Features and Benefits of CUCollect TM Credit Card Collections Solution Figure 39: The Case of HEWFCU Figure 40: Delinquency Levels and Risk Figure 41: Recessions and Delinquencies in the US Foresight: Best Practices in Managing Credit Risk Cycle Page 4

5 LIST OF TABLES LIST OF TABLES Table 1: Card Fraud in Developed Economies (US$ Million), Table 2: Card Fraud in Developing Economies (US$ Million), Table 3: Real GDP Growth (%), Table 4: Unemployment Rates in Developed Economies (%), Table 5: Unemployment Rates in Emerging Economies (%), Table 6: Charge Card Industry Market Size (Million), Foresight: Best Practices in Managing Credit Risk Cycle Page 5

6 EXECUTIVE SUMMARY 1 Executive Summary Credit cards are one of the most important methods of payment in the current financial system. They are extensively used for purchasing items at retail stores, online stores, to pay utility bills and make payments for a range of other services. When a card issuer issues a credit card to a person, it is considered to be an extension of a loan facility. However, as with other types of loan, loans extended through credit cards also suffer from credit risks such as defaults on timely payment or no payments at all. Moreover, the convenience offered by credit cards to make payments is also exploited for fraudulent activities, resulting in the loss of millions of dollars every year around the world. In order to control and limit these risks and losses, a proper risk management framework is required to be established. This report highlights some of the major concerns and challenges in addressing those issues and current trends around the globe in managing credit card risks. It also provides case examples of the best practices adopted by card issuers and other participants of the card payment industry. Growth in card fraud in emerging economies outbids developed markets Although card fraud is much higher in value terms in developed economies such as the US, the UK and France, these countries have been successful in limiting the growth of fraud by adopting advanced security measures, innovative products and strict regulations. Emerging economies like China and Russia have lagged behind in introducing such measures and have therefore witnessed significant growth in card fraud. Among the developed markets, the value of card fraud was highest in the US, where it increased from US$X.XX billion in 2008 to US$X.XX billion in 2012, growing at a CAGR of X.XX% during the review period. It was followed by France whose card fraud value increased from US$XXX.X million in 2008 to US$XXX.X million in 2012, recording a CAGR of X.XX% during the review period. Among the emerging markets, the value of card fraud in China increased from US$XX.X million in 2008 to US$XXX.X million in 2012, at a staggering CAGR of XX.XX%. China was followed by Brazil with a card fraud value of US$XXX.X million in 2012 while, in terms of growth, Russia gained the second spot with a CAGR of XX.XX%. Credit card industry faces a number of challenges in managing risks The major challenges in managing credit card risks can be categorized into three broad sections: macroeconomic challenges, regulatory challenges and operational challenges. Macroeconomic challenges represent factors such as weak economic growth and high unemployment rates that affect the population s financial abilities. Regulatory challenges are the result of change in rules and regulations and the legal environment of a country, while operational challenges are associated with the operational structure of an organization such as its policies, infrastructure and investments. Government regulations around the globe are aiding in the management of credit card risks Governments, credit bureaus and financial institutions have tried to control credit card risks such as fraud, delinquencies and non-payments by introducing several necessary regulations. Regulations such as the single euro payment area card framework (SEPA) and the anti-money laundering regulation have indirectly helped in the managing of these risks. Other measures taken by regulatory bodies include restriction on issuance of credit cards to high risk customers, increase in age requirement, high income requirement for issuance of a credit card, and a limit on the number of cards a consumer can have. Card issuers and other market players are managing risks by adopting innovative solutions Over the period of last five years, card issuers, acquirers, merchants and network operators have adopted and implemented a host of security measures, regulations and business strategies to lower the chances of fraud and credit losses. These measures include adoption of EMV chip and PIN credit cards, anti-skimming technologies, requirement of guarantors for high risk customers, use of secured credit cards and charge cards, behavior analysis and scoring, high-end security for online shopping such as virtual keypads, SMS verifications and one-time passwords Foresight: Best Practices in Managing Credit Risk Cycle Page 6

7 EXECUTIVE SUMMARY Development of an effective risk management framework The management of risk associated with credit cards requires continuous efforts from every participant of the card payment industry such as card issuers, acquirers, network providers and merchants. However, to do so, development of a best practices framework is of utmost importance. A well developed framework facilitates a better understanding of risks and areas which require attention from the intended parties, and formulates strategies to address them. A good risk management strategy is likely to include policy development, adoption and implementation of the policies, process review at regular intervals and infrastructure development Foresight: Best Practices in Managing Credit Risk Cycle Page 7

8 CREDIT CARD FRAUD DYNAMICS 2 Credit Card Fraud Dynamics Credit card fraud has long been presenting challenges for the card payment industry. Broadly speaking, it encompasses a number of malicious activities such as card theft, fund transfers and use of stolen information to make payments not authorized by the genuine cardholder. Fraud can be classified under card present and card not present categories. Card present fraud generally includes fraud at POS terminals and ATMs where the card is physically present and the purchase is made through stolen and skimmed cards. Card not present fraud is synonymous with online trading and internet banking, and includes phishing attacks and pharming to obtain sensitive data. Figure 1: Credit Card Fraud Dynamics Source: Timetric analysis Timetric Although financial charges due to credit card fraud affect financial institutions, merchants and cardholders, its impact is most severe for merchants. Losses due to credit fraud for merchants are nearly 10 times higher than those for financial institutions and around 20 times higher than for cardholders. This is mainly due to the higher absorption level of credit losses by merchants emanating from unauthorized transactions, fees and the interest associated with chargebacks Foresight: Best Practices in Managing Credit Risk Cycle Page 8

9 CREDIT CARD FRAUD DYNAMICS 2.1 Global Snapshot of Card Fraud This section presents a global snapshot of card fraud by taking examples from both developed and emerging economies with their top level card fraud statistics, most of which is driven by credit cards. It also highlights the trend that countries adopting new technologies, products and strict regulations perform better in controlling card fraud than other countries that lag behind in such efforts. Locations considered as high risk zones for card fraud have also been highlighted in this section, providing merchants with a better idea of where to be extra careful in dealing with orders Card fraud hotspots around the world The following figure highlights some of the countries and regions considered to be high risk zones regarding card fraud (especially online fraud). Most of the countries depicted in the map are emerging economies that have lagged behind in updating their security measures and follow relatively loose regulatory regimes. Figure 2: High Risk Zones Source: Timetric analysis Timetric 2020 Foresight: Best Practices in Managing Credit Risk Cycle Page 9

10 CREDIT CARD FRAUD DYNAMICS Card fraud in developed and emerging economies This section analyzes card fraud at ATMs and POS terminals in developed markets such as the US, the UK, France and Japan, as well as in emerging markets such as India, China and Brazil. Developed economies The value of card fraud remained the highest in the US, increasing from US$X.XX billion in 2008 to US$X.XX billion in 2012, after registering a CAGR of X.XX% during the review period. It was followed by France whose card fraud value increased from US$XXX.X million in 2008 to US$XXX.X million in 2012, after increasing at a CAGR of X.XX% during the review period. In terms of growth, card fraud grew at a rapid pace in Australia at a CAGR of XX.XX% due to the rapid expansion of online trade. According to a report on e-commerce by the Australian Communications and Media Authority, XX% of internet users purchased goods or services online between January and April Table 1: Card Fraud in Developed Economies (US$ Million), CAGR US X,XXX.X X,XXX.X X,XXX.X X,XXX.X X,XXX.X X.XX% UK X,XXX.X XXX.X XXX.X XXX.X XXX.X -XX.XX% France XXX.X XXX.X XXX.X XXX.X XXX.X X.XX% Australia XXX.X XXX.X XXX.X XXX.X XXX.X XX.XX% Japan XXX.X XXX.X XXX.X XX.X XX.X -X.XX% Source: Timetric analysis Timetric Figure 3: Card Fraud in Developed Economies (US$ Million), Source: Timetric analysis Timetric 2020 Foresight: Best Practices in Managing Credit Risk Cycle Page 10

11 CREDIT CARD FRAUD DYNAMICS Developing economies The value of card fraud in China increased from US$XX.X million in 2008 to US$XXX.X million in 2012, at a CAGR of XX.XX% during the review period. China was followed by Brazil with a card fraud value of US$XXX.X million while, in terms of growth, Russia gained the second spot with a CAGR of XX.XX%. Card fraud in China was driven by rising income levels, card penetration and the expansion of online trade. The revenue generated from e-commerce valued at US$X.X billion in 2011 and the category posted a growth rate of XX.XX% on an annual basis. With rising e-commerce activities, card not present fraud has witnessed tremendous growth, despite the decline of card present fraud. Table 2: Card Fraud in Developing Economies (US$ Million), CAGR China XX.X XX.X XX.X XXX.X XXX.X XX.XX% Brazil XXX.X XXX.X XXX.X XXX.X XXX.X -X.XX% Russia XX.X XX.X XX.X XX.X XXX.X XX.XX% India X.X X.X X.X X.X X.X -X.XX% Timetric Figure 4: Card Fraud in Developing Economies (US$ Million), Source: Timetric analysis Timetric 2020 Foresight: Best Practices in Managing Credit Risk Cycle Page 11

12 CREDIT CARD FRAUD DYNAMICS 2.2 Overview of Card Fraud and its Impact This section of the report provides information on the different types of card fraud and the possible ways a fraudster engages in them. It discusses fraudulent activities that start from the application stage to unauthorized purchases at brick and mortar stores, as well as online stores, and includes the various methods used by fraudsters to steal a person s identity and other sensitive information. The section also discusses the levels of impact a fraudulent activity can have on issuers and acquirers, merchants and cardholders, and explains why the effect is more severe for merchants than for cardholders Types of card fraud This section discusses the various types of fraud associated with credit cards, ranging from application fraud to card skimming, and from merchant fraud to online fraud. Identity theft to acquire a valid credit card Fraudsters generally engage in two types of identity theft: Application fraud manifests when an applicant provides false information to obtain a credit card. The fraudster usually assumes the identity of another person to open an account in his or her name on the basis of information stolen from that person. Some fraudsters also provide false documents which suggest their income levels to be much higher than the actual income. Account takeovers happen when a fraudster hijacks an existing account of a genuine customer. This is done by stealing personal information such as the account number or the credit card number. Once such information is acquired, the fraudster contacts the card issuer, impersonating the genuine customer and requests the diversion of mail to a new address. The fraudster then reports the card as lost and requests a replacement, thereby gaining access. Once the fraudster gets hold of the card, it is used for both card present and card not present fraud, and the person whose identity has been compromised finds themselves in trouble, along with the merchant and issuers due to the litigation and credit loss involved Foresight: Best Practices in Managing Credit Risk Cycle Page 12

13 CREDIT CARD FRAUD DYNAMICS 2.3 Challenges in Managing Credit Card Risks The major challenges in managing credit card risks can be categorized into three broad sections: macroeconomic challenges, regulatory challenges and operational challenges. Macroeconomic challenges represent factors such as weak economic growth and high unemployment rates which affect the financial abilities of a person. Regulatory challenges are the result of change in rules and regulations and the legal environment of a country, while operational challenges are associated with the operational structure of the organization such as policies, infrastructure and investments. Challenges, as a result of movement in macroeconomic fundamentals and regulatory changes, are external in nature and a credit card issuer cannot influence them on their own, rather they need to mould themselves according to the external business environment by adopting innovative solutions to manage risks. However, operational challenges are part of the internal business structure of the firm and can be dealt with by making gradual changes to the business structure of the organization. Figure 5: Key Challenges in Managing Credit Card Risks Source: Timetric analysis Timetric 2020 Foresight: Best Practices in Managing Credit Risk Cycle Page 13

14 EMERGING TRENDS IN MANAGING CREDIT CARD RISK 3 Emerging Trends in Managing Credit Card Risk Risk management for credit cards is an ongoing process as the dynamic nature of its problems requires continuous efforts and attention. Effort is required at every level of the card payment system, and from every participant of the value chain, including regulators, card issuers, acquirers (merchant s bank or a financial institution which manages merchant s funds), network providers such as Visa and MasterCard, and merchants. Regulators and governments in every major economy are coming up with strict measures to control card fraud and the issuance of credit cards to high-risk customers such as students, financially dependent persons and retired people. Regulatory norms have also increased income requirements for the issuance of credit cards and place an emphasis on increased customer due diligence. Issuers and acquirers are resorting to behavioral analysis and other methods of screening using powerful analytical tools to eliminate potential high-risk customers and suspicious activities. In such cases, they now require financial guarantees before issuing a credit card or resort to credit cards with financial backing or collateral. Moreover, to reduce their exposure to credit card debts, issuers regularly engage in securitization credit card receivables to hedge their risk. Network providers, on the other hand, have come up with Payment Card Industry (PCI) security standards and are promoting the use of EMV chip and PIN-based credit cards which offer a higher level of protection in comparison to magnetic stripe-based cards. Merchants are also increasingly adopting POS terminals and applications which conform to Payment Card Industry Data Security Standard (PCI DSS) norms and adding extra layers of security to protect their websites Foresight: Best Practices in Managing Credit Risk Cycle Page 14

15 EMERGING TRENDS IN MANAGING CREDIT CARD RISK 3.1 Role of Government and Credit Bureaus in Managing Credit Card Risk The increasing use of plastic for payment purposes and the rising risks associated with them have attracted the attention of regulatory authorities around the world. Credit cards, which hold a majority share in the card industry, are vulnerable to various risks ranging from defaults on payments to card present and card not present fraud. Governments, credit bureaus and financial institutions have tried to keep fraud under control by introducing several necessary regulations over the years. Regulations such as the single euro payment area card framework (SEPA) and the anti-money laundering (AML) regulation have indirectly helped in the managing of these risks. In this section, some of the emerging trends which, intentionally or unintentionally, contributed to the management of the credit card risk cycle are discussed Foresight: Best Practices in Managing Credit Risk Cycle Page 15

16 EMERGING TRENDS IN MANAGING CREDIT CARD RISK 3.2 Trends in Risk Management at Financial Institutions and Service Providers This section covers emerging trends in the management of credit card risks from the point of view of key participants of the payment industry, i.e. card issuers, acquirers, network operators and merchants. Over the past few years, industry participants have adopted and implemented a host of security measures, regulations and business strategies to lower the chances of fraud and credit losses. The following figure highlights the adoption levels of some of the risk management strategies in key regions of the world. Figure 6: Adoption of Risk Management Tools Source: Timetric analysis Timetric 2020 Foresight: Best Practices in Managing Credit Risk Cycle Page 16

17 BEST PRACTICE FRAMEWORK IN CREDIT CARD RISK MANAGEMENT 4 Best Practice Framework in Credit Card Risk Management As discussed earlier, the management of risk associated with credit cards requires continuous efforts from every participant of the card payment industry. However, to do so, development of a best practices framework is of utmost importance. A well developed framework facilitates in understanding risks and areas which require attention from the intended parties, and formulate strategies to address them. A good risk management strategy is likely to include the following points: Policy development Adoption and implementation of the policies Process review at regular intervals Infrastructure development The first step in the development of a risk management framework should be development of policies related to the functioning of the organization and areas that need to be addressed. Once the key risk areas have been identified, the organization should clearly classify and document them for future reference. This process will help in understanding the responsibilities and further policies required to tackle the issues. The next step is to adopt and implement those policies in the organization s operational structure. This may require additional training and education of employees, escalating costs in the short term. However, the increased cost shouldn t be looked upon as a burden as it is expected to reduce credit losses in the future. Moreover, every step taken to increase protection can help to stabilize the whole credit card industry. The third step is to review and update the whole process at regular intervals and, if required, on more frequent occasions, as demanded by special circumstances. This is an important step given the dynamic nature of the payment industry and the use of latest technologies by fraudsters. Apart from updating policies, it is also required to update the organization s infrastructure so that it remains capable of handling the latest developments and analyses. Development of an efficient infrastructure is perhaps the most crucial step in the development of a risk management framework. It serves as a base for the proper functioning of the whole idea. Development of infrastructure may include IT setup, data management tools, skilled human resources and analytical applications. The current chapter also discusses case studies which explain some of the challenges faced by leading card issuers and network operators and the practical solutions adopted Foresight: Best Practices in Managing Credit Risk Cycle Page 17

18 APPENDIX 5 Appendix 5.1 Methodology All Timetric foresight reports are created by following a comprehensive, four-stage methodology. This includes market study, research, analysis and quality control. 1) Market Study A. Standardization Definitions are specified using recognized industry classifications. The same definition is used for every country. Annual average currency exchange rates are used for the latest completed year. These are then applied across both the Review and forecast data to remove exchange rate fluctuations. B. Internal audit Review of in-house databases to gather existing data: Historic market databases and reports Company database C. Trend monitoring Review of the latest companies and industry trends 2) Research A. Sources Collection of the latest market-specific data from a wide variety of industry sources: Government statistics Industry associations Company filings International organizations Regulatory agencies B. Expert opinion Collation of opinion taken from leading industry experts Analysis of third-party opinion and forecasts: Broker reports Media Official government sources C. Data consolidation and verification Consolidation of data and opinion to create Review datasets Creation of models to benchmark data across sectors and regions 3) Analysis A. Market forecasts Feeding forecast data into market models: Macroeconomic indicators Industry-specific drivers Analysis of industry database to identify trends: Latest trends Key drivers of the industry B. Report writing Analysis of market data Discussion of company and industry trends and issues Review of financial deals and trends 4) Quality Control 2020 Foresight: Best Practices in Managing Credit Risk Cycle Page 18

19 APPENDIX A. Templates Detailed process manuals Standardized report templates and accompanying style guides Complex forecasting tool used to ensure forecast methodologies are consistently applied Quality-control checklists B. Quality control process Peer review Senior-level QC Random spot checks on data integrity Benchmark checks across databases Market data cross-checked for consistency with accumulated data from: Company filings Government sources. 5.2 Background Timetric s dedicated research and analysis teams consist of experienced professionals with an industry background in marketing, market research, consulting and advanced statistical expertise. Timetric adheres to the Codes of Practice of the Market Research Society ( and the Society of Competitive Intelligence Professionals ( All Timetric databases are continuously updated and revised. 5.3 Contact Us If you have any queries about this report, or would like any further information, please contact info@timetric.com. 5.4 About Timetric Timetric is an independent economic and business research firm that provides critical intelligence on emerging economies and key global industries. The company offers detailed economic and sector intelligence, business insights and independent and authoritative commentary. Underpinning all Timetric s research services is a belief that data if gained following the right technologies and analytic frameworks can provide unique and powerful economic and business insights. The Timetric economic and industry intelligence centers are premium decision tools that provide access to comprehensive research, data and expert analysis. They provide invaluable decision support, presented in an easily digestible format and grounded in rich, proprietary data and data analysis frameworks. Each year, Timetric produces hundreds of high-quality research reports across countries, industries and companies. These reports draw on in-depth primary and secondary research, proprietary data and highquality modeling and analysis to give its readers a deep insight into global market dynamics and economic trends. Timetric helps its clients to: Gain an unbiased, expert insight from a genuinely independent and trusted source Save time in researching, visualizing and comparing economic and industry data Access the latest and most useful data sets, indices and forecasts Gain access to a unique methodology for understanding economic trends Forecast and predict trends more accurately Economic Research Services Timetric s economic research services are founded on three key goals: 2020 Foresight: Best Practices in Managing Credit Risk Cycle Page 19

20 APPENDIX 1. To provide the strongest base data: The most accurate data The most timely and frequently updated data sets The best data curation methodologies and standardizations Unique data sets and forward-looking indicators Industry-specific, premium data sets 2. To develop the best data analysis frameworks: Unique economic indices and data analysis frameworks Forward-looking indicators Proprietary indices and surveys Data analysis frameworks, scorecards and models 3. To provide authoritative independent economic insights: To give a uniquely local perspective on developing markets Truly expert, independent economic analysis and commentary Proprietary analysis techniques and frameworks Unique forecasts Timetric believes that world-class content delivery should be the enabling factor across all it does. All its research services follow the principle that data and research should be easy to access, visualize and consume. All economic research products are built on the Timetric economic research software platform, which has four layers: 1. Unique, proprietary aggregation and curation software for pulling together the world s data 2. A cloud time-series database filled with top-quality statistics from across the globe 3. Web-delivered search, discovery and research software to allow customized data searches 4. World-class browser-based display to visualize the data searched 5.5 Disclaimer All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form by any means, electronic, mechanical, photocopying, recording or otherwise, without the prior permission of the publisher, Timetric. The facts of this report are believed to be correct at the time of publication but cannot be guaranteed. Please note that the findings, conclusions and recommendations that Timetric delivers will be based on information gathered in good faith from both primary and secondary sources, the accuracy of which Timetric is not always in a position to guarantee. Timetric will accept no liability whatsoever for actions taken based on any information that may subsequently prove to be incorrect Foresight: Best Practices in Managing Credit Risk Cycle Page 20