Global Consumers: Losing Confidence in the Battle Against Fraud

Global Consumers: Losing Confidence in the Battle Against Fraud JUNE 2014 Shirley W. Inscoe Research sponsored by: Photocopying or electronic distribution of this document or any of its contents without prior written consent of the publisher violates U.S. copyright law, and is punishable by statutory damages of up to US$150,000 per infringement, plus attorneys fees (17 USC 504 et seq.). Without advance permission, illegal copying includes regular photocopying, faxing, excerpting, forwarding electronically, and sharing of online access.

TABLE OF CONTENTS IMPACT POINTS... 4 INTRODUCTION... 5 METHODOLOGY... 5 GLOBAL CARD FRAUD SNAPSHOT... 6 FRAUD IN THE AMERICAS... 13 RISKY BEHAVIOR... 13 REPLACEMENT CARDS... 16 CONSUMER ATTITUDES TOWARD FRAUD... 20 FRAUD IN EUROPE, THE MIDDLE EAST, AND AFRICA... 23 RISKY BEHAVIOR... 23 REPLACEMENT CARDS... 27 CONSUMER ATTITUDES TOWARD FRAUD... 34 FRAUD IN THE ASIA-PACIFIC... 38 RISKY BEHAVIOR... 38 REPLACEMENT CARDS... 41 CONSUMER ATTITUDES TOWARD FRAUD... 45 RECOMMENDATIONS... 48 RELATED AITE GROUP RESEARCH... 49 ABOUT AITE GROUP... 50 AUTHOR INFORMATION... 50 CONTACT... 50 LIST OF FIGURES FIGURE 1: CURRENT TOTAL CARD FRAUD RATES BY COUNTRY... 7 FIGURE 2: CURRENT CREDIT CARD FRAUD RATES... 9 FIGURE 3: CURRENT DEBIT CARD FRAUD RATES... 10 FIGURE 4: MULTIPLE FRAUD INCIDENTS... 11 FIGURE 5: CURRENT PREPAID CARD FRAUD RATES... 12 FIGURE 6: RISKY BEHAVIOR IN THE AMERICAS... 14 FIGURE 7: RISKY BEHAVIOR TRENDS IN THE AMERICAS... 15 FIGURE 8: RISKY BEHAVIOR AND FRAUD EXPERIENCED IN THE AMERICAS... 16 FIGURE 9: REPLACEMENT CARDS IN THE AMERICAS... 17 FIGURE 10: USE OF REPLACEMENT CARDS IN THE AMERICAS... 17 FIGURE 11: SATISFACTION WITH FINANCIAL INSTITUTION AFTER FRAUD IN THE AMERICAS... 18 FIGURE 12: SWITCHING BEHAVIOR IN THE AMERICAS... 19 FIGURE 13: BACK-OF-WALLET BEHAVIOR IN THE AMERICAS... 20 FIGURE 14: CONSUMER TRUST IN FINANCIAL INSTITUTIONS IN THE AMERICAS... 21 FIGURE 15: CONSUMERS FRAUD CONCERNS IN THE AMERICAS... 22 2

FIGURE 16: RISKY BEHAVIOR IN EMEA (1/2)... 23 FIGURE 17: RISKY BEHAVIOR IN EMEA (2/2)... 24 FIGURE 18: RISKY BEHAVIOR AND FRAUD EXPERIENCED IN EMEA (1/2)... 26 FIGURE 19: RISKY BEHAVIOR AND FRAUD EXPERIENCED IN EMEA (2/2)... 27 FIGURE 20: REPLACEMENT CARDS IN EMEA (1/2)... 28 FIGURE 21: REPLACEMENT CARDS IN EMEA (2/2)... 28 FIGURE 22: USE OF REPLACEMENT CARDS IN EMEA... 29 FIGURE 23: SATISFACTION WITH FINANCIAL INSTITUTION AFTER FRAUD IN EMEA (1/2)... 30 FIGURE 24: SATISFACTION WITH FINANCIAL INSTITUTION AFTER FRAUD IN EMEA (2/2)... 31 FIGURE 25: SWITCHING BEHAVIOR IN EMEA... 32 FIGURE 26: BACK-OF-WALLET BEHAVIOR IN EMEA (1/2)... 33 FIGURE 27: BACK-OF-WALLET BEHAVIOR IN EMEA (2/2)... 34 FIGURE 28: CONSUMERS' TRUST IN FINANCIAL INSTITUTIONS IN EMEA (1/2)... 35 FIGURE 29: CONSUMERS' TRUST IN FINANCIAL INSTITUTIONS IN EMEA (2/2)... 35 FIGURE 30: CONSUMERS' FRAUD CONCERNS IN EMEA (1/2)... 36 FIGURE 31: CONSUMERS' FRAUD CONCERNS IN EMEA (2/2)... 37 FIGURE 32: RISKY BEHAVIOR IN THE ASIA-PACIFIC... 39 FIGURE 33: RISKY BEHAVIOR TRENDS IN THE ASIA-PACIFIC... 40 FIGURE 34: RISKY BEHAVIOR AND FRAUD EXPERIENCED IN THE ASIA-PACIFIC... 41 FIGURE 35: REPLACEMENT CARDS IN THE ASIA-PACIFIC... 42 FIGURE 36: USE OF REPLACEMENT CARDS IN THE ASIA-PACIFIC... 42 FIGURE 37: SATISFACTION WITH FINANCIAL INSTITUTION AFTER FRAUD IN THE ASIA-PACIFIC... 43 FIGURE 38: SWITCHING BEHAVIOR IN THE ASIA-PACIFIC... 44 FIGURE 39: BACK-OF-WALLET BEHAVIOR IN THE ASIA-PACIFIC... 45 FIGURE 40: CONSUMERS' TRUST IN FINANCIAL INSTITUTIONS IN THE ASIA-PACIFIC... 46 FIGURE 41: CONSUMERS' FRAUD CONCERNS IN THE ASIA-PACIFIC... 47 LIST OF TABLES TABLE A: RISKY BEHAVIOR TRENDS IN EMEA... 24 3

IMPACT POINTS This Impact Report, based on a Q1 2014 ACI Worldwide study of 6,159 consumers in 20 countries, provides an overview of respondents' attitudes toward various types of financial fraud and discusses the actions they may take subsequent to a fraud experience. Where applicable, it also compares these results with those from similar ACI surveys in 2011 and 2012. Of all cardholders debit, credit, and prepaid 27% have experienced card fraud in the past five years. This percentage is unchanged since the 2012 study. After experiencing fraud, 6 of consumers use their card less, at least in some situations, than they used their card previously. In 2014, of debit and credit card holders cite having experienced fraud multiple times during the past five years. Of cardholders who received replacement cards as a result of a data breach or fraudulent activity in the past year, 4 used the new card less than the original. Consumers who are dissatisfied with how they are treated by their financial institution after experiencing fraud sometimes change providers, resulting in a global attrition rate of 2. Fifty-five percent of respondents are "very concerned" about reclaiming their financial identity if they become a victim of identity theft; this represents a twofold increase in consumers with this level of concern from 2011. Eighteen percent of global consumers lack confidence that their financial institution can protect them against fraud. Forty-nine percent of global consumers exhibit at least one risky, which puts them at higher risk of financial fraud. 4

INTRODUCTION With 1,367 confirmed data breaches 1 in 2013 alone, the security of the financial services value chain is a topic of frequent discussion in the media as well as around the dinner table. Organized fraud rings are constantly coming up with creative new methods of stealing funds and identities, and consumers are increasingly losing confidence that there is anything that can be done to reverse this downward spiral. This Impact Report, the first in a two-part series on how financial fraud affects consumers, will examine how concerns related to fraud are overwhelming consumers, who are losing confidence on a variety of levels they are uncertain their financial institutions can protect them against fraud and, after experiencing fraud or receiving a replacement card, often change providers or send their cards to the dreaded back of wallet. This report will also, to the extent possible, identify trends in consumer and attitudes. The second report in the series will demonstrate that consumers are not confident that retailers' security systems adequately protect their data either when they shop in stores or when the retailers store their data. It will also focus on consumers' willingness to engage in the battle against fraud and show how they prefer to be contacted by their financial institutions. METHODOLOGY ACI Worldwide, a global leader in electronic payments for financial institutions, retailers, and processors, conducted online quantitative market research in March 2014 and surveyed 6,159 consumers. The study was conducted in a total of 20 countries in the following regions: The Americas (North and South America): Brazil, Canada, Mexico, and the United States EMEA (Europe, the Middle East, and Africa): France, Germany, Italy, the Netherlands, Poland, Russia, South Africa, Sweden, the United Arab Emirates, and the United Kingdom The Asia-Pacific: Australia, China, India, Indonesia, New Zealand, and Singapore In total, 6,159 consumers were included in the research: approximately 300 consumers, divided equally between men and women, participated in each of the 20 countries. Of the total, 6,041 own one or more type of payment card (i.e., credit card, debit card, prepaid card). This is the fourth time that ACI has fielded this type of survey, and some comparative results are included for the past two studies. In each country, the data have a margin of error of approximately 5 points. Statistical tests of significance, where shown, were conducted at the 95% level of confidence. 1. Verizon, 2014 Data Breach Investigations Report, http://www.verizonenterprise.com/dbir/2014/, accessed June 12, 2014. 5

GLOBAL CARD FRAUD SNAPSHOT Card fraud comprises unauthorized activity on three types of payment cards debit, credit, and prepaid. Cardholders experience fraud at very different rates around the globe, and each type of card has unique fraud challenges. The United Arab Emirates (UAE) has the highest rate of fraud overall at 44%, followed by China at 42%, and India and the United States at 4 each (Figure 1). Compared to the study fielded in Q3 2012, the rates of fraud among various countries have moved, but fraud rates overall are relatively flat. In the 2012 study, Mexico had the highest rate of card fraud at 44%, followed by the United States at 42%, India at 37%, and the UAE at 36%. 2 The 2014 study added three new countries, New Zealand, Poland, and Russia, so comparative data is unavailable for those countries. 2. See Aite Group's report Global Consumers React to Rising Fraud: Beware Back of Wallet, October 2012. 6

Figure 1: Current Total Card Fraud Rates by Country Percentage of Respondents Who Have Experienced Card Fraud in the Past 5 Years, 2012 vs. 2014 UAE China India United States Mexico Australia South Africa Brazil United Kingdom Singapore France Russia Indonesia Canada Italy Poland New Zealand Germany The Netherlands Sweden 36% 44% 36% 42% 37% 4 42% 4 44% 3 3 3 25% 30% 3 30% 34% 2 26% 2 26% 2 1 22% 25% 2 24% 1 17% 1 12% 1 12% 10% 2012 (n=5,114) 2014 (n=6,041) Source: Aite Group, ACI Worldwide studies of consumers in 20 countries, Q1 2014 and in 17 countries, Q3 2012 Credit card fraud rates in the 2014 study reflect that consumers around the globe are still experiencing card fraud despite the rollout of EMV. The United States is the final G-20 country to deploy EMV, and cards are already in the market, with current issuance focusing on international travelers and general issuance to mass-market consumers picking up steam in Q4 2014. 3 Many small issuers will likely roll out EMV cards more slowly than the largest issuers, so it will likely 3. See Aite Group's report EMV: Lessons Learned and the U.S. Outlook, June 2014. 7

take years before the U.S. market is fully EMV-compatible. After rolling out EMV, other countries have experienced a big decrease in counterfeit card fraud, but this has been offset by growth in counterfeit fraud in non-emv countries, growth in card-not-present fraud, and growth in application fraud. Since the United States is the last G-20 country to deploy EMV, we anticipate an even higher spike in card-not-present fraud than prior countries have experienced (there literally is no other major country left for the fraudsters to attack with counterfeit cards). Of course, counterfeit card usage will not disappear in the United States in the short term, since many merchants will use terminals that will accept magnetic stripe cards for years after EMV has partially been rolled out. Credit card fraud rates vary widely among consumers in the 20 countries surveyed. Consumers in the UAE experience the highest rate of credit card fraud at 39%, followed by the United States at 36%. Sweden is the only country surveyed for which credit card fraud is in the single digits ; it is important to note that consumers in countries such as Sweden, Poland, and Germany are low users of credit cards. Consumers in the Netherlands also enjoy a low rate of credit card fraud; only one consumer in 10 experienced it in the past five years. In the 2012 study, the United States and Mexico were tied for first place with a fraud rate of 37%, followed by the UAE, where 3 of consumers had experienced credit card fraud (Figure 2). 8

Figure 2: Current Credit Card Fraud Rates Q. Have you experienced fraud on your credit card in the past 5 years? UAE United States India China Mexico Brazil Australia Singapore United Kingdom South Africa France Russia Canada Italy New Zealand Poland Germany Indonesia The Netherlands Sweden 3 39% 37% 36% 27% 32% 27% 3 37% 2 30% 27% 30% 27% 2 25% 3 25% 25% 1 24% 19% 19% 1 22% 15% 15% 10% 1 10% 1 2012 (n=5,114) 2014 (n=6,041) Source: Aite Group, ACI Worldwide studies of consumers in 20 countries, Q1 2014 and in 17 countries, Q3 2012 Like with credit cards, the implementation of EMV will also curtail counterfeit fraud on debit cards. Some large issuers plan to roll out EMV debit cards right after credit, while others plan to delay debit rollout for a few months to a year. As a result, much of the current counterfeit credit card fraud in the United States may shift to debit cards after EMV-enabled credit cards roll out. In the 2012 study, cardholders in Mexico experienced the highest rate of debit card fraud at 25%, followed by China (24%), India (2), and the United States (). Consumers in China currently experience by far the highest debit card fraud rate at 30%, followed by India at 2, and Mexico 9

at. The United States is in fourth place again at 1 (Figure 3). High rates of debit card fraud closely correlate with a lack of EMV or an early stage of EMV implementation. Figure 3: Current Debit Card Fraud Rates Q. Have you experienced fraud on your debit card in the past 5 years? China India Mexico United States Russia South Africa United Kingdom UAE France Poland Brazil Sweden Indonesia Australia Singapore Italy The Netherlands Canada Germany New Zealand 24% 30% 2 2 25% 1 17% 12% 15% 17% 15% 1 12% 1 17% 1 1 12% 10% 9% 10% 1 10% 10% 9% 9% 1 7% 6% 6% 4% 2012 (n=5,114) 2014 (n=6,041) Source: Aite Group, ACI Worldwide studies of consumers in 20 countries, Q1 2014 and in 17 countries, Q3 2012 Many consumers experienced debit and credit card fraud on more than one occasion. Fourteen percent of global consumers experienced debit or credit card fraud more than once in the past five years, a similar result to the 2012 study (Figure 4). 10

Figure 4: Multiple Fraud Incidents Q. Have you experienced more than 1 incident of debit or credit card fraud in the past 5 years? 6% 2011 respondents (N=4,200) 2012 respondents (n=4,247) 2014 respondents (n=4,248) Last, but certainly not least, are prepaid cards. In terms of tenure, prepaid cards are the most recent type of payment cards on the market. Prepaid card fraud rates vary widely among consumers around the globe, similarly to credit and debit cards. The highest rate of fraud on prepaid cards is experienced by consumers in India at 1, followed by China at 17%, Indonesia at 1, and Italy and Singapore at 10%. Consumers in all other countries enjoy a rate of fraud in the single digits on prepaid cards (Figure 5). 11

Figure 5: Current Prepaid Card Fraud Rates Q. Have you experienced fraud on your prepaid card in the past 5 years? (n=6,041) India China Indonesia Italy Singapore UAE Russia Brazil Mexico Poland Australia France United States South Africa Germany Sweden The Netherlands United Kingdom Canada New Zealand 1 17% 1 10% 10% 9% 7% 7% 7% 6% 4% 2% 2% 2% Prepaid card rates are far lower than other types of cards, but that is likely tied to usage of this relatively new payment vehicle. Cards with very high usage rates in countries such as China and India experience higher rates of fraud. This may indicate that as usage rates grow in countries with current low rates of fraud, fraud will increase as well. 12

FRAUD IN THE AMERICAS This section of the report examines consumer s related to financial fraud in the Americas. Consumers in the Americas primarily live in countries whose banking systems have existed for centuries and where consumers have broad access to the banking system; Brazil is an exception, as the banking sector there really started revving up in the 1990s. As a result, traditional banking products and services are widely deployed in most countries in this region. RISKY BEHAVIOR Consumer sometimes influences whether consumers become fraud victims; in other instances, they may be powerless to prevent it. For example, a consumer who writes the personal identification number (PIN) for his debit card on the card and has the card stolen has enabled the thief to steal funds from his account(s) via an ATM. Conversely, a consumer who purchases goods from a retailer and uses her PIN at the point of sale has done nothing inappropriate. But if the retailer stores that card number and PIN in an unencrypted manner, then has a data breach, the innocent cardholder still becomes a victim of debit card fraud when a cybercriminal uses the cardholder's information. The outcome in both cases results in criminals emptying the victim's bank account, so it is not surprising that consumers may find protecting themselves against financial fraud frustrating. To begin, consumers were asked if they have demonstrated any of five specific s in the past five years. These s range from those consumers have been warned about for years (e.g., using a public computer for online banking) to newer threats (e.g., improper mobile phone security). Most consumers would never leave their computer totally unsecured but do not view their smartphones and tablets as the mini computers they actually are. While the level of risk associated with each may vary, all five s are deemed risky. Consumers in Mexico are the most likely to exhibit risky. One-third (3) state they leave smartphones unlocked when not in use, 27% state they throw documents with bank account numbers in the trash bin, and state they use online banking or shop online without security software or on a public computer. In Brazil, 30% of consumers indicate they throw documents with bank account numbers in the trash, 22% use online banking or shop online on a computer without security software or on a public computer, and 2 leave smartphones unlocked when they are not using them. In the United States, 1 of consumers throw documents with bank account numbers in the trash, and 1 use unsecure computers to bank or shop online. Twelve percent of Canadians throw documents with bank account numbers in the trash and leave smartphones unlocked when not in use. Overall, consumers in all of the Americas countries surveyed seem to have learned not to respond to emails and calls requesting bank account information; Brazil has the highest rate of consumers who still do this, at 7% (Figure 6). 13

Figure 6: Risky Behavior in the Americas Q. Which of the following have you done in the past 5 years? Left smartphone unlocked when not using it Responded to emails or calls asking for bank details Used online banking or Internet shopping without security software or on a public computer Thrown papers or documents with account numbers (e.g., bank statements) in the trash bin Made a note of your PIN and carried it with you or kept it with your card 2 12% 3 1 7% 6% 5% 22% 5% 7% 30% 12% 27% 1 12% 6% 9% 6% Brazil (n=300) Canada (n=304) Mexico (n=307) United States (n=311) In order for financial fraud to decrease, consumers must play a role, and limiting risky is one way consumers can help protect themselves. Unfortunately, data available from prior surveys do not demonstrate consistent downward trends in risky ; this indicates that consumers really don t understand risky and the negative impact it can have on them. Consumers are not changing their in a way that indicates an understanding of risk and a desire to protect themselves. In Brazil and Canada, participation in several risky s increased from 2011 to 2012, then decreased again in 2014; this was most apparent in throwing documents with bank account numbers in the trash. While downward trends cannot be shown across the board, the good news is that exhibiting risky s is flat or slightly down in most categories in each country surveyed (Figure 7). 14

Figure 7: Risky Behavior Trends in the Americas Risky Behavior Trends Over 2011, 2012, and 2014 (Where data is available) United States 2014 United States 2012 United States 2011 Mexico 2014 Mexico 2012 Canada 2014 Canada 2012 (n=311) (n=312) (n=283) (n=307) (n=302) (n=304) (n=304) 1 5% 7% 1 6% 1 6% 1 2 7% 24% 24% 2 3 6% 27% 9% 17% 7% 36% 9% 12% 5% 12% 6% 1 6% 25% 4% Left smartphone unlocked when not using it Responded to emails or calls asking for bank details Used online banking or Internet shopping without security software or on a public computer Canada 2011 Brazil 2014 Brazil 2012 Brazil 2011 (n=72) (n=300) (n=306) (n=271) 4% 4% 1 7% 2 22% 12% 2 22% 7% 30% 3 45% Thrown papers or documents with account numbers (e.g., bank statements) in the trash bin Made a note of your PIN and carried it with you or kept it with your card Does risky actually increase the likelihood of becoming a fraud victim? In Canada, Mexico, and the United States, consumers who exhibit risky also experience a higher rate of fraud. In Brazil, however, this is not the case. As an example, 50% of the consumers who exhibit risky in the United States are victims of card fraud, while only 3 of consumers in the same country who do not exhibit risky experience card fraud. Similar situations occur in Canada and Mexico, indicating that if risky continues to decline, it may help decrease card fraud (Figure 8). 15

Figure 8: Risky Behavior and Fraud Experienced in the Americas Fraud Experienced by Respondents Who Did and Did Not Participate in Risky Behavior in the Americas 72% 67% 7 80% 6 7 6 50% 50% 2 3 29% 1 39% 26% 3 (n=166) (n=119) (n=90) (n=214) (n=166) (n=124) (n=88) (n=221) Brazil Brazil Canada* Canada* Mexico* Mexico* United States* United States* Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky * Statistically significant difference in card fraud experience between those who engaged in risky and those who did not Experienced card fraud Did not experience card fraud REPLACEMENT CARDS Data breaches allow various consumer data to potentially fall into the hands of the bad guys. The retailer Target experienced one of the largest breaches in recent years, followed quickly by Neiman Marcus, Michaels, and many others. In data breaches such as these, data such as payment card numbers, PINs, and email addresses is often at risk. As a result of some breaches, card issuers mail replacement cards to their cardholders even if there has not yet been fraud on the account. Consumers may not fully understand why they are receiving a replacement card, so good communication is essential. If a consumer uses a replacement card less often than he or she used the original card, the card issuer experiences a drop in revenue. In the Americas, 4 of Americans received a replacement card during the past year, along with 24% of Mexicans, 17% of Canadians, and 27% of Brazilians. Given the huge Target breach, which was largely limited to the United States, it is not surprising that the highest rate of replacement cards are in that country. Some consumers received more than one replacement card during the past year (Figure 9). 16

Figure 9: Replacement Cards in the Americas Q. Has your financial institution sent a new debit, credit, or prepaid card to you during the past year because of a data breach or fraudulent activity? Yes once Yes twice Yes 3 times Yes more than 3 times 1 2 4% 2% 0% 0% 0% 0% 32% Brazil (n=285) Canada (n=301) Mexico (n=288) United States (n=306) In some countries, replacement cards are far more likely to go to back of wallet (and be used less often) than in others. For example, in Mexico, 6 of consumers are likely to place the card in back of wallet and not use it as much as the card it replaced. In Brazil, 47% of consumers exhibit back-of-wallet ; in Canada, 3 send replacement cards to back of wallet; and in the United States, 29% of consumers use the replacement card less. Less usage of a replacement card, particularly if it is issued because of a data breach when no fraudulent transactions have occurred, demonstrates the customer's loss of confidence in the card or the card issuer (Figure 10). Figure 10: Use of Replacement Cards in the Americas Percentage of Respondents in the Americas Who Use Their Replacement Card Less as a Result of Fraud or a Breach 47% 6 3 29% Brazil (n=74) Canada (n=48) Mexico (n=69) United States (n=126) 17

Being a victim of fraud can be traumatic, leaving consumers feeling violated. Since it can be a very emotional experience, financial institutions must use good customer service to calm customers and help them through the required post-fraud process. In the Americas, Canadians are the most pleased with treatment from their institution after experiencing fraud; 89% of consumers there are at least somewhat happy with the treatment they experienced. Second is the United States, where 7 of consumers are at least somewhat happy with their treatment. In sharp contrast to those are Mexico and Brazil, where 4 and 60% of consumers respectively are at least somewhat dissatisfied with their treatment by their financial institution after experiencing fraud (Figure 11). Figure 11: Satisfaction With Financial Institution After Fraud in the Americas Q. How happy were you with the treatment from your financial institution when you experienced card fraud? Very happy 15% 27% 5 7 Somewhat happy 25% 1 25% Brazil (n=85) Somewhat unhappy 3 5% 3 9% Canada (n=65) Mexico (n=96) Very unhappy 29% 6% 17% 1 United States (n=127) Consumers who experience fraud and are dissatisfied with their financial institution after the experience sometimes change providers as a result. Given the unhappy customer dissatisfaction rates in Mexico and Brazil, it is not surprising to see that 3 and 2 of consumers in those respective countries change providers after the fraud experience. It is expensive for financial institutions to attract new customers, so improving customer satisfaction among customers who experience fraud and retaining those customers is important. In the United States, 9% of consumers switch providers, and in Canada, only 6% do so (Figure 12). 18

Figure 12: Switching Behavior in the Americas Q. As a result of your experience with fraud, did you change your financial institution or credit card company? United States (n=127) 9% 9 Mexico (n=96) 3 67% Canada (n=65) 6% 94% Brazil (n=85) 2 79% Yes, I did No, I did not Canadians exhibit the least back-of-wallet after experiencing fraud, and even there, 3 of consumers use their cards somewhat less after a fraud experience. The United States is next, where 3 of consumers use their cards to some degree less than they did prior to the fraud. When nearly four consumers in 10 reduce their use of cards, card issuers experience a large reduction in revenue. Unsurprisingly, in Brazil (60%) and Mexico (7),very high percentages of consumers use their cards much less than they did prior to the fraud experience, negatively impacting issuer revenue even more (Figure 13). 19

Figure 13: Back-of-Wallet Behavior in the Americas Q. When you experienced fraud, did you choose to use cash or an alternative payment method over a credit or debit card following the card fraud incident? Brazil (n=85) Canada (n=65) 5% 15% 5% 2 40% 40% 69% Used cash instead of my debit card, but not instead of my credit card Yes, in all situations Mexico (n=96) 4% 2 22% 5 Yes, but only in some situations United States (n=127) 2% 2 6 No CONSUMER ATTITUDES TOWARD FRAUD Consumers are constantly bombarded by news about fraud in the press stories of computer hackers, data breaches, collusive fraud rings, and victims of identity theft; stories of all types of financial fraud, including tax fraud, healthcare fraud; and on and on. In this environment, can consumers depend on their financial institution to protect them from fraud? In the Americas, consumers do not have absolute confidence that their financial institutions can protect them, but the majority (between 52% and 62%) do feel the financial institutions are doing what they can. This attitude implies they are not confident that financial institutions have the power to protect them, which is understandable given the lack of control financial institutions have over fraudster. Consumers hear about skimming attacks in restaurants, at ATMs, and at gas stations With such subterfuge occurring on behalf of the fraudsters, consumers understand that financial institutions cannot be all-powerful. Some consumers express a bit more skepticism and feel financial institutions could be doing more to protect them; this sentiment is shared by 1 of consumers in Brazil, 1 in Mexico, in the United States, and 6% in Canada. The smallest group of consumers have very little confidence that their financial institutions can protect them at all 9% in Mexico, 4% in Brazil, in the United States, and in Canada (Figure 14). 20

Figure 14: Consumer Trust in Financial Institutions in the Americas Q. Do you have confidence in your financial institution to protect you from card fraud? 60% 62% 59% 52% 3 30% 25% 1 1 6% 1 4% 9% Yes, absolute confidence Yes, to an extent, Not really, they could they're doing what they do more can No, I have very little confidence they can Brazil (n=285) Canada (n=301) Mexico (n=288) United States (n=306) Consumers are concerned about a wide variety of fraud types. In the countries where fraud rates are highest, consumers express higher degrees of concern. In the United States, despite high rates of fraud, consumers express less concern; this is likely because U.S. consumers are protected by federal legislation and payment network policies that require financial institutions to reimburse them when they are victimized by electronic fraud. Consumers in Mexico and Brazil are more concerned about every category of fraud than consumers in the United States and Canada. In Brazil and Mexico, consumers are most concerned about identity theft and fraud on their debit cards. In the United States and Canada, consumers are most concerned about identity theft, data breaches that result in compromised account numbers, and fraud on their credit cards (Figure 15). 21

Figure 15: Consumers Fraud Concerns in the Americas Percentage of Consumers Who Are "Very Concerned" About Fraud Types in the Americas Data breach resulting in compromised account numbers 4 42% 72% 7 7 Identity theft 44% 50% 82% 64% Direct debit fraud (auto payment from account) 29% 30% 75% Online banking fraud 3 37% 67% 69% Cheque/Check fraud 19% 2 57% 5 Brazil (n=300) Canada (n=304) 4 Mexico (n=307) Fraud on my prepaid card 49% United States (n=311) 7 Fraud on my debit card 34% 35% 82% Fraud on my credit card 4 39% 69% 7 22

FRAUD IN EUROPE, THE MIDDLE EAST, AND AFRICA Many countries in Europe, the Middle East, and Africa have well-developed banking systems, although not all do. Some have emerging economies with consumers having access to many banking products in relatively recent years. It is somewhat difficult to compare financial fraud across such diverse economies, but this section does so. RISKY BEHAVIOR Similar to consumers in the Americas, consumers in EMEA are largely educated to ignore emails and calls requesting details about their bank accounts, although 9% of consumers in Russia and South Africa still respond. Likewise, consumers in most countries no longer make a note of their PIN and carry it with their cards; however, of consumers in both Italy and Russia still do so, along with 17% of consumers in the UAE. Across all the countries of EMEA, between 1 and 3 of consumers throw papers containing bank account numbers in the trash. With the exceptions of the Netherlands (4%), the United Kingdom (9%), and France (10%), consumers in high percentages ( to 37%) use computers without security software or public computers for online banking or online shopping. Failing to lock smartphones when not in use is a trait shared across the countries at a rate of 9% to 25% (Figure 16 and Figure 17). Figure 16: Risky Behavior in EMEA (1/2) Q. What of the following have you done in the past 5 years? Left smartphone unlocked when not using it Responded to emails or calls asking for bank details Used online banking or Internet shopping without security software or on a public computer Thrown papers or documents with account numbers (e.g., bank statements) in the trash bin Made a note of your PIN and carried it with you or kept it with your card 17% 15% 9% 6% 10% 1 4% 24% 19% 1 1 5% 10% 2% 7% France (n=300) Germany (n=299) Italy (n=308) The Netherlands (n=304) Poland (n=302) 23

Figure 17: Risky Behavior in EMEA (2/2) Q. What of the following have you done in the past 5 years? Left smartphone unlocked when not using it Responded to emails or calls asking for bank details Used online banking or Internet shopping without security software or on a public computer Thrown papers or documents with account numbers (e.g., bank statements) in the trash bin Made a note of your PIN and carried it with you or kept it with your card 2 22% 17% 25% 9% 9% 37% 22% 9% 3 29% 26% 15% 1 7% 17% Russia (n=308) South Africa (n=314) Sweden (n=301) UAE (n=318) United Kingdom (n=310) Looking across the last three studies, very few countries show consistent declines in risky. Only Sweden and the United Kingdom show percentages of consumers who write PINs down and keep them with their card trending downward, although only 2% of consumers do so in the Netherlands. South Africa is the only country that shows strong improvement in the percentage of consumers who throw papers with account numbers in the trash. No country in EMEA showed steady improvement in the percentages of consumers who use unsecure computers to do online banking or shopping, but less than 10% of consumers respond to emails or phone calls concerning bank accounts in all EMEA countries. South Africa, Sweden, and the United Kingdom all show strong improvement between studies in percentages of consumers who leave their smartphone unsecured when not in use (Table A). Table A: Risky Behavior Trends in EMEA Risky Country 2011 2012 2014 Made a note of your PIN and carried it with you or kept it with your card France Germany Italy The Netherlands Poland Russia 4% 7% 1 10% 17% 2% 5% 10% 2% 7% 24

Risky Country 2011 2012 2014 South Africa Sweden The UAE United Kingdom 1 1 12% 9% 12% 1 7% 17% Thrown papers or documents with account numbers (e.g., bank statements) in the trash bin France Germany Italy The Netherlands Poland Russia South Africa Sweden The UAE United Kingdom 1 1 26% 24% 29% 49% 30% 3 15% 32% 5 4 4 19% 1 1 3 29% 26% 15% Used online banking or Internet shopping without security software or on a public computer France Germany Italy The Netherlands Poland Russia South Africa Sweden The UAE United Kingdom 1 1 1 1 12% 1 17% 10% 19% 17% 24% 10% 1 4% 24% 37% 22% 9% Responded to emails or calls asking for bank details France Germany Italy The Netherlands Poland Russia South Africa Sweden The UAE United Kingdom 0% 4% 10% 4% 5% 4% 5% 4% 12% 6% 9% 9% Left smartphone unlocked when not using it France Germany Italy The Netherlands Poland Russia South Africa Sweden The UAE United Kingdom 1 19% 27% 25% 24% 2 17% 15% 9% 2 22% 17% 25% 25

In seven out of 10 EMEA countries, consumers who exhibit risky experience fraud at higher rates than consumers who refrain from risky. In the three countries where this was not the case, South Africa, Sweden, and the United Kingdom, fraud rates are relatively flat among consumers who did and did not behave in risky ways. In no countries in EMEA did consumers who refrain from risky experience a higher rate of fraud than those who did not refrain (Figure 18 and Figure 19). Figure 18: Risky Behavior and Fraud Experienced in EMEA (1/2) 77% Fraud Experienced by Respondents Who Did and Did Not Participate in Risky Behavior in EMEA 7 87% 70% 8 8 89% 69% 92% 59% 36% 1 24% 1 29% 1 1 1 3 (n=118) (n=180) (n=120) (n=178) (n=158) (n=148) (n=91) (n=212) (n=119) (n=156) France* France* Germany* Germany* Italy* Italy* The Netherlands* Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky The Netherlands* Did not engage in risky Poland* Engaged in risky * Statistically significant difference in card fraud experience between those who engaged in risky and those who did not Experienced card fraud Have not experienced card fraud Poland* Did not engage in risky 26

Figure 19: Risky Behavior and Fraud Experienced in EMEA (2/2) Fraud Experienced by Respondents Who Did and Did Not Participate in Risky Behavior in EMEA 84% 89% 90% 7 7 69% 7 70% 6 5 4 29% 29% 3 37% 29% 2 15% 9% 10% (n=174) (n=119) (n=168) (n=142) (n=132) (n=169) (n=188) (n=130) (n=104) (n=206) Russia* Russia* South Africa Engaged in risky Did not engage in risky Engaged in risky South Africa Did not engage in risky Sweden Sweden UAE* UAE* United Kingdom Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky United Kingdom Did not engage in risky * Statistically significant difference in card fraud experience between those who engaged in risky and those who did not Experienced card fraud Have not experienced card fraud REPLACEMENT CARDS Across all the EMEA countries, consumers received one replacement card due to fraud or data breaches during the past year at a rate from 9% in Sweden (where fraud is low) to 34% in the UAE (one of the countries with high fraud rates). Many consumers received more than one replacement card during the past year (Figure 20 and Figure 21). 27

Figure 20: Replacement Cards in EMEA (1/2) Q. Has your financial institution sent a new debit, credit, or prepaid card to you during the past year because of a data breach or fraudulent activity? Yes once 19% 15% 10% France (n=285) Yes twice Yes 3 times 2% % % % % Germany (n=291) Italy (n=303) The Netherlands (n=302) Poland (n=275) Yes more than 3 times % % % % Figure 21: Replacement Cards in EMEA (2/2) Q. Has your financial institution sent a new debit, credit, or prepaid card to you during the past year because of a data breach or fraudulent activity? Yes once Yes twice 9% 2% 4% 7% 34% Russia (n=292) South Africa (n=310) Sweden (n=299) Yes 3 times % % UAE (n=317) United Kingdom (n=307) Yes more than 3 times % Replacement cards are not a bad thing in and of themselves. In fact, consumers are often protected from fraud by a proactive financial institution that sends them a replacement card in the wake of a data breach or identified skimming incident. In the absence of reassurance and good communication, however, consumers may not understand why they receive a replacement card and could lose confidence in using it. Across the countries of EMEA, consumers use replacement cards less than the cards they replaced at rates ranging from a low of 22% (Germany) to a high of 49% (Poland). This translates to one out of every five consumers in 28

Germany not using the replacement cards as much as the original to one out of every two consumers using replacement cards less in Poland. This high rate of back-of-wallet costs card issuers revenue and demonstrates a loss of confidence in the cards or financial institutions involved (Figure 22). Figure 22: Use of Replacement Cards in EMEA Percentage of Respondents in EMEA Who Use Their Replacement Card Less as a Result of Fraud or a Breach 34% 22% 44% 2 49% 4 40% 39% 3 36% France Germany Italy The Netherlands Poland Russia South Africa Sweden UAE United Kingdom (n=47) (n=58) (n=50) (n=32) (n=49) (n=47) (n=60) (n=41) (n=138) (n=61) After experiencing fraud, over a third of consumers in six out of 10 countries in the EMEA region are at least somewhat unhappy with their financial institutions. Russia leads by far, with 65% of consumers at least somewhat unhappy after the fraud experience; Italy is not far behind at 55%. Other countries where over one-third of consumers are at least somewhat unhappy include Germany (4), South Africa and the UAE (37% each), and Poland (36%). These high rates of unhappy customers contrast sharply with the other four countries in EMEA, where the majority of customers are at least somewhat happy with the treatment received from their financial institution after their fraud experience. In Sweden, 86% of consumers are at least somewhat happy, in the Netherlands and the United Kingdom, 82% of consumers in each country are at least somewhat happy, and in France, 79% of consumers are at least somewhat happy (Figure 23 and Figure 24). 29

Figure 23: Satisfaction With Financial Institution After Fraud in EMEA (1/2) Q. How happy were you with the treatment from your financial institution when you experienced card fraud? 1 France Germany Italy The Netherlands Poland (n=50) (n=39) (n=62) (n=49) (n=76) 5% 1 15% 46% 2 26% 3 3 24% 3 27% 27% 37% 42% 56% Very happy Somewhat happy Somewhat unhappy Very unhappy 5% 30

Figure 24: Satisfaction With Financial Institution After Fraud in EMEA (2/2) Q. How happy were you with the treatment from your financial institution when you experienced card fraud? Russia South Africa Sweden UAE United Kingdom (n=88) (n=139) (n=29) (n=93) (n=68) 5% 7% 7% 7% 26% 24% 3 17% 19% 1 34% 30% 32% 2 46% 52% 56% Very happy Somewhat happy Somewhat unhappy Very unhappy 19% Even though so many customers are at least somewhat unhappy with their treatment subsequent to experiencing fraud, comparatively few consumers report that they switched financial institutions. One exception is Poland, where two out of five consumers (40%) change financial institutions after experiencing fraud. In two countries, Russia (25%) and the Netherlands (2), at least one out of five consumers change financial institutions after experiencing fraud. Otherwise, all countries have rates less than. While these rates may seem relatively low, financial institutions are competing for every customer and could decrease these levels of attrition with improved customer service for fraud victims (Figure 25). 31

Figure 25: Switching Behavior in EMEA Q. As a result of your experience with fraud, did you change your financial institution or credit card company? United Kingdom (n=88) 86% South Africa Sweden UAE (n=139) (n=29) (n=93) 15% 17% 97% 85% 8 The Netherlands Poland Russia (n=68) (n=50) (n=39) 25% 2 40% 75% 79% 60% France Germany Italy (n=62) (n=49) (n=76) 1 12% 1 82% 8 87% Yes, I did No, I did not Not all unhappy consumers switch financial institutions after experiencing fraud, but they can still negatively impact their financial institution's revenue by using their card less often. Close to or over half of consumers in all but one country use cash or an alternate payment method instead of a card following their fraud incident; only in the United Kingdom do a large majority of 32

consumers (6) use their card as much as they did prior to the fraud incident. This back-ofwallet negatively impacts card revenue and demonstrates consumers' loss of confidence in the card or in their financial institution (Figure 26 and Figure 27). Figure 26: Back-of-Wallet Behavior in EMEA (1/2) Q. When you experienced fraud, did you choose to use cash or an alternative payment method over a credit or debit card following the card fraud incident? The Netherlands Poland (n=50) (n=39) 2% % 22% 1 36% 40% 3 5 Used cash instead of my debit card, but not instead of my credit card Yes, in all situations France Germany Italy (n=62) (n=49) (n=76) 4% 4% 12% 40% 37% 30% 4 5 54% Yes, but only in some situations No 33

Figure 27: Back-of-Wallet Behavior in EMEA (2/2) Q. When you experienced fraud, did you choose to use cash or an alternative payment method over a credit or debit card following the card fraud incident? United Kingdom South Africa Sweden UAE Russia (n=88) (n=139) (n=29) (n=93) (n=68) 1 7% 12% 12% 25% 6 40% 44% 3 52% 35% 49% 57% 29% Used cash instead of my debit card, but not instead of my credit card Yes, in all situations Yes, but only in some situations No CONSUMER ATTITUDES TOWARD FRAUD Less than one-third of consumers across EMEA have absolute confidence that their financial institution can protect them from fraud. As in the Americas, the majority feel that their financial institutions are doing what they can to protect them, but they aren't confident that this is enough to be effective all the time. In Russia, 34% of consumers think financial institutions could be doing a lot more to protect consumers, by far the highest percentage of consumers who feel this way in the region (Figure 28 and Figure 29). 34

Figure 28: Consumers' Trust in Financial Institutions in EMEA (1/2) Q. Do you have confidence in your financial institution to protect you from card fraud? 60% 66% 52% 66% 60% 29% 2 15% 1 12% 15% 5% 9% 4% 5% 2% France Germany Italy The Netherlands Poland (n=285) (n=291) (n=303) (n=302) (n=275) Yes, absolute confidence Not really, they could do more Yes, to an extent, they're doing what they can No, I have very little confidence they can Figure 29: Consumers' Trust in Financial Institutions in EMEA (2/2) Q. Do you have confidence in your financial institution to protect you from card fraud? 62% 64% 6 72% 47% 34% 10% 9% 24% 12% 2 15% 15% 12% 1 6% 4% 5% Russia South Africa Sweden UAE United Kingdom (n=292) (n=310) (n=299) (n=317) (n=307) Yes, absolute confidence Yes, to an extent, they're doing what they can Not really, they could do more No, I have very little confidence they can Consumers express concern related to a wide range of financial fraud types. The majority of consumers are very concerned about identity theft, data breaches resulting in compromised account numbers, online banking fraud, and fraud on credit cards. In some countries, consumers are very concerned about fraud on their debit cards as well (Figure 30 and Figure 31). 35

Figure 30: Consumers' Fraud Concerns in EMEA (1/2) Percentage of Consumers Who Are "Very Concerned" About Fraud Types in EMEA Data breach resulting in compromised account numbers Identity theft Direct debit fraud (auto payment from account) Online banking fraud Cheque/Check fraud Fraud on my prepaid card Fraud on my debit card Fraud on my credit card 5% 7% 1 15% 17% 15% 2 22% 2 24% 3 3 30% 35% 34% 4 39% 4 3 27% 25% 40% 3 40% 46% 46% 45% 46% 49% 54% 5 5 52% 5 5 62% 59% 66% France (n=300) Germany (n=299) Italy (n=308) The Netherlands (n=304) Poland (n=302) 36

Figure 31: Consumers' Fraud Concerns in EMEA (2/2) Percentage of Consumers Who Are "Very Concerned" About Fraud Types in EMEA Data breach resulting in compromised account numbers Identity theft Direct debit fraud (auto payment from account) Online banking fraud Cheque/ check fraud Fraud on my prepaid card Fraud on my debit card Fraud on my credit card 7 70% 24% 5 4 67% 74% 30% 59% 4 67% 64% 1 46% 34% 74% 66% 56% 36% Russia (n=308) 32% 3 South Africa (n=314) 29% Sweden (n=301) 1 55% UAE (n=318) 32% 1 United Kingdom (n=310) 2 1 75% 60% 25% 49% 40% 70% 5 6 35% 37

FRAUD IN THE ASIA-PACIFIC The final region covered by the consumer fraud study is the Asia-Pacific, with six countries included in 2014. Consumer and attitudes in this region are somewhat different than in EMEA and the Americas. RISKY BEHAVIOR Consumer in Australia and New Zealand tend to be far less risky than the rest of the Asia-Pacific. The very low percentages of consumers who carry their PIN with a card or respond to emails and calls asking for bank account information more closely resemble consumers in the Americas and EMEA than the other countries in the Asia-Pacific. Over of consumers in all countries leave smartphones unlocked when not in use and throw documents with bank account numbers in the trash. In all countries except Australia and New Zealand, over of consumers bank or shop online on computers without security software or on public computers (Figure 32). 38

Figure 32: Risky Behavior in the Asia-Pacific Q. What of the following have you done in the past 5 years? Left smartphone unlocked when not using it 2 2 29% 2 32% Responded to emails or calls asking for bank details Used online banking or Internet shopping without security software or on a public computer Thrown papers or documents with account numbers (e.g., bank statements) in the trash bin 22% 4% 24% 3 27% 1 24% 2 36% 2 37% 32% 37% Australia (n=310) China (n=302) India (n=310) Indonesia (n=330) New Zealand (n=310) Singapore (n=311) 6% Made a note of your PIN and carried it with you or kept it with your card 4% 1 15% 25% Australia alone exhibits a consistent downward trend in risky we hope to see everywhere. In other countries, consumers are up and down in these s; often, we see an increase between 2011 and 2012 with a decrease in 2014. However, 2014 rates are often as high or higher than risky rates in 2011. This implies a lack of consumer education or a lack of belief by consumers that their really has an impact on the likelihood of fraud (Figure 33). 39

Figure 33: Risky Behavior Trends in the Asia-Pacific Risky Behavior Trends Over 2011, 2012, and 2014 (Where data is available) Singapore 2014 Singapore 2012 Singapore 2011 Indonesia 2014 Indonesia 2012 India 2014 India 2012 India 2011 China 2014 China 2012 China 2011 (n=311) (n=306) (n=20) (n=330) (n=305) (n=310) (n=312) (n=304) (n=302) (n=319) (n=31) 24% 2 1 22% 1 0% 32% 37% 50% 25% 15% 2 27% 37% 15% 2 39% 17% 29% 22% 3 2 25% 24% 2 3 45% 26% 0% 4% 12% 17% 9% 2 24% 36% 1 26% 1 30% 5 2 0% 6% 26% 10% Left smartphone unlocked when not using it Responded to emails or calls asking for bank details Used online banking or Internet shopping without security software or on a public computer Thrown papers or documents with account numbers (e.g., bank statements) in the trash bin Made a note of your PIN and carried it with you or kept it with your card Australia 2014 Australia 2012 Australia 2011 (n=110) (n=315) (n=307) 2 2 6% 19% 4% 10% 2 6% 0% 7% 15% 37% In every country of the Asia-Pacific region (except New Zealand, where fraud rates are only slightly higher), risky and experiencing fraud clearly correlate. Educating consumers about risky and the need to avoid them can help reduce fraud incidents and help consumers feel some element of control and confidence over their ability to protect themselves from becoming a victim of fraud (Figure 34). 40

Figure 34: Risky Behavior and Fraud Experienced in the Asia-Pacific Fraud Experienced by Respondents Who Did and Did Not Participate in Risky Behavior in the Asia-Pacific 7 72% 77% 74% 86% 8 84% 8 66% 59% 50% 49% 50% 49% 4 25% 2 26% 1 15% 3 17% (n=123) (n=185) (n=203) (n=96) (n=210) (n=93) (n=208) (n=109) (n=151) (n=157) (n=201) (n=105) Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky Australia*Australia* China* China* India* India* Indonesia* Indonesia* Did not engage in risky Engaged in risky Did not engage in risky Engaged in risky New Zea-Nelanland Zea- Singapore* Singapore* Did not engage in risky * Statistically significant difference in card fraud experience between those who engaged in risky and those who did not Experienced card fraud Have not experienced card fraud REPLACEMENT CARDS In the Asia-Pacific region, consumers received at least one replacement card from a low of one in 10 in Indonesia to almost three in 10 in India. As in other regions, some consumers received multiple replacement cards during the past year (Figure 35). 41