Card fraud costs to banks increase to $40bn

Card fraud costs to banks increase to $40bn Revisiting the benefits of advanced fraud risk management systems January 2017 source: Featurespace Advanced fraud management systems offer $15.8bn of savings for card issuers In 2015, the global card industry lost approximately $22bn (2014 $16bn) due to fraud, and we estimate it loses a further $18bn ($15bn) in managing fraud and in revenue lost to competitors driven by false positives good transactions that are mistakenly blocked by the industry s existing fraud management systems. Adaptive, machine learning fraud management systems, such as Featurespace s ARIC Fraud Hub, can lower the incidence of undetected fraud. However, the main advantages are the savings on fraud management and missed revenue. Learning from good behaviour rather than pattern matching bad behaviour Most fraud management systems on the market today work by looking for bad behaviour; in other words, they rely on pattern-matching against recognised past fraud types. In contrast, advanced fraud detection and management systems that utilise deep machine learning and behavioural analysis are able to better understand the normal, good behaviour of each individual customer, and therefore recognise the importance of the subtle anomalies that indicate a card user is acting out of character. 70% reduction in false positives, 25% reduction in fraud Over the past few months, Featurespace has been challenged by a number of major card issuers to demonstrate the benefits of ARIC Fraud Hub. Using real historical customer data provided by the card issuers, Featurespace demonstrated a 25% reduction in the incidence of undetected fraud and, simultaneously, a 70% reduction in false positives. i Oakhall applied these results to card industry data to estimate the implied savings for the industry at $16bn, comprising $6bn reduced fraud and $10bn reduced fraud management costs and lost revenue. This is an update to our original analysis of 2014 data, published June 2016 Authors Jonathan Crossfield +44 20 3393 0633 Andrew Griffin info@oakhalladvisors.com

ARIC Fraud Hub Featurespace s ARIC Fraud Hub is a real-time, machine learning fraud management software system for organisations in financial services, including retail banks, payment providers and card issuers. The ARIC (Adaptive, Real-time, Individual, Change Identification) platform enables card issuers to monitor each individual customer s behaviour in real-time. Instead of starting from point-in-time data assuming what fraud looks like, the ARIC Fraud Hub uses times-series data to learn what normal behaviour is for each individual card user. This enables ARIC to spot and block new fraud types in real-time. It also means ARIC understands the context of normal behaviour, reducing the number of transactions that get unnecessarily blocked in an attempt to stop fraud. ARIC uses adaptive behavioural analytics to detect anomalies in individual behaviour to spot new fraud attacks as they occur. ARIC s scalable models self-learn as fraud evolves, significantly reducing the need for manual intervention in the detection and management of fraud. In this report we show how field tests using real historical card-issuer transaction data reduce the incidence of undetected fraud by 25%, but more importantly that the much better performance in avoiding the rejection of good transactions, known as false positives, yields twice that value in cost of fraud management and avoidance of lost revenue, which we refer to in Fig. 1 as fraud-related costs. Fig. 1: Potential benefits of the Featurespace ARIC Fraud Hub to the card industry source: Nilson, Oakhall estimates based on Featurespace ARIC Fraud Hub performance data The cost of fraud and fraud management Using industry data, we estimate the total cost of card fraud to credit and debit card issuers at approximately $40.1bn (previously $31.0bn, an increase of 29.4%). $21.8bn (+33.9%) reflects costs associated with incidents of card fraud; $18.3bn (+24.5%) are fraud-related costs associated with false positives. www.oakhalladvisors.com 2

Costs associated with incidents of card fraud - $21.8bn (+33.9%) The Nilson Report recently estimated that global card fraud losses totalled approximately $21.8bn in 2015, +20.6% from an upwardly revised 2014 estimate of $18.1bn. When compared to total credit and debit card transactions of $31.3tn (+8.5% y/y), this figure is equivalent to 7.0c for every $100 spent on credit and debit cards (2014: 6.3c). The Nilson Report projects that worldwide card fraud losses will reach $31.7bn by 2020 (CAGR of 7.7%). In the UK alone, banks saw 1.5m cases of attempted card fraud in 2015, with 80% occurring in card not present transactions (CNP) such as internet, mail order or telephone purchases. Fig. 2: Card Not Present incidents dominate card fraud case volume in the UK source: Financial Fraud Action UK, 2016 Costs associated with genuine transactions declined - $18.3bn (+24.5%) Using industry data, we estimate the industry s annual card fraud losses are about equal to the combined costs associated with legitimate transactions that have been incorrectly blocked by existing fraud prevention systems. Such incidents are referred to as genuine transactions declined or false positives. False positives can occur when a customer attempts a transaction that falls outside certain parameters that the bank considers normal. A transaction may be flagged as an anomaly if, for example, it occurs at an unusual time, or is an uncommon size; or perhaps the location or the nature of the merchant is considered questionable. Based on historical customer data provided by several global retail banks, Featurespace estimates that incumbent fraud detection and management systems prevent 10 legitimate transactions for every fraudulent purchase identified. In some instances, this figure can be much higher (20+ legitimate purchases stopped per fraudulent transaction identified), particularly where cards are used for online payments (CNP transactions). When a genuine transaction is rejected by a bank s fraud management system, the response from the bank s customer is typically twofold: o The customer uses an alternative method of payment often provided by a rival card issuer to complete the transaction. o The customer calls the card issuer to resolve the issue, and/or files a complaint. www.oakhalladvisors.com 3

In this way, each false positive is potentially both a lost revenue opportunity and an additional cost to the card issuer. Loss of market share - $6.0bn revenue lost to competitors Following a false positive event, Featurespace estimates that spending on the affected card typically falls between 4% and 10% as customers switch to alternative methods to pay merchants. ii As a result, the issuing bank suffers a loss of income from card fees it would otherwise have earned if the card was operational. Applied to the Nilson Report s global card spend data this equates to $6.0bn of fee revenue (previously $4.0bn, with the increase driven primarily by higher numbers of genuine transactions declined due to higher incidence of fraud and overall growth in card transaction volumes). Fraud management industry cost - $12.2bn Banks employ teams of analysts who study fraud events and implement rules that enable the card issuer to block potentially fraudulent transactions. The level of staffing has to match potential spikes in calls around fraud or false positive events, as illustrated below: Fig. 3: Fraud losses and call centre activity source: Oakhall Third party fraud detection providers may share data to enable their customers to benefit from fraud detection across the network; it still takes time, however, for new incidents of fraud to be factored into the rules of these systems. Based on industry data, we estimate the cost today of managing fraud is approximately $12.2bn each year (previously $10.7bn, with the increase driven by higher total card transaction volumes and incidence of fraud and good transactions declined). Quantifying the benefits of the Featurespace ARIC Fraud Hub Reduced fraud costs In a proof-of-concept trial using historical customer data from a multinational retail bank, the Featurespace ARIC Fraud Hub reduced undetected incidents of fraud by approximately 25% compared to the bank s existing fraud management system. Card fraud losses totalled nearly $22bn globally in 2015. Had card issuers employed the Featurespace ARIC Fraud Hub, this would imply a reduction in undetected fraud of $5.5bn. www.oakhalladvisors.com 4

Internal cost savings through reduced false positives ARIC also provides a unique technical approach to false positives. When anomalous changes occur, instead of assuming the customer is guilty until proven innocent, the ARIC platform understands the wider context of positive and negative behaviours. It is therefore able to accept more genuine transactions, minimising inconvenience to legitimate customers. Reduced card fee income losses due to false positive incidents A leading credit card issuer challenged Featurespace to compare the ARIC Fraud Hub to its existing fraud management system by using real historical customer data. In this proof-of-concept trial, the ARIC engine lowered the false positive ratio from ten false positives per fraud, to three, a reduction in false positive incidents of over 70%. We estimate that card fee income losses, due to false positive incidents, cost card issuers $6.0bn annually. A reduction in false positive incidents of 70% would therefore save the industry approximately $4.2bn per year. Internal cost savings due to reduced false positive incidents ARIC allows card issuers to improve operational efficiencies. ARIC is self-learning so the models do not degrade, which means card issuers can cut manual labour costs by reducing manual review tasks. The platform is currently trialling in the financial sector; in the gaming sector, however, Featurespace s clients have already seen a reduction in analyst headcount of up to 50%. We estimate that fraud-related call centres cost card issuers $12.2bn annually. Assuming a 50% cost saving would imply global cost reductions for card issuers of $6.1bn. Featurespace has trialled its ARIC Fraud Hub with historical customer data provided by companies in the gaming and financial sectors and is being used in a live environment in the gaming sector with Betfair and other customers. Across both sectors, the ARIC Fraud Hub has performed similarly well, generating consistent results: 70% reduction in false positives and 50% reduction in call centre costs. Reducing customer and regulator friction False positives increase reputational and regulatory risk Banking regulators maintain a close watch on the level of complaints received by banks and especially those which are escalated to the regulators own ombudsman services. In the UK, the Financial Conduct Authority collects complaints data from the firms it regulates. The most recent data for banking and credit card products shows there were 634,000 complaints in the first half of 2016, each of which will have taken time to resolve. High levels of complaints can be a significant drain on management time and may cause issues with regulators. While the absolute cost is hard to estimate, keeping the number of fraud and false positive events under control will help reduce potential complaints and strengthen relations with regulators. Card fee income is under pressure due to changes in regulation Another issue here is pressure on card fee rates resulting from regulatory caps (e.g. the EU caps on interchange fees for consumer debit and credit card transactions of 0.2% and 0.3%). While this may lower the overall cost of false positives, we would expect it to increase the emphasis on reducing customer friction and market share gains within banks. In addition, the cost of fraud-related call centres as a percentage of card fee income will increase leading to greater emphasis on cost control. www.oakhalladvisors.com 5

Appendices Appendix I: Calculating lost card fee income due to false positive incidents iii iii www.oakhalladvisors.com 6

Appendix II: Calculating call centre costs due to false positives www.oakhalladvisors.com 7

Published by Oakhall Ltd 33 Cannon St London EC4M 5ST London, UK based Oakhall was established to provide smart financial analysis and articulation to private and public companies and has particular experience in the FinTech sector. Oakhall worked with Featurespace to verify and analyse the savings that Adaptive Behavioural Analytics could achieve in the card payments sector. Disclaimers and disclosures Copyright 2016 Oakhall Ltd. All rights reserved. This report has been commissioned by Featurespace Ltd and prepared and issued by Oakhall Ltd. Oakhall Ltd will not accept any liability to any third party who for any reason or by any means obtains access or otherwise relies on this report. Oakhall Ltd has itself relied on information provided to it by third parties or which is publicly available in preparing this report. While Oakhall Ltd has used reasonable care and skill in preparing this report, Oakhall Ltd does not guarantee the completeness or accuracy of the information contained in it and the report solely reflects the opinions of Oakhall Ltd. The information provided by Oakhall Ltd should not be regarded as an offer to buy or sell securities and should not be regarded as an offer or solicitation to conduct investment business as defined by The Financial Services and Markets Act 2000 ( the Act ) nor does it constitute a recommendation. Opinions expressed do not constitute investment advice. Any information on the past performance of an investment is not necessarily a guide to future performance. Oakhall Ltd operates outside the scope of any regulated activities defined by the Act. If you require investment advice, we recommend that you contact an independent adviser who is authorised by the Act to conduct such services. Oakhall Ltd does not have any direct investments in any companies contained in the report. i Featurespace s ARIC Fraud Hub has been demonstrated to detect up to 40% of transaction fraud. To do this, however, inevitably requires an increase in the number of false positive alerts. Detecting 25% of transaction fraud optimises the ARIC Fraud Hub platform to simultaneously detect 70% of false positive incidents, and therefore these are the numbers we use in this report. ii Featurespace estimates that when a card is used in a fraudulent transaction, spending on that card typically falls between 4% and 10% as customers switch to alternative methods to pay merchants. This range is based on anonymised data from Featurespace clients. iii We have used fraud data from the UK to build our fraud rate assumptions. This is because the UK has demonstrated comparatively lower rates of fraud, ensuring our assumptions to remain conservative. www.oakhalladvisors.com 8