State of Card Fraud: 2018 A deep dive into the evolution of card fraud + industry benchmark data for financial institutions. Stopping Fraud at the Speed of Data
Continuing the trend of prior years, the cost of fraud continues to rise for global financial institutions...fraudsters continuously test for the weakest entry point in the financial transaction system and these institutions should apply a multi-layered approach to fraud prevention to combat this growing issue. -LexisNexis Risk Solutions Sr. Director of Fraud and Identity Management Strategy Kimberly Sutherland Did you know? Every dollar of fraud now costs banks and credit unions roughly $2.92 a 9.3% increase over 2017. 2
2018: The Post-Equifax Breach Year 209,000 breached credit card accounts. That incident defined the tailend of 2017 and set the tone for 2018 s state of card fraud. That stolen data was part of the Equifax breach story, which ended with 147.9 million Americans estimated to be Impacted along with 145.5 million SSNs and 97,500 tax IDs. That was just the tip of the iceberg. The true impact of a breach of that magnitude won t be felt for many years. Which brings us to our annual whitepaper. Inside The State of Card Fraud 2018 We ve created this white paper to help FIs take a deeper dive into the issues that impact them most. This includes insight into: INDUSTRY DATA POINTS Pages 4-8 Shifting data breach & card fraud trends BENCHMARK DATA Pages 9-13 Our curated reports provide a look into the true cost for FIs RISING TRENDS Pages 14-19 Account Fraud, Synthetic fraud, ATM fraud, gas station skimming fraud OBSERVATIONS + PREDICTIONS Pages 20-22 A checklist of our 2016, 2017 and 2018 projections 3
Industry Data Points Type of information compromised in a breach The latest data breach stats How fraud incidents are trending overtime Industry-wide card fraud stats How CNP fraud compares with POS fraud Card fraud broken down by type of card Card fraud losses worldwide 4
Industry Data Points Type of Information Compromised in a Data Breach ITRC data breach records indicate there has already been 864 breaches that have exposed a total of 34,174,633 records. (as of As of Aug. 31, 2018). The average cost per record, lost or stolen, during a breach was $336 per record for the financial industry. In 2018, +10% of data breaches involved financial sector companies, including such as banks, credit unions and credit card companies. The average cost of a data breach is $3.86 million a 6.4% increase from last year. 5
Industry Data Points Fraud Incidents Overtime According to Javelin + LexisNexis latest research, in the past year: Account Takeover Fraud rose 177% Existing-Card Fraud rose 8% Existing-Non-Card Fraud rose 115% New Account Fraud declined 80% Existing Account Fraud rose 16% CNP fraud is 81% more prevalent than POS fraud 61% of fraud losses for major banks stem from identity fraud 20% of the identity fraud incurred by larger banks is synthetic identity fraud 6 6
Industry Data Points POS fraud is trending down but CNP fraud is skyrocketing 7 7
Industry Data Points Card Fraud Losses Worldwide The loss of personal information directly contributes to growing fraud losses for banks and merchants $27.69B $31.26 $32.82B $24.71B $21.84B $18.11B $13.70B $11.27B 2012 2013 2014 2015 2016 2017 *2018 *2019 Nilson Report 2018 8
Benchmark Data Top 3 fraud goals of FIs How much card fraud costs FIs annually Top fraud fears of FIs FIs greatest internal challenges Additionald fraud obstacles FIs face FI s top card fraud + reissuance goals 9
Benchmark Data Rippleshot's Card Fraud Benchmark Report collects key data points from across the payment card industry. This data is intended to help fraud management teams determine where gaps exist, and how their goals align with others in the industry. Below are the Top 3 fraud goals listed by FIs: Minimizing Customer Impact Reducing Fraud Impact Detecting Fraudulent Accounts Faster 10
Benchmark Data Rippleshot s internal data indicates how much card fraud is costing FIs annually Top Fraud Fears Among FIs: Check Fraud was ranked as a Top 3 fraud concern by 58.3% Synthetic Fraud was ranked as a Top 3 fraud concern by 33.3% ATM Fraud was ranked as a Top 3 fraud concern by 16.6% 11
Benchmark Data FIs reported the following issues as the greatest challenges that exist across their organizations in terms of customer impact: Better Fraud Detection Alerts Fraud Reduction Card Reissuance Faster Fraud Detection Faster Customer Communication Here s how FIs ranked their top fraud concerns: Detecting Fraudulent Accounts Reducing Fraud Impact Minimizing Customer Impact Responding to Fraud Alerts Reducing Reissuance Costs 12
Benchmark Data Additional Top Fraud Challenges Among FIs Credit Card Fraud ranked as a top fraud concern by 33.3% of Debit Card Fraud ranked as a top fraud concern by 75% of respondents. respondents. Account Fraud ranked as the top fraud concern by 66.7% of respondents. FI s Top Card Fraud + Reissuance Goals Loss mitigation and reducing customer impact Full migration to EMV Fraud Prevention Reissue to avoid further losses Block/cancel compromised card Reissue cards likely to go fraudulent 13
Rising Trends Account Takeover Fraud Synthetic Fraud Key data insights ATM Fraud The FI impact Popular ATM schemes Gas Station Skimming Fraud Inside the numbers 14
Rising Trends: Account Takeover Fraud Data indicates that account takeovers jumped by 300 percent in the 2017 alone. What's contributing to this rise is also the ability for cyber criminals to gain access to bank accounts easier than a credit card. Much like credit card details, bank account credentials are being sold across the dark web at a rapid pace. This has made it increasingly possible for hackers with any level of training to commit account takeover fraud. The availability of financial credentials across the dark web has also helped fraudsters commit account takeover on a larger scale. While fraudsters continue to capitalize on vulnerabilities that exist across the payments, retail and financial industries, these problems are going to continue to be exacerbated at a rapid pace. The FI Impact: ATO on the Rise ATO tripled in the past year totaling $5.1 billion in losses. New account fraud rose an estimated 70% in the past year. This type of fraud relies on PII to facilitate. ATO fraud has an average resolution time of 16 hours. 15
Rising Trends: Synthetic Fraud ID verification systems aren t working as efficiently as needed for today s fraud ecosystem. Synthetic ID fraud and automated attacks are on the rise. Fraudsters are using personally identifiable information to determine identities quicker. Financial institutions are at an increased risk to new account fraud and increased ID theft fraud as a result. For financial institutions, they often become the real victim of synthetic fraud. Since there is no reported fraud from an actual person, or an actual person to trace the fraud back to, they often end up absorbing the costs. For example, when a credit card is created with a synthetic ID, the balance will never be paid as there is no specific person for the bank to collect from. This is why banks are increasingly placing more emphasis on early fraud detection to alert them of suspicious behavior, and why banks are working to add more verification and authentication to online banking. The FI Impact: Synthetic ID Key Data Insights Synthetic ID fraud is estimated to account for 85% of all identity fraud in the U.S. Synthetic Fraud accounts for an average loss estimated at $10,000 per account. Synthetic Fraud costs lenders more than $6 billion annually. Synthetic IDs develop over a period of 6 months to 5 years By 2021, synthetic fraud is estimated to account for 40% of all credit card chargeoffs. Synthetic ID fraud accounts for 80% of all credit card fraud losses, and nearly 1/5 of credit card charge-offs. 16
Rising Trends: ATM Fraud The rise in ATM fraud has forced banks and credit unions to implement better fraud controls and continually upgrade their security features in order to think smarter about their fraud management strategies. Solving ATM fraud has become a 2 billion-dollar question. (The impact of ATM skimming on a global scale). Getting to the bottom of ATM fraud means having a better understanding of how fraudsters think, how quickly they act and what payment channels they are targeting most. Banks typically have less than 48 hours after an ATM compromise before money is out the door. Banks need to quickly identify compromised ATMs and cards to get a handle on the scope of the problem a process that can take weeks. Weeks isn't good enough when a problem needs to be solved in less than two days. When an ATM breach transpires, fraud occurs within 48 hours. From a typical breach, the end cost results can result in the loss of $250,000. The FI Impact: ATM Fraud Schemes According to NCR, skimming costs an average of $650 per card and between $5,000 to $100,000 per incident. ATM fraud rose 10% YOY between 2016 and 2017. FBI Warning: ATM Wiretaps In September, the U.S. Secret Service issued an "ATM wiretapping" alert. This technique involves magnets and medical devices to siphon customer account data from the card reader. This alert warn FIs about this new trend that involves the cutting of "cupcake sized-holes" into ATMs to steal the payment data. 17
Rising Trends: ATM Fraud The average ATM skimming fraud costs $600 per card There is a 4-30 days harvesting period for ATM Skimming fraud ATM cashouts occur during a 24-48 hours, with an average loss of $150,000 The FI Impact: Economics of ATM Skimmer Detection When skimmers are detected within a 2-hour window, FIs have a significant chance of reducing the cost of fraud and customer impact. 18
Rising Trends: Gas Station Skimming Fraud Gas station skimmers have been a heated topic across the fraud management ecosystem for years. Since the EMV chip card compliance deadline isn t until October 2020 roughly five years after the liability shift was implemented for merchants this gap has left gas stations in the fraud spotlight. Skimmers have been a rapidly-growing problem due to tech advancements that has allowed them to be designed slimmer than a credit card and cheaper to produce. With fraudsters ability to insert them seamlessly into machines with less obtrusive methods, this has led to an uptick in concerns from issuers in how to proactively confront this expensive problem. That stolen payment data from credit/debit cards is used quickly, and often sold on the dark web. This accelerates the speed at which fraud spreads and only exacerbates payment breaches. The FI Impact: The Spread of Skimming Fraud A single compromised pump can capture data from roughly 30-100 cards per day. In a single investigation, the Secret Service discovered 59 skimmers at 85 locations in 21 states. 19
Past Observations + Predictions Our 2016 Card Fraud Predictions Our 2017 Card Fraud Predictions The outcome The outcome Our 2018 Card Fraud Predictions What will define 2018 The contributing factors 20
Past Observations + Predictions Understanding the current card fraud trends means taking a brief look back to what defined 2016 and 2017. Below are the key trends that we predicted during our past annual reports: RIPPLESHOT S 2016 PREDICTIONS OUTCOME RIPPLESHOT S 2017 PREDICTIONS OUTCOME 21
2018 Observations + Predictions What we predict will define the year: ID fraud is increasing significantly Including application fraud, account takeover & synthetic fraud CNP fraud continues to grow Debit card fraud on the rise ATM and gas station skimming First party/friendly fraud Fallback charges Rippleshot s 2018 Projections Contributing factors Drive towards digital transformation and improving the customer experience prioritized over stopping fraud Continued data breaches but focused on PII information Less push toward legislation and more focus on growth EMV acceptance forcing new fraud schemes including growth in gas station skimming 22
State of Card Fraud: 2018 Thank You. Thank you for reading our State of Card Fraud 2018 report. We hope it arms your leadership and fraud management teams with deeper insight into how the industry is evolving, provides benchmark data to help you determine how your organization compares, and delivers insights into what FIs should expect. Questions? Contact Marketing Director Anna Kragie at: anna@rippleshot.com Rippleshot 227 W Monroe St Suite No. 5200, Chicago, IL 60606