Ralf Ohlhausen of the PPRO Group considers how fraudsters exploit the security gaps in cards. No matter what the regulator enacts, from PCI DSS to EMV, fraudsters seem to find some way around it all. So what can financial institutions do to protect their customers from this omnipresent threat?
Before the birth of the credit card and advent of online shopping, transaction fraud was rare. Fast forward to today and ‘plastic fraud’ is rife and, moreover, expected by merchants, many of whom skip straight to damage limitation rather than trying to fight it.
Go deeper with GlobalData
As the most popular payment method after cash, fraud figures involving credit cards have skyrocketed since the e-commerce boom of the 1990s with fraud losses from UK-issued cards in 2014 alone, amounting to £479m ($677m).
‘Card-not-present’ transactions have made it all too easy for fraudsters to bypass crucial, physical control mechanisms including a signature, photo comparisons, or chip-and-PIN processes which simply cannot be carried out online.
Attempts to limit the losses
To limit rising figures, the credit card industry has made various attempts over the past 20 years to stop the fraudsters in their tracks, with varying degrees of success.
With the introduction of PCI DSS (payment card industry data security standard), merchants were required to implement security measures to secure credit card details that they had stored or collected.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataA 12-point list details the security requirements for merchants’ IT environments and those of Payment Service Providers and companies that don’t adhere to the requirements, are not permitted to perform credit card transactions.
The introduction of the standard has affected mostly smaller merchants, whose lack of PCI certification means that their credit card transactions need to be performed by PSPs or other financial institutions who have the high security standards required. Unfortunately, the introduction of (and adherence to) PCI DSS has not prevented the details of millions of cards from being stolen over the past few years, particularly from major merchants – ironically.
Other approaches to secure online credit card use have involved the card holder needing to provide the expiry date and address details to verify their identity.
The latter can, however, only be verified in a few countries and even then, often not completely. In 3-D Secure, the industry thought it had scored its greatest hit.
During this payment process, cardholders were redirected to the banks which issued their credit cards and asked to enter a secret code in a pop-up window.
This requirement, however, led to customers terminating orders during the final step, either because they had forgotten their code or because they hadn’t registered with 3-D Secure in the first place.
Although this option put the liability onto the bank and cardholder rather than the merchant for any fraudulent transactions, it was deemed a conversion killer and as well as reducing fraud it also reduced transactions.
As an alternative method of verification, most sites merely ask their customers to enter the security code (CVC, or Card Validation Code) printed on the back of their card when processing a transaction.
As these codes may not be stored by the merchant or by any other partner involved in the transaction, this method provides a certain measure of security for the cardholder but is however useless if the card is stolen or photocopied.
The most recent approach to securing online credit card transactions is known as ‘tokenisation’. In order to carry out this process, credit card companies store a numerical ‘token’ for each credit card in a database.
This is then shared with the merchant during the online payment process, rather than sharing the credit card details themselves. The payment is authorised by automatically comparing the token with the credit card company’s database.
The original idea was to assign a new token for each transaction, but for those merchants offering the popular one-click payment option, static tokens are needed which can be stored and re-used for each payment, which increases the risk once again.
No one-fix solution
The bottom line is that despite numerous efforts to make the credit card a secure method for online payment, they have not had a lasting effect due to a number of reasons, with fraud figures showing no signs of stabilising or decreasing in the short-term.
Criminals will always find loopholes and the processes designed to increase online security are often dismissed by merchants or poorly implemented, due to concerns around the affect upon order conversion rates.
When it comes to card payments, there is, unfortunately, no one solution to this dilemma, as payments initiated by merchants which require data to be transmitted or stored in some form will always leave a back door open for data thieves.
The challenge for merchants is to incorporate alternative payment options to help them spread the risk and offer shoppers a more secure method for payment alongside the trusted and much loved credit card, whilst safeguarding their own finances.
Rolf Ohlhausen is the business development director at the PPRO Group
