Spotting Credit Card Fraud

Knowledge, advice and some high-tech software should help merchants combat fraud.

It was about 80 years ago when the credit card age, as we know it, began. Hotel chains and oil companies in the U.S. gave out a card in 1920 that customers could use for purchases. Thirty years later, the first-ever universal “plastic” was issued to 200 of Diners Club Inc.’s customers who were free to use the cards at 27 restaurants in New York City. From then until 1970, the credit card wasn’t a big part of life, until the birth of the magnetic strip and its placement on the card that year.

Decades later, and millions of new cards being issued worldwide each year (150 million in 2001 alone), there were bound to be problems. People discovered they could use these numbers without getting caught through such payment methods as telephone and e-commerce.

Fraud became the major bug in the credit card age.

“The credit card industry was designed strictly and solely for you the card holder, your card and your signature to be at the merchant location, and there were no exceptions to that,” said Michael Keresman, CEO of CardinalCommerce, a leading provider of technology-neutral authentication platforms for electronic and wireless commerce since 1999. “(Now) consumer confidence is undermined by fraud. And merchants that even use some fraud prevention systems — address verification — if you get too tight on those in the current world, they actually restrict (a merchant’s) ability to sell in a certain market, like international.”

How Merchants Can Protect Themselves

Last year, Americans charged about US$1.4 trillion on their credit cards, but card issuers lost about $1 billion to credit card fraud, and merchants felt the pinch of about $10 billion. Since fraud has had such an economical impact on businesses, some merchants spend large sums of money on software to avoid it. But how can merchants protect themselves from fraud? CardinalCommerce has created its Cardinal Centinel Authentication Software for Merchants, which ensures that merchants take all the necessary steps to guarantee payment, and thus are not responsible for fraud.

“We enable merchants to comply with the new operating rules of MasterCard and Visa so that by definition, they are off the hook for fraud,” Keresman noted. “So we essentially become that player that takes care of all of these new payment initiatives and provide the comfort of fraud-free transactions.”

Even though all banks don’t use Verified by Visa or MasterCard SecureCode, the CardinalCommerce software satisfies the operating requirements of the credit companies, noting that the merchant did try to authenticate each transaction (for the banks that do not use Verified or SecureCode). And it is easy to use.

“We designed (our system) so that it can be done by the merchant, a shopping cart, a merchant service provider, the acquiring bank or the processors,” said Keresman. “So we designed (it) from the beginning so that it was very easy to deploy it at any part of that transaction supply chain. And because of our centralized architecture, our centralized ASP model, we can easily be part of (the bank’s) product offering to merchants.”

With Cardinal Centinel, merchants can take payments without the need of multiple software programs, a checkout process is included, and the software adapts to all payment types, so the merchant can concentrate on the business and not on whether or not the technology is up and running.

“We knew that the only obstacle standing in the way of merchant adoption would be how do we deploy this? And if it was very complicated, very sophisticated and it took merchants or their different providers too much time and energy and it was too complicated, that would impair adoption,” said Keresman. “It has to be easy to use. It has to be easy to deploy.”

The software allows access to Visa and MasterCard verification programs, and when American Express and Discover release theirs, each one will be loaded onto the CardinalCommerce server, giving merchants immediate access to the amendment.

“What’s nice about our system is that anytime there is a change, we put that in our ASP, our central servers, and instantly, all of our merchants, our entire merchant network has access to those changes. It’s real time,” Keresman explained. “So what that means is that we really become technology neutral and change neutral. It doesn’t matter how many changes there are, once a merchant picks Cardinal, we take care of the rest… If they (merchants) go to a merchant service provider or gateway or something like that, we can very easily incorporate their gateway.”

How Can Fraud Be Stopped?

Card-issuing companies are trying to figure out how to stop fraud at card-not-present transactions. But this doesn’t just involve orders over the Internet or telephone — it also includes other areas, such as pay-at-the-pump for gasoline. These cards are currency, and card-issuing companies are working towards making the numbers less accessible. By having to insert a user name and password, or even a personal identification number (PIN) such as the one required with debit card transactions, the chances of fraud occurring is virtually eliminated.

About 10 years ago, France adopted a credit card that didn’t have a signature on the back, but instead, required a PIN number for verification. Since then, fraud in the country has been reduced by about 80 percent.

In May, the U.K. had its first public trial of PIN numbers on credit cards, which is expected to spread to the rest of the country by 2005. About 80,000 people living in Northampton were given these cards, which need a PIN number for successful verification. Although the incorporation of these cards into the country will cost about ₤1.1 billion (about US$1.8 billion), fraud cost U.K. businesses ₤424.6 million (about US$692.5 million) in 2002, thus making the money worthwhile.

Also in the U.K., credit cards that contain microchips will soon be incorporated. This will be the first country in the world to introduce these chips, and thus, meet a new global standard for cards called EMV (EMV is a global set of requirements created by Europay, MasterCard and Visa — hence, EMV — in an effort to create a set of global standards so chip cards and terminals can work together at all institutions and card associations). The cards will be issued from July and onwards.

In the U.S., both MasterCard and Visa are trying to find a way of letting people know that shopping online and over the telephone is safe, by coming out with new ideas for eliminating fraud. One of these ideas was to introduce a user name and password.

“What Visa and MasterCard want to do is change that credit card number from a hot number to a low, as a customer reference account,” said Keresman. “So, what you would have is a card that you are holding and a signature… and a user name/password.”

When consumers feel safe making a purchase, it is beneficial to the merchant because studies have shown that shoppers generally spend more when they feel comfortable.

“All the studies show that when consumers use another factor of authentication, particularly user name and password, they buy more frequently and the average ticket price is higher,” Keresman noted.

Why Are People Still Reluctant To Shop Online?

The biggest influence on whether or not an individual will shop online is security, according to a MasterCard International study from May. For those who do shop on the Internet, 97 percent of the transactions are made via credit or debit card, according to CardinalCommerce. Keresman points out that many people are reluctant to give their number out where the merchant cannot be seen, which includes buying over the telephone or the Internet.

Fear of card-not-present transactions was evident when telephone orders became popular. At that time, both MasterCard and Visa told merchants that if fraud occurred, they would be 100 percent responsible, according to Keresman. Now there are billions of card-not-present transactions via the Internet, cell phone, telephone, etc., and credit card companies are no longer afraid. They want people to shop online and order items over the telephone. But consumer confidence remains the biggest issue thwarting its growth.

“At the root of that is customer confidence and fraud undermines customer confidence, consumer confidence,” said Keresman.

The MasterCard study also revealed that online security issues are keeping those who feel confident from making more purchases on the Internet. The study involved 1,000 U.S. consumers and their shopping habits in a card-not-present environment, noting that the biggest concerns for these consumers were: security features that need to be enhanced (73 percent), fraud (70 percent), and fear that a hacker will intercept a credit card number during the transaction (61 percent).

How Can Merchants Be Aware of Fraud?

One in every six consumers has been the target of Internet fraud either in the form of identity theft, cash fraud or product fraud.

In 2002, the U.S. Federal Trade Commission reported 161,819 cases of identity theft, making it the most common fraud complaint, and costing consumers more than $343 million. Identity fraud takes place when a hacker gains access to a Web site and acquires information such as credit card numbers, social security numbers, etc. The criminal then uses this information to assume the individual’s identity and applies for credit cards, bank accounts and even cell phones in that person’s name. After bad cheques are cashed and credit card bills are run up, it is ultimately the individual who suffers.

Cash fraud (a.k.a. “merchant account takeover” or “hijacking”) happens when a hacker gets into a merchant’s shopping cart or virtual cash register and finds the merchant’s gateway account and password. The individual then accesses the account and refunds money to his or her credit card.

There are a few common signs to demonstrate that product fraud might be taking place. Sometimes merchants have to be weary of first-time shoppers, because often, credit card thieves will place an order with a merchant only once so that their trail cannot easily be followed. Orders that are larger than normal are often a good sign that something isn’t right, and if the purchase is made up of the same product in multiple quantities, it may mean that the thief is looking to resell the goods. Merchants should also look for orders that go to one address, but are placed on multiple cards.

The Market Now and Into The Future

Merchants and banks see the Internet as a new way to sell products, without high infrastructure costs. Banks see e-commerce as a means of lowering the number of transactions where cash or cheques (a.k.a. paper) are involved. Since 75 percent of all transactions are done via paper, and banks lose money on these transactions (it costs over $2 to process a cheque, according to Keresman), banks are hoping more people will move towards using debit and credit cards for all their needs.

“MasterCard and Visa believe that by the year 2005, perhaps 2006, half of their transactions will be in a card-not-present or signature-less environment, and how do we make it easy for consumers? How do we make sure they have the comfort and confidence to buy in those environments?” asked Keresman. “I’ll use my card if I feel comfortable, and I will use it more and more places.”

The Internet has the capability of becoming a great distribution channel. But, if the fear of shopping in a card-not-present transaction situation continues at the same level it is at now, then the Internet will not reach its full potential. In addition, if fraud continues at its pace, merchants will have to endure charge backs and other fraud-induced attacks, which can be quite costly. Currently, many merchants pay a charge back fee of $10 to $30 each time they have to reimburse the cardholder.

CardinalCommerce has been successful in fighting fraud, and their reputation is very well known as a result. This is demonstrated through the new partnerships that are constantly being formed between them and others in the industry. In fact, they are currently partnered with over 50 companies and are still expanding.

“There are over six million merchants online today,” explained Keresman. “There are organizations that work directly with merchants all the time. They understand merchants — they work with them. And we felt the best way to help provide confidence with those merchants was to partner with someone that they know.”

Because of the success of their partnerships, CardinalCommerce could become the industry leader. Keresman believes it is important to have a “de facto” standard that everyone can use, thus keeping everything on the same level.

“When you look at a simple, elegant solution that’s robust and is lasting and can accommodate perpetual changes in the card industry, wouldn’t it be great to have a simple standard that everybody could use?” Keresman asked. “Your choice of a provider should be a company that not only can handle Visa on the Internet, but the other payment types and also someone who has a platform that can handle other distribution channels. And if you go through that, there is only one choice out there – Cardinal.”