The Fraudsters Faithful Friend

Before the birth of the credit card and advent of online shopping, transaction fraud was rare. Fast forward to today and “plastic fraud” is rife and moreover expected by merchants, many of whom skip straight to damage limitation rather than trying to fight it. As the most popular payment method after cash, fraud figures involving credit cards have skyrocketed since the e-commerce boom of the 1990’s with fraud losses from UK-issued cards in 2014 alone, amounting to £479 million. “Card-not-present” transactions have made it all too easy for fraudsters to bypass crucial, physical control mechanisms including a signature, photo comparisons, or chip-and-PIN processes which simply cannot be carried out online.

Attempts to limit the losses

To limit rising figures, the credit card industry has made various attempts over the past 20 years to stop the fraudsters in their tracks, with varying degrees of success.

With the introduction of PCI DSS (payment card industry data security standard), merchants were required to implement security measures to secure credit card details that they had stored or collected. A 12-point list details the security requirements for merchants’ IT environments and those of Payment Service Providers and companies that don’t adhere to the requirements, are not permitted to perform credit card transactions. The introduction of the standard has affected mostly smaller merchants, whose lack of PCI certification means that their credit card transactions need to be performed by PSPs or other financial institutions who have the high security standards required. Unfortunately, the introduction of (and adherence to) PCI-DSS has not prevented the details of millions of cards from being stolen over the past few years, particularly from major merchants – ironically.

Other approaches to secure online credit card use have involved the card holder needing to provide the expiry date and address details to verify their identity. The latter can, however, only be verified in a few countries and even then, often not completely. In 3-D Secure, the industry thought it had scored its greatest hit. During this payment process, cardholders were redirected to the banks which issued their credit cards and asked to enter a secret code in a pop-up window. This requirement, however, led to customers terminating orders during the final step, either because they had forgotten their code or because they hadn’t registered with 3-D Secure in the first place. Although this option put the liability onto the bank and cardholder rather than the merchant for any fraudulent transactions, it was deemed a conversion killer and as well as reducing fraud it also reduced transactions.

As an alternative method of verification, most sites merely ask their customers to enter the security code (CVC, or Card Validation Code) printed on the back of their card when processing a transaction. As these codes may not be stored by the merchant or by any other partner involved in the transaction, this method provides a certain measure of security for the cardholder but is however useless if the card is stolen or photocopied.

The most recent approach to securing online credit card transactions is known as “tokenisation”. In order to carry out this process, credit card companies store a numerical “token” for each credit card in a database. This is then shared with the merchant during the online payment process, rather than sharing the credit card details themselves. The payment is authorised by automatically comparing the token with the credit card company’s database. The original idea was to assign a new token for each transaction, but for those merchants offering the popular one-click payment option, static tokens are needed which can be stored and re-used for each payment, which increases the risk once again.

No one-fix solution

The bottom line is that despite numerous efforts to make the credit card a secure method for online payment, they have not had a lasting effect due to a number of reasons, with fraud figures showing no signs of stabilising or decreasing in the short-term.

Criminals will always find loopholes and the processes designed to increase online security are often dismissed by merchants or poorly implemented, due to concerns around the affect upon order conversion rates. When it comes to card payments, there is, unfortunately, no one solution to this dilemma, as payments initiated by merchants which require data to be transmitted or stored in some form will always leave a back door open for data thieves.

The challenge for merchants is to incorporate alternative payment options to help them spread the risk and offer shoppers a more secure method for payment alongside the trusted and much loved credit card, whilst safeguarding their own finances.

[su_box title=”About Ralf Ohlhausen” style=”noise” box_color=”#336588″]Business Development Director Ralf Ohlhausen, MSc in mathematics and Master of Telecommunications Business, has over 25 years’ experience in e‑commerce, financial services, mobile telecommunications and IT. Before joining PPRO Group, he was President Europe at SafetyPay. Other management positions on his international career path took him to Digicel, O2, British Telecom and Mannesmann-Kienzle. At PPRO, Ralf is responsible for increasing PPRO’s global reach, focusing in particular on the addition of new payment choices to the company’s portfolio.[/su_box]