Credit card fraud


Credit card fraud is an inclusive term for fraud committed using a payment card, such as a credit card or debit card. The purpose may be to obtain goods or services, or to make payment to another account which is controlled by a criminal. The Payment Card Industry Data Security Standard is the data security standard created to help businesses process card payments securely and reduce card fraud.
Credit card fraud can be authorised, where the genuine customer themselves processes a payment to another account which is controlled by a criminal, or unauthorised, where the account holder does not provide authorisation for the payment to proceed and the transaction is carried out by a third party. In 2018, unauthorised financial fraud losses across payment cards and remote banking totalled £844.8 million in the United Kingdom. Whereas banks and card companies prevented £1.66 billion in unauthorised fraud in 2018. That is the equivalent to £2 in every £3 of attempted fraud being stopped.
Credit cards are more secure than ever, with regulators, card providers and banks taking considerable time and effort to collaborate with investigators worldwide to ensure fraudsters aren't successful. Cardholders' money is usually protected from scammers with regulations that make the card provider and bank accountable. The technology and security measures behind credit cards are becoming increasingly sophisticated making it harder for fraudsters to steal money.

Means of payment card fraud

There are two kinds of card fraud: card-present fraud and card-not-present fraud. The compromise can occur in a number of ways and can usually occur without the knowledge of the cardholder. The internet has made database security lapses particularly costly, in some cases, millions of accounts have been compromised.
Stolen cards can be reported quickly by cardholders, but a compromised account's details may be held by a fraudster for months before any theft, making it difficult to identify the source of the compromise. The cardholder may not discover fraudulent use until receiving a statement. Cardholders can mitigate this fraud risk by checking their account frequently to ensure there are not any suspicious or unknown transactions.
When a credit card is lost or stolen, it may be used for illegal purchases until the holder notifies the issuing bank and the bank puts a block on the account. Most banks have free 24-hour telephone numbers to encourage prompt reporting. Still, it is possible for a thief to make unauthorized purchases on a card before the card is canceled.

Prevention of payment card fraud

Card information is stored in a number of formats. Card numbers – formally the Primary Account Number – are often embossed or imprinted on the card, and a magnetic stripe on the back contains the data in machine-readable format. Fields can vary, but the most common include: Name of card holder; Card number; Expiration date; and Verification CVV code.
In Europe and Canada, most cards are equipped with an EMV chip which requires a 4 to 6 digit PIN to be entered into the merchant's terminal before payment will be authorized. However, a PIN isn't required for online transactions. In some European countries, if you don't have a card with a chip, you may be asked for photo-ID at the point of sale.
In some countries, a credit card holder can make a contactless payment for goods or services by tapping their card against a RFID or NFC reader without the need for a PIN or signature if the cost falls under a pre-determined limit. However, a stolen credit or debit card could be used for a number of smaller transaction prior to fraudulent activity being flagged.
Card issuers maintain several countermeasures, including software that can estimate the probability of fraud. For example, a large transaction occurring a great distance from the cardholder's home might seem suspicious. The merchant may be instructed to call the card issuer for verification or to decline the transaction, or even to hold the card and refuse to return it to the customer.

Types of payment card fraud

Application fraud

Application fraud takes place when a person uses stolen or fake documents to open an account in another person's name. Criminals may steal or fake documents such as utility bills and bank statements to build up a personal profile. When an account is opened using fake or stolen documents, the fraudster could then withdraw cash or obtain credit in the victim's name. To protect yourself, keep your details private and store sensitive documents in a secure place and be careful how you dispose of personal identifiable information.

Account takeover

An account takeover refers to the act by which fraudsters will attempt to assume control of a customer's account. Control at the account level offers high returns for fraudsters. According to Forrester, risk-based authentication plays a key role in risk mitigation.
A fraudster uses parts of the victim's identity such as an email address to gain access to financial accounts. This individual then intercepts communication about the account to keep the victim blind to any threats. Victims are often the first to detect account takeover when they discover charges on monthly statements they did not authorize or multiple questionable withdrawals. Recently there has been an increase in the number of account takeovers since the adoption of EMV technology, which makes it more difficult for fraudsters to clone physical credit cards.
Among some of the most common methods by which a fraudster will commit an account takeover include proxy-based "checker" one-click apps, brute-force botnet attacks, phishing, and malware. Other methods include dumpster diving to find personal information in discarded mail, and outright buying lists of 'Fullz,' a slang term for full packages of identifying information sold on the black market.

Social engineering fraud

fraud can occur when a criminal poses as someone else which results in a voluntary transfer of money or information to the fraudster. Fraudsters are turning to more sophisticated methods of scamming people and businesses out of money. A common tactic is sending spoof emails impersonating a senior member of staff and trying to deceive employees into transferring money to a fraudulent bank account.
Fraudsters may use a variety of techniques in order to solicit personal information by pretending to be a bank or payment processor. Telephone phishing is the most common social engineering technique to gain the trust of the victim.
Businesses can protect themselves with a dual authorisation process for the transfer of funds that requires authorisation from at least two persons, and a call-back procedure to a previously established contact number, rather than any contact information included with the payment request. Your bank must refund you for any unauthorised payment, however they can refuse a refund on the basis: it can prove you authorised the transaction; or it can prove you are at fault because you acted deliberately, or failed to protect your details that allowed the transaction.

Skimming

Skimming is the theft of personal information having used in an otherwise a normal transaction. The thief can procure a victim's card number using basic methods such as photocopying receipts or more advanced methods such as using a small electronic device to swipe and store hundreds of victims' card numbers. Common scenarios for skimming are restaurants or bars where the skimmer has possession of the victim's payment card out of their immediate view. The thief may also use a small keypad to unobtrusively transcribe the three or four-digit card security code, which is not present on the magnetic strip.
Call centers are another area where skimming can easily occur. Skimming can also occur at merchants when a third-party card-reading device is installed either outside a card-swiping terminal. This device allows a thief to capture a customer's card information, including their PIN, with each card swipe.
Skimming is difficult for the typical cardholder to detect, but given a large enough sample, it is fairly easy for the card issuer to detect. The issuer collects a list of all the cardholders who have complained about fraudulent transactions, and then uses data mining to discover relationships among them and the merchants they use. Sophisticated algorithms can also search for patterns of fraud. Merchants must ensure the physical security of their terminals, and penalties for merchants can be severe if they are compromised, ranging from large fines by the issuer to complete exclusion from the system, which can be a death blow to businesses such as restaurants where credit card transactions are the norm.
Instances of skimming have been reported where the perpetrator has put over the card slot of an ATM a device that reads the magnetic strip as the user unknowingly passes their card through it. These devices are often used in conjunction with a miniature camera to read the user's PIN at the same time. This method is being used in many parts of the world, including South America, Argentina, and Europe.

Unexpected repeat billing

Online bill paying or internet purchases utilizing a bank account are a source for repeat billing known as "recurring bank charges". These are standing orders or banker's orders from a customer to honor and pay a certain amount every month to the payee. With E-commerce, especially in the United States, a vendor or payee can receive payment by direct debit through the ACH Network. While many payments or purchases are valid, and the customer has intentions to pay the bill monthly, some are known as Rogue Automatic Payments.
Another type of credit card fraud targets utility customers. Customers receive unsolicited in-person, telephone, or electronic communication from individuals claiming to be representatives of utility companies. The scammers alert customers that their utilities will be disconnected unless an immediate payment is made, usually involving the use of a reloadable debit card to receive payment. Sometimes the scammers use authentic-looking phone numbers and graphics to deceive victims.

Regulation and governance

United States

While not federally mandated in the United States PCI DSS is mandated by the Payment Card Industry Security Standard council, which is composed of major credit card brands and maintains this as an industry standard. Some states have incorporated the standard into their laws.

Proposed toughening of federal law

The Department of Justice has announced in September 2014 that it will seek to impose a tougher law to combat overseas credit card trafficking. Authorities say the current statute is too weak because it allows people in other countries to avoid prosecution if they stay outside the United States when buying and selling the data and don't pass their illicit business through the U.S. The Department of Justice asks Congress to amend the current law that would make it illegal for an international criminal to possess, buy or sell a stolen credit card issued by a U.S. bank independent of geographic location.

Cardholder liability

In the US, federal law limits the liability of card holders to $50 in the event of theft of the actual credit card, regardless of the amount charged on the card, if reported within 60 days of receiving the statement. In practice, many issuers will waive this small payment and simply remove the fraudulent charges from the customer's account if the customer signs an affidavit confirming that the charges are indeed fraudulent. If the physical card is not lost or stolen, but rather just the credit card account number itself is stolen, then Federal Law guarantees cardholders have zero liability to the credit card issuer.

United Kingdom

In the UK, credit cards are regulated by the Consumer Credit Act 1974. This provides a number of protections and requirements. Any misuse of the card, unless deliberately criminal on the part of the cardholder, must be refunded by the merchant or card issuer.
The regulation of banks in the United Kingdom is undertaken by the: Bank of England ; Prudential Regulation Authority a division of the BoE; and the Financial Conduct Authority who manages the day to day oversight. There is no specific legislation or regulation that governs the credit card industry. However the Association for Payment Clearing Services is the institution that all settlement members are a part of. The organisation works under the Banking Consolidation Directive to provide a means by which transactions can be monitored and regulated. UK Finance is the association for the UK banking and financial services sector, representing more than 250 firms providing credit, banking and payment-related services.

Australia

In Australia, credit card fraud is considered a form of ‘identity crime’. The Australian Transaction Reports and Analysis Centre has established standard definitions in relation to identity crime for use by law enforcement across Australia:
Estimates created by the Attorney-General's Department show that identity crime costs Australia upwards of $1.6 billion each year, with majority of about $900 million being lost by individuals through credit card fraud, identity theft and scams. In 2015, the Minister for Justice and Minister Assisting the Prime Minister for Counter-Terrorism, Michael Keenan, released the report Identity Crime and Misuse in Australia 2013–14. This report estimated that the total direct and indirect cost of identity crime was closer to $2 billion, which includes the direct and indirect losses experienced by government agencies and individuals, and the cost of identity crimes recorded by police.

Cardholder Liability

The victim of credit card fraud in Australia, still in possession of the card, is not responsible for anything bought on it without their permission. However, this is subject to the terms and conditions of the account. If the card has been reported physically stolen or lost the cardholder is usually not responsible for any transactions not made by them, unless it can be shown that the cardholder acted dishonestly or without reasonable care.

Vendors vs merchants

To prevent vendors being "charged back" for fraud transactions, merchants can sign up for services offered by Visa and MasterCard called Verified by Visa and MasterCard SecureCode, under the umbrella term 3-D Secure. This requires consumers to add additional information to confirm a transaction.
Often enough online merchants do not take adequate measures to protect their websites from fraud attacks, for example by being blind to sequencing. In contrast to more automated product transactions, a clerk overseeing "card present" authorization requests must approve the customer's removal of the goods from the premises in real time.
If the merchant loses the payment, the fees for processing the payment, any currency conversion commissions, and the amount of the chargeback penalty. For obvious reasons, many merchants take steps to avoid chargebacks—such as not accepting suspicious transactions. This may spawn collateral damage, where the merchant additionally loses legitimate sales by incorrectly blocking legitimate transactions. Mail Order/Telephone Order merchants are implementing Agent-assisted automation which allows the call center agent to collect the credit card number and other personally identifiable information without ever seeing or hearing it. This greatly reduces the probability of chargebacks and increases the likelihood that fraudulent chargebacks will be overturned.

Famous credit fraud attacks

Between July 2005 and mid-January 2007, a breach of systems at TJX Companies exposed data from more than 45.6 million credit cards. Albert Gonzalez is accused of being the ringleader of the group responsible for the thefts. In August 2009 Gonzalez was also indicted for the biggest known credit card theft to date — information from more than 130 million credit and debit cards was stolen at Heartland Payment Systems, retailers 7-Eleven and Hannaford Brothers, and two unidentified companies.
In 2012, about 40 million sets of payment card information were compromised by a hack of Adobe Systems. The information compromised included customer names, encrypted payment card numbers, expiration dates, and information relating to orders, Chief Security Officer Brad Arkin said.
In July 2013, press reports indicated four Russians and a Ukrainian were indicted in the U.S. state of New Jersey for what was called "the largest hacking and data breach scheme ever prosecuted in the United States." Albert Gonzalez was also cited as a co-conspirator of the attack, which saw at least 160 million credit card losses and excess of $300 million in losses. The attack affected both American and European companies including Citigroup, Nasdaq OMX Group, PNC Financial Services Group, Visa licensee Visa Jordan, Carrefour, J. C. Penny and JetBlue Airways.
Between 27 November 2013 and 15 December 2013, a breach of systems at Target Corporation exposed data from about 40 million credit cards. The information stolen included names, account numbers, expiry dates, and card security codes.
From 16 July to 30 October 2013, a hacking attack compromised about a million sets of payment card data stored on computers at Neiman-Marcus. A malware system, designed to hook into cash registers and monitor the credit card authorisation process, infiltrated Target's systems and exposed information from as many as 110 million customers.
On 8 September 2014, The Home Depot confirmed that their payment systems were compromised. They later released a statement saying that the hackers obtained a total of 56 million credit card numbers as a result of the breach.
On 15 May 2016, in a coordinated attack, a group of around 100 individuals used the data of 1600 South African credit cards to steal US$12.7 million from 1400 convenience stores in Tokyo within three hours. By acting on a Sunday and in another country than the bank which issued the cards, they are believed to have won enough time to leave Japan before the heist was discovered.

Countermeasures to combat card payment fraud

Countermeasures to combat credit card fraud include the following.

By Merchants