Fragmentation of Fraud
Transcription
Fragmentation of Fraud
Fragmentation of Fraud November 2014 A unique view on International eCommerce fraud Contents WHY ANOTHER FRAUD REPORT? A unique opportunity 3 A unique approach 9 The fraud landscape 10 Global complexity Gaining understanding FOREWORD 4 EXECUTIVE SUMMARY 5 Fragmented fraud landscape DETAILED FINDINGS Changing fraud patterns Coping with globalising fraud Proliferation of markets A comprehensive approach required Proliferation of channels Proliferation of payment types Merchants are losing the battle Keeping up Finding the right solution A comprehensive tailored approach So what? 12 International fraud The fragmentation of fraud Fragmentation by channel What tools should I use Barriers to change CONCLUSION 20 The new battle lines are drawn Customer choice or security? The time to act is now Merchants’ key needs 14 Channel proliferation increases risk GLOSSARY OF TERMS Channel hopping Fragmentation by payment method 18 Deploying the right tools Key challenges Fragmentation by market Fighting future fraud 21 16 The growth of alternative payments New payment methods – new problems Fragmenting payment methods Fragmentation of Fraud 2 Why another fraud report? A unique opportunity As international commerce evolves at an unprecedented pace, we see vast opportunities being created for merchants to grow internationally. However, as commerce proliferates, so do opportunities for fraudsters. That’s why Worldpay has commissioned the first “fragmentation of fraud” study, to examine both the emerging fraud risks in this changing commercial landscape, and the future challenges of global online payments. A unique approach This report is the first study of its kind to simultaneously consider new markets, new payment types and new channels, globally. Worldpay commissioned a survey of online fraud management professionals in international merchant organisations. The opinion of a reformed fraudster was sought to contextualise the findings and provide further insight. Readers of this report will gain an understanding of: • Where and how fraud is affecting merchants • The challenges posed by the fragmentation of fraud • Potential approaches to fighting the fragmentation of fraud The first global report to simultaneously consider new markets, new payment types and new channels Fragmentation of Fraud 3 Foreword Tony Sales, ex-fraudster “In my opinion the report commissioned by Worldpay is the first to correctly analyse empirical data to provide true insight and reveal how fraudsters will attack online merchants’ systems over the coming months and years. Omni-channel retailing is exploding. But with omni-channel retailing comes omni-channel crime. And unlike merchants, fraudsters share information at the speed of light without the constraint of regulation or commercial imperative; which is why they are usually one step ahead of the good guys. Thanks to the internet, the world is a smaller place and most people can now buy goods from any country. Unfortunately so can criminal gangs. Using fake payment methods, from stolen credit card numbers to mobile wallet accounts, they can systematically attack companies around the world. Online merchants need to respond. Any good Loss Prevention team pays for itself. Yet the report highlights that 49% of teams feel under-resourced to adequately deal with the escalating threats their businesses face, leaving them vulnerable. This is a false economy and serious misjudgement. Criminal gangs are sophisticated. They will harvest this information, usually through social engineering, then hit that under-resourced company for many times more than a Loss Prevention team’s required budget, sometimes even leaving the company broken and unable to recover. Fraudsters evolve rapidly to respond to the obstacles they face in carrying out their business. The information contained in this report and the dynamic approach it promotes, should give merchants both the wake-up call and potentially the tools to do the same.” “This is a valuable contribution to the community of fraud professionals as it helps benchmark each company’s strategy, both in terms of resource management and channel/region focus. Like all good surveys, it helps you to start to ask the right questions and to reflect on the direction you should be taking your company” Considine Diarmuid Senior Commerce Operations Manager at Skype 49% of teams feel under resourced to adequately deal with the escalating threats their businesses face Fragmentation of Fraud 4 Executive summary The fraud landscape is increasingly fragmented The fragmentation of fraud Worldpay’s research, developed with fraud experts in over 270 organisations, reveals that the proliferation of countries, channels and purchase methods is creating a “fragmentation of fraud” for merchants. This splintering effect has resulted in a variety of fraudulent techniques and practices that are increasingly difficult to manage. Proliferation of markets Merchants trading online are increasingly looking further afield to drive growth. As the report shows, new geographies and different business models increasingly figure in their growth aspirations, creating new challenges in fraud management. Merchants in our survey already sell to an average of 14 different countries, with this figure increasing to an average of 23 for US merchants. Research methodology 274 interviews were conducted among those responsible for online fraud management in international merchants (with $50m+ turnover or equivalent) across 5 verticals, based in the UK, USA, China, Russia, Japan and India. Respondents completed a survey in September and October 2014. Research was conducted by Loudhouse, an independent research agency based in London. Figure A: Sample breakdown by country Figure B: Sample breakdown by sector UK 47 Retail 68 USA 53 Airline 50 China 43 Travel 55 Russia 40 Japan 40 Video games and digital content 51 India 51 Gambling 50 Total 274 Total 274 Fragmentation of Fraud 5 Proliferation of channels The proliferation of different channels is a crucial driver for merchant growth. Following the wild growth of m-commerce and the omni-channel approach, the goal of integrating multiple sales channels is increasingly seen as the benchmark, further multiplying potential fraud risks. As evidence of this, around 77% of merchants report that, within two years, purchases on mobile devices will make up a greater proportion of customer orders than now. This is expected to be even more likely in China (86%) and Russia (85%). Proliferation of payment types As merchants expand into new markets, to reach more consumers and increase sales, they need to consider new payment methods, including locally relevant payment types. These so-called “alternative” forms of payment typically have very different fraud and risk profiles to traditional credit card payments. Some 79% of merchants say that, within two years, alternative payment methods will make up a greater proportion of customer orders than now. Merchants are losing the battle – and need support Keeping Up Worldpay’s research shows merchants don’t have the appetite to invest heavily in keeping pace with the increasingly complex fraud landscape. Many are painfully aware of the scope of the evolving challenges. The increasing focus on online payments and the proliferation of fraud across different countries, channels and payment methods is making it harder than ever for merchants to manage risk. Merchants are painfully aware of the scope of evolving challenges Fragmentation of Fraud 6 Research Highlights: • 77% of merchants say a multi-channel payments approach makes fraud more difficult to identify, manage and prevent • 63% say their organisation struggles to keep ahead of fraudulent activities across payment methods • Around 70% admit they already struggle to keep ahead of fraudulent activities across borders • 79% admit combatting fraud in this changing landscape is a significant challenge for their organisation • Just one in five companies (20%) is very confident about its ability to manage new fraud threats Finding the right solution A comprehensive, tailored approach Worldpay’s research revealed that merchants are seeking comprehensive solutions that account for the ever changing global payments landscape. Specifically, merchants want risk management solutions that address multiple channels, across multiple payment types, in multiple markets. They also want tailored advice and tools, which have been designed with their sector in mind, and to be supported by fraud experts who work in partnership with them. Research Highlights • 89% would like a risk-management solution that includes all payment types, not just cards • E-wallets (78%) and mobile payments such as SMS (75%) are areas of fraud anxiety amongst the merchant community • 78% want a risk management solution tailored to their industry Fragmentation of Fraud 7 So what? Online commerce businesses are struggling to manage fraud threats across borders, purchase channels and payment methods. These three elements are expected to “fragment” even further in the next few years. Without the tools to gain an overview of these myriad individual payments, organisations are ill-equipped to identify, manage and prevent fraudulent transactions now and in the future. This report highlights the fact that merchants should consider fraud management solutions that are tailored to their specific sector and business. Moreover, these solutions must be easy to use and simply integrated into existing systems and processes. Many don’t have the time, expertise or budget to carry out the comprehensive work required to navigate the fragmenting landscape. Partnership with an expert fraud provider is an essential step in reducing the costs of fighting the fragmentation of fraud. Without the tools to gain an overview of these myriad individual payments, organisations are ill-equipped to identify, manage and prevent fraudulent transactions Research Highlights • 82% would like a partnership approach with a fraud expert • 57% of merchants said they need a dedicated omni-channel fraud and loss prevention team • However merchants lack the capacity to implement this. Around 50% don’t have the time, 45% lack budget and 45% don’t have the knowledge Fragmentation of Fraud 8 Detailed findings This section presents the research findings in more detail. It is split into five parts: 1 Go The fraud landscape 2 Go Fragmentation by market 3 Go Fragmentation by channel 4 Go Fragmentation by payment method 5 Go Fighting future fraud Fragmentation of Fraud 9 1. The fraud landscape Figure 1: Key challenges in identifying and preventing fraud 70% Growth of mobile payments Expanding global reach brings complexity The fraud landscape has never been more complex for merchants. The internationalisation of markets and evolution of purchase channels has opened the door to both revenue opportunities and greater fraud risk. Merchants feel challenged. 79% admit the proliferation of customer markets, purchase channels and payment methods is a significant challenge for their organisation when it comes to fraud. Key challenges The key challenges facing merchants when identifying and preventing fraud are: • Proliferation of channels, including mobile payments • Proliferation of payment types, including e-wallets • Proliferation of countries sold to, including purchases from particular countries 65% Purchases from particular countries 60% Number of channels merchants utilise 58% Number of countries that operated in / sold to 54% Growth of e-wallets 50% Keeping up with fraud trends and new fraudulent activities 47% Number of payment methods accepted Fragmentation of Fraud 10 Figure 2: Biggest fraud concerns In some cases, it is the sheer number of countries or channels to manage that creates the problem. For others, it is specific countries or payment methods – in particular mobile payments and e-wallets – that create the most concern. Against this backdrop, just 20% of merchant organisations are confident about their ability to manage new fraud threats, dropping to just 13% in the UK. Half of respondents to Worldpay’s survey say that keeping up with fraud trends is a challenge. Changing fraud patterns Perceptions of fraud vary around the globe, and Chinese merchants are more concerned than average about the levels of fraud – 67% say the volume of fraudulent online transactions has increased over the last 2-3 years. Identity theft emerges as a particular concern in India (80%) along with friendly fraud (75%). Meanwhile, Japanese merchants are more concerned than those in other markets about phishing, pharming and whaling (73%). Globally, merchants are most concerned by: identity theft; phishing/pharming/whaling; account takeover; friendly fraud; clean fraud (see Figure 2). Identity theft is a particular concern in India (80%) 71% 66% 63% Account takeover Identity theft Phishing/ Pharming/ Whaling 61% Friendly fraud 40% Affiliate fraud 54% Clean fraud 35% Triangulation schemes 50% Botnets 28% Man in the middle attack 43% Card testing 4% New threats not listed here 42% Re-shipping For glossary of terms click here Fragmentation of Fraud 11 2. Fragmentation by market Figure 3: Markets perceived to have most perpetrators of fraud International fraud Merchants in our survey already sell to an average of 14 different countries, and for US merchants, this figure increases to an average of 23. This complexity is only set to increase. 76% believe that, in two years’ time, international orders will make up a greater proportion than they do now (increasing to 98% in China). Outside of the US and Canada, regions with the most fraud perpetrators are Asia Pacific – in particular India, Japan, Russia and China. Dealing with the different languages and approaches to fraud in each of these geographies presents unique challenges to merchants operating abroad (See Figure 3). Coping with international fraud In this context, 7 out of 10 of merchants admit they already struggle to keep ahead of fraudulent activities across borders. A similar number believe fraud levels in particular countries will increase in the next two years for their organisation. This is particularly the case for merchants based in China (91%), while the UK is less pessimistic (55%). Merchants in our survey already sell to an average of 14 different countries, and for US merchants, this figure increases to an average of 23 Fragmentation of Fraud 12 A comprehensive approach required A number of unique challenges exist for merchants operating in multiple countries, requiring a comprehensive approach to tackling fraud (see Figure 4). In particular: • Integration of cross-border systems and gaining the right data for authentication purposes or single view of a customer • Increased volume of transactions or fraud in some countries vs. others (and neglect of certain markets), coupled with a lack of global oversight • Difficulty keeping up with foreign fraud management tools, complicated by language differences Further internationalisation looks inevitable for many merchants, which will exacerbate these challenges, and reinforce the need for fraud management solutions that can simultaneously address multiple markets, languages and fraud types in an integrated way. Figure 4: Main challenges of managing fraud across countries 58% 51% Integration between systems in individual countries Difficulty keeping up with different tools for each country 52% 49% We focus on some countries that are more likely to have fraudulent transactions, and neglect the others Increased volume of transactions from particular countries 43% Gaining a single view of an individual customer 39% Lack of oversight over all countries at a global level “Thanks to the internet, the world is a smaller place and most people can now buy goods from any country. Unfortunately so can criminal gangs. Using fake payment methods criminal gangs can systematically attack companies around the world. Online merchants need to respond.” 36% Language differences 31% Internal pressure to operate in or sell to different countries Tony Sales, ex-fraudster Fragmentation of Fraud 13 3. Fragmentation by channel Figure 5: Channels perceived to be most prone to fraud 69% Channel proliferation increases risk Merchants continue to expand into multiple channels to help fuel growth – 77% say that, within two years, purchases on mobile devices will make up a greater proportion of customer orders than now. ‘Omni-channel’ is an emerging concept for merchants seeking to simplify the consumer experience across its sales channels. This shift brings opportunities, but equally requires continued focus with three in four merchants focused on operating via new channels in the next two to three years. Channel proliferation comes with challenges. Some (77%) say a multichannel approach makes fraud more difficult to identify, manage and prevent. A similar number say it leads to greater exposure to fraud risk. This is expected to be even more likely in China (86%) and Russia (85%). Around 75% envisage that mobile fraud levels for their organisation will increase in the next two years. Third-party fraud The channel perceived to be most prone to fraud currently is online sales through a third-party website. Witness the huge success of Amazon, eBay and Alibaba. Gartner forecasts that by 2017, 70% of e-commerce sites in North America will be dependent on services from Amazon and/or eBay. Online sales through third party website 64% Mobile commerce (m-commerce) 55% Online website 39% Partner / sales agency / broker sales 77% 36% Telephone / call centre say a multi-channel approach makes fraud more difficult to identify, manage and prevent 34% Catalogue/mail order 25% Stores/branches 8% I don’t think that our channels are prone to fraud Fragmentation of Fraud 14 Figure 6: Biggest mobile risk factors The emergence of m-commerce brings further uncertainty with 64% believing mobile is highly prone to fraud. The key concerns for merchants are, as highlighted in Figure 6, largely connected to the security of the device, either through malware, spyware, unsafe data & network connections, or consumers losing their device. Tracking the device ID used to make the purchase will continue to be a key area of focus and innovation for merchants trying to fight fraud on mobile devices. 51% Malware on mobile devices 46% Spyware on mobile devices “Omni-channel retailing is exploding. But with omni-channel retailing comes omni-channel crime. And unlike merchants, fraudsters share information at the speed of light without the constraint of regulation or commercial imperative; which is why they are usually one step ahead of the good guys.” 46% Unsafe network and data connections Tony Sales, ex-fraudster 43% Consumers losing their mobile devices 34% Insecure applications / apps 34% Consumers not employing best practice for safe mobile transactions Fragmentation of Fraud 15 4. Fragmentation by payment method Figure 7: Level of fraud concern amongst those currently accepting each payment method 18% 18% The growth of alternative payments Offering relevant payment methods is a crucial element of growing internationally, as shown by the 2nd edition of Worldpay’s Alternative Payments Report. The share of alternative (non-card) payment methods is expected to rise to 59% of all e-commerce spend by 2017, driven by consumers in emerging markets and the rise of e-wallets. This view is shared by the merchants we surveyed, with 79% believing that within two years, alternative payment methods will make up a greater proportion of customer orders than now. New payment methods – new problems Against this backdrop, 73% of merchants surveyed think that non-card payment fraud levels (as a percentage of all online transactions) will increase in the next two years. 63% of merchants say their organisation struggles to keep ahead of fraudulent activities across payment methods today, rising to 74% among merchants in China. New virtual currencies such as Bitcoin are becoming a material concern for merchants (82%), as highlighted in Figure 7. E-wallets (78%) and mobile payments such as SMS (75%) also register as areas of fraud anxiety amongst the merchant community. Mintel reports that the number of Chinese people making payments through mobile phones reached 125 million last year, up 126% from the previous year. 18% 18% 22% 22% 35% 35% 43% 43% 39% 47% 47% Credit Credit card card 25% 25% 26% 26% 45% 45% Virtual such asas Bitcoin such as PayPal Virtualcurrency, currency, such Bitcoin E-wallet, E-wallet, such as PayPal 33% 33% 23% 23% 49% 49% 45% 45% Mobile phone, by SMS/text Mobile phone, by SMS/text to customer’s mobile bill to customer’s mobile bill Debit card Debit card 17% 17% 40% 40% Direct bank transfer, such as via online banking Direct bank transfer, such as via online banking 39% 39% 21% 21% 40% 40% Prepaid card, giftcard Prepaid card, giftcard or cashcard or cashcard 10% 10% 14% 14% 62% 62% 45% 45% 42% 42% 33% 33% 28% 28% 41% 41% Offline banking payments Offline banking payments Cash on delivery Cash on delivery Very concerned Somewhat concerned Not very concerned Fragmentation of Fraud 16 Reasons for concern vary. Some payment methods are considered fundamentally less secure (79%) while others are seen as more likely targets for hackers (69%). Meanwhile, less than effective solutions to identify and fight fraud in certain payment methods are also a concern (55%). Figure 8: Challenges in identifying, managing and protecting against fraud across different payment methods Fragmenting payment methods The reasons all point to a lack of confidence in the ability to manage fraud across payment methods. The rise of alternative payment methods will continue to contribute to the fragmentation of fraud. Key challenges to identifying, managing and protecting against fraud across different payment methods are similar to those for new markets. Merchants point to (see Figure 8): • Lack of visible fraud data across all payment methods • Gaining a single view of each customer • Increased volume of transactions for particular payment methods • Difficulty keeping up with different tools for each payment method 58% “There are many ways that fraudsters can “pay” for goods. The most obvious method is stolen credit card numbers, but there is an ever widening choice. E-wallets are used by fraudsters to not only pay for goods but also to steal money from the victim.“ Lack of visibility over all payment methods at a holistic level 52% 50% Increased volume of transactions for particular payment methods Gaining a single view of an individual customer 50% 45% 36% Focus on some payment methods that are more likely to have fraudulent transactions, and neglect others Difficulty keeping up with different tools for each payment method 34% Integration between systems for individual payment methods Internal pressure to offer new payment methods Tony Sales, ex-fraudster Fragmentation of Fraud 17 5. Fighting future fraud Ensuring tools are relevant Merchants are clear about how they would like to tackle future fraud and are clear on partners to work with. But they are struggling to find a solution under one roof. Figure 9: Barriers to controlling / reducing level of fraudulent orders and transactions 49% 57% Lack of time to investigate or implement methods Not having a dedicated omni-channel fraud and loss prevention team Currently, the main tools and tactics used to prevent fraud are validation services (93%) or proprietary/customer data (83%). These tools remain the most likely to be used in two to three years’ time. Purchase device tracking and multi-merchant data are less frequently mentioned. Just under half of merchants, however, review their fraud prevention and risk management strategy every six months or less. Typically it is reviewed annually (42%). Given how quickly fraud threats evolve, this may no longer be enough. Barriers to change Merchants identify a number of barriers to controlling, and therefore reducing, their organisation’s level of fraudulent orders and payments. These include not having a dedicated omni-channel fraud and lossprevention team, lack of time to investigate / implement methods, lack of budget, or the perceived high cost to invest in better processes and measures (see Figure 9). 29% Fraud levels are not deemed high enough 45% Lack of budget / high cost to invest in better processes or measures 42% Lack of knowledge / not clear how we would do it 26% Challenges with system integration 40% Inadequate methods available on the market 31% Lack of senior buy-in Fragmentation of Fraud 18 Figure 10: Relative importance of elements in a fraud management solution Deploying the right tools Merchants also point out that, in today’s fragmented landscape, fraud-prevention tools should include all types of payment method transactions, not just cards (89%). The optimum system for identifying, managing and preventing fraud in their organisation would be tailored to their industry (78%). Beyond this, attributes merchants appreciate in a fraud solution are ease of use, integration with other systems and applications, and a solution that is customised to the needs of the business (see Figure 10). Partnership with a fraud expert is also seen as crucial to keep ahead of threats (82%). Ease of use 61% 34% 5% Intregration with other systems and applications 55% 42% 4% Customised to the needs of my business 53% 41% 5% Provision of real time reports and performance 49% 38% 13% Uses many data sources so decisions are more accurate 49% 41% 10% 49% 3% Relevant to my industry 48% “Any good Loss Prevention team pays for itself. Yet the report highlights that 49% of teams feel under resourced to adequately deal with the escalating threats their businesses face, leaving them vulnerable. This is a false economy and serious misjudgement. “ Tony Sales, ex-fraudster Provision of training and development to enhance the skills needed 47% 47% 6% Demonstrated track record of effectiveness and success 45% 45% 11% 50% 10% Short implementation time 41% A close partnership with the fraud prevention solution provider Very concerned 39% 51% 10% 47% 15% 58% 6% Future - proof 38% Overall cost 36% Critical Fairly important Fragmentation of Fraud Not particularly important 19 Conclusion The new battle lines are drawn Managing fraud is an ongoing battle for merchants. Internationalisation will continue apace – as will the challenges of staying ahead of fraud. Adding new payment methods and broadening reach adds complexity and uncertainty. Merchants are looking for better advice to ensure the risks of expansion are calculated. Sales channels will continue to evolve. The mobile payments market will continue to grow exponentially. The avenues open to the fraudster are multiplying and diversifying. Customer choice or security? Battening down the hatches is not the only answer. Market conditions and consumer demand dictate that merchants must offer choice and flexibility. It is clear the fragmentation of fraud that results from these market forces is proving a complex challenge to merchants keen to maximise revenues without leaving themselves exposed. Many of these challenges arise from a lack of visibility across countries, channels and payment methods. This results in difficulty in even identifying the extent of the problem, let alone effectively managing it. Keeping up with the different threats that are emerging across the global payments landscape, as well as the tools that are available to tackle these threats, are pain points for merchants. The time to act is now All merchants face challenges in providing dedicated resources, budget, time and knowledge. But standing still will not solve the challenges identified in this report. Merchants are increasingly demanding a comprehensive fraud solution across markets, channels and payment types, which recognises that each sector is different. Whether retail and gambling, video gaming or airlines, every sector faces common challenges but, at the same time, very specific threats. The research highlights merchants’ key needs: • The automation of specialised investigations • A risk-management tool that includes all payment types • A risk-management tool that is tailored to their industry • A partnership approach with a fraud expert Merchants are demanding a comprehensive fraud solution Fragmentation of Fraud 20 Glossary of terms Pharming Redirecting a website’s traffic to a fake site. Phishing Luring victims into surrendering information that will be used for identity theft. Whaling Hijacking the computers of top-ranking business execs. Account takeover Posing as a genuine customer to gain control of an account. Identity theft Stealing personal details to commit fraud. Friendly fraud Making an online purchase then disputing the charges in a bid to win a refund. Affiliate fraud Simulating campaign traffic to earn fraudulent commissions. Clean fraud Using detailed information about customers to ensure fraudulent transactions on their stolen credit cards pass merchants’ typical checks. Triangulation A process involving buying an item online with a stolen credit card then selling it on an auction site. Botnets Distributing malware that turns a victim computer into a bot that performs automated tasks over the internet. Man-in-the-middle attack Interjecting into a communication between two parties – then making demands from either party in the guise of the other. Card testing Making low-value online purchases using stolen credit cards or randomly generated card numbers in a bid to identify valid card details. Re-shipping Purchasing items online with stolen credit cards then incentivising unaware third parties into forwarding the goods on. back to page 11 Fragmentation of Fraud 21 Fragmentation of Fraud November 2014 © Worldpay 2014. All rights reserved. This document and its content are proprietary to Worldpay and may not be reproduced, published or resold. The information is provided on an “AS IS” basis for information purposes only and Worldpay makes no warranties of any kind including in relation to the content or sustainability. Terms and Conditions apply to all our services. Worldpay (UK) Limited (Company No. 07316500 / FCA No. 530923), Worldpay Limited (Company No. 03424752 / FCA No. 504504), Worldpay AP Limited (Company No. 5593466 / FCA No. 502597). Registered Office: The Walbrook Building, 25 Walbrook, London EC4N 8AF and authorised by the Financial Conduct Authority under the Payment Service Regulations 2009 for the provision of payment services. Worldpay (UK) Limited is authorised and regulated by the Financial Conduct Authority for consumer credit Activities Worldpay, the logo and any associated brand names are all trade marks of the Worldpay group of companies.