Using Technology to Reduce Payment Card Fraud
Last year, United States consumers and businesses were responsible for about 27 percent of payment-card purchases around the globe. They were also responsible for 47 percent of global payment-card fraud. That's according to a September 2011 issue of the payments card industry newsletter, The Nilson Report. But why was payment card fraud so disproportionately high for the U.S. transactions? The answer has much to do with this country's slowness in adopting a technology for payment cards that many other countries—developed as well as undeveloped—adopted some time ago.
Doug King, a payments risk expert in the Atlanta Fed's Retail Payments Risk Forum, wrote a working paper earlier this year that looks at the experiences of other countries that reduced fraud after they adopted EMV chip technology (named for the companies Europay, MasterCard, and Visa). King summarized the paper in a subsequent post in the forum's blog, Portals and Rails, reproduced below with some modifications.
Payment cards in many countries now rely on the EMV global standard using chip technology. Data out of these countries are showing that these cards used along with PIN verification are more secure than the magnetic-stripe cards still predominately used in the United States.
The paper explores the experience of multiple European, Asian-Pacific, and North American countries that have migrated away from magnetic-stripe payment cards to EMV chip cards using PIN verification. Where information and data are available, the paper reviews the reason behind the particular country's migration to chip-and-PIN, the actual migration process, and the migration's success in reducing payment card fraud. It also examines the pattern of fraud migration from chip-enabled payment transactions to non-chip-enabled payment transactions. Finally, the paper closes by examining current payment card fraud trends in the United States and potential implications of prolonging a migration to chip-enabled payment technology.
What we found in the data is a recurring pattern of fraud losses. For instance, the data show that chip-and-PIN has been highly successful in the domestic card-present environment (that is, where the customer has the physical card, which is swiped) in reducing counterfeit and lost or stolen card fraud. This chart depicts the United Kingdom's positive domestic card-present experience.
On the other hand, fraud on non-chip-and-PIN transactions—most notably in the card-not-present (that is, where transactions take place over the Internet or via the telephone) and cross-border environments—has actually increased. Ultimately, the net results to date on EMV chip-and-PIN's impact on total card fraud losses in these countries have been marginal. As an example, this next table shows Canada's growing card-not-present fraud loss trend.
The working paper uses the Netherlands experience as a case study because of the country's similarities to the United States. Much like the United States, the Netherlands was experiencing low rates of payment card fraud, so this country did not migrate to the EMV standard when all the rest of Europe was adopting it. Eventually, fraud loss rates in the Netherlands climbed, ultimately propelling the Netherlands banking industry into implementing chip-and-PIN.
Like the Netherlands, the United States is now seeing a growth of card fraud loss rates on both credit and debit cards. As we've blogged several times, the costs for an EMV implementation here in the United States have so far outweighed the fraud loss reduction benefits of chip-embedded cards, according to some industry stakeholders. But given the parallels between the United States and the Netherlands, it is reasonable to expect card fraud losses to continue to grow here as long as the industry relies on mag-stripe technology.
Clearly, there is a need for industry coordination for an EMV implementation to effectively reduce payment card fraud. Based on the fraud trends experienced by countries adopting EMV chip-and-PIN, implementing the EMV standard in the United States for only certain types of card products or without solutions for mitigating card-not-present fraud could lead to only a marginal reduction in total fraud losses as fraudsters seek to exploit the lowest hanging fruit.
It should be noted that while the card industry in each of the countries investigated in the working paper adopted PIN authentication, this method is only one of several options. The working paper focused on PIN authentication because of the abundance of card fraud and transaction data reported by these countries' payments industries.
For more details on the successes and failures that a number of countries have experienced in moving to EMV technology, read the paper on our website.
By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed
August 29, 2012