Organizations that do not have a good risk management solution in place can see fraud rates rise up to 60%. How can they tackle it?
By Nishanth Chandran
In e-commerce transactions, fraudsters collect data in two ways. In physical format or in digital format. Physical format involves a person simply copying the card details or skimming. Digital format involves phishing and spamming, whereby user data is collected by pirated software like trojan horses and transmitted to the fraudster.
Today, most data stolen is also sold in the open market as credit card dumps. These can be purchased via private chat, forums etc and are sold for between $2~3 per credit card details.
In India, different industries have different fraud rates. Organizations that do not have a good risk management solution in place can see fraud rates rise up to 60%. Social fraud is fast becoming another damaging matter. Fraudsters, in this case, do not intend to make direct profit, but rather aim at disturbing an organization or damaging their brand reputation.
How to get rid of fraud?
If a merchant wants to reach a zero fraud level, there is a very simple way: stop selling! Obviously this is not the option. Industry came a few years ago with a global initiative, 3D secure, which provides additional authentication measures for credit card transactions. It was initially developed by Visa, but was later adopted by MasterCard, under the name MasterCard SecureCode.
In India, the Reserve Bank of India (RBI) mandated two-factor authentication for net banking transactions and 3D secure for all credit card transactions. However, merchants need to additionally implement a sophisticated tool to prevent fraud for three main reasons. At first, 3D secure relies on card issuers to implement strong authentication mechanisms but some have failed to do so, leading to vulnerabilities. Secondly, besides cards, Indian merchants accept transactions for which they offer cash on delivery without typically screening them online. This leads to huge rates of returns, inefficient delivery, and loss of time and money. Also, all industries have unique needs.
For example, how often is it reasonable to buy the kind of goods the merchant is selling? If the merchant sells digital songs, it is very likely that some customers may come several times a day and buy songs. For Louis Vuitton bags, it is relatively unlikely that the same customer comes three or four times in a day to buy one or several bags. The two situations need to be treated differently.
New methods
Online fraud mainly started with Ibased fraud but when a solution to IP fraud was devised, fraudsters started to get behind a proxy, making it difficult to detect their true IP. Proxy detection tools were then created and helped prevent proxy-based frauds.
The latest tools for fraud detection include device finger printing solutions and transaction behavior mapping. Device finger printing, tracks the physical device in real time. It is relatively easy for a fraudster to change the name or address or email for each transaction. With limited IT skills the same fraudster can hide his proxy or change IP for each transaction. But changing the device for each transaction becomes cumbersome. Transaction behavior mapping uses artificial intelligence (AI) which maps the behavior between various elements of a transaction and gives a risk score.
Focused solutions
Every industry suffers a unique kind of fraud, and companies are currently offering focused solutions with industry-specific rules which are tailor made. These rules work in conjunction with tools: device finger printing solution and transaction behavior mapping with velocity checks.
Fraud evolves rapidly and tries to find loopholes in existing fraud detection and prevention technology. There are, however, some basic steps one can implement to ensure minimization, including a robust fraud prevention system and a 24×7 human monitoring team.
