How EMV Will Change Banking Fraud
Fiserv: Check Fraud, Synthetic IDs Will IncreaseU.S. financial institutions are preparing to migrate credit and debit cards from magnetic-stripe technology to more secure chip technology that conforms to the Europay, MasterCard and Visa standard. But shifting the technology is going to be a headache for issuers, merchants and processors, Fiserv's Stephanie Fuoco and Mike Urban say.
The U.S. is in wait mode to learn exactly how to route and handle EMV transactions, Fuoco says. While Visa and Mastercard have set some liability shift dates for 2015, financial institutions feel uneasy about meeting those dates with the issues still looming.
"Visa and MasterCard have not indicated that they're going to change those dates yet, but none of the major financial institutions or merchants are going to have a big push towards EMV until these other issues are resolved," Fuoco says during this first part of a two-part interview with Information Security Media Group [transcript below].
Banks also need to realize that fraud losses in other areas besides card use are likely to increase, Urban says.
"I think that as we go through this migration and become EMV compliant, we're going to see some shifting of fraud losses from a card perspective," Urban says. "Within a financial institution, it will appear that the losses are going down from a physical point-of-sale side of things, which is great in the card group. But we actually expect that there's going to be a shift into check fraud."
During part 1 of this interview, Urban and Fuoco discuss:
- How fraud will migrate from cards to other areas of banking;
- Why banking institutions should not lean too heavily on mobile when it comes to their EMV rollouts;
- Visa's and MasterCard's view of card fraud after the 2015 and 2017 liability shift dates.
Be sure to also check out the second part of this interview, where Urban and Fuoco discuss risks associated with Bitcoin and other emerging currencies.
Urban, who has more than 18 years of experience in financial crime management, analyzes financial crime issues and trends for Fiserv.
Fuoco is a senior sales support consultant for card services for Fiserv, where she leads a team responsible for integrated payment fraud service offerings.
How EMV Will Change Banking Fraud
TRACY KITTEN: Can you give our audience some background about where exactly the U.S. is in its migration toward EMV?
STEPHANIE FUOCO: Right now there are still some challenges that we are facing as an industry because of the multiple networks that we have in place. There is a common AID that needs to be defined in order for us, in the U.S. market, to know how to route and handle an EMV transaction. So until that, we're still in wait mode to see how we can migrate to EMV. That and in addition to Justice Leon's ruling on Durbin, we are still waiting to see if we have to have multiple networks on the front of the card, which will significantly impact how we issue those EMV cards. In the EMV markets from Fiserv's perspective, if there is a need to handle an EMV transaction for a specific group of cardholders, we can certainly issue those cards and handle those transactions, realizing that once these challenges that we have in the U.S. market are solved, they will have to reissue those cards.
MIKE URBAN: I would say that institutions today are looking at where EMV makes sense to them. A lot of issuers have frequent travelers outside of the United States who require chip and pin capabilities in order to use their cards, particularly at unattended Kiosks in parts of the world that have already migrated to chip and pin. Institutions are really taking a targeted look at particular client bases, or segments within their card customers, and targeting those specific places today. As Stephanie said, what are some of the more operational network abilities? What is the impact to change from a business perspective where institutions are still looking at the investment there, as well as the merchants that are looking at what they would have to make on that side as well.
Fraud Balance
KITTEN: How would you say banking institutions should start planning for the so-called fraud balance?
FUOCO: Today the U.S. market is seeing an increase in fraud from not only card-not-present, but also counterfeit fraud as the bordering countries have migrated to EMV. Some of the best practices that we've been sharing with our financial institutions are things like, look at their expiration terms and make sure that they have a non-multiple of twelve for the term. Then it is harder for the fraudster to guess what the expiration date is because we all know the old purchase data regardless if the expiration date is good or bad.
For the card-not-present type of fraud, that is still a challenge. It is hard to identify whether it is a good transaction or not. With a lot of fraud strategies that we put in place, we know typically the type of card-not-present transactions that have a tendency to be fraud, so we'll put different limits in place to limit the number of transactions. There are certain combinations that we will decline that we identify as typical fraud, but the card-not-present fraud is still a challenge. We strongly encourage financial institutions to have their card holders enroll in reading security. That would be verified by Visa, or MasterCard has secure codes because it does add an additional layer. But, that is only good if the merchant themselves are enrolled in the program. It does help reduce some of that fraud when both the merchant and the issuer are enrolled in the program.
URBAN: From a future fraud perspective, there is an increase in card-not-present already. There is an increase in skimming fraud, where that data is getting captured in other parts of the world and then the fraud is executed in the U.S. I think that as we go through this migration and become EMV compliant, have all the cards and terminals EMV capable, we're going to see some shifting of fraud losses from a card perspective. Within a financial institution, it will appear that the losses are going down from a physical point-of-sale side of things, which is great in the card group. But we actually expect that there is going to be a shift into check fraud.
Check fraud has not really gone away even though checks are declining. I expect to see, and have heard from other financial institutions and people in this industry, that they're expecting those losses are going to start to shift to other parts of financial institutions, and checks is an obvious one.
I think the other area that we're going to see increases is around first-party fraud; that's where criminals are creating synthetic identities and obtaining lending products. We saw that very large bust about a year ago; the $200 million bust in North Jersey where the criminals were basically using synthetic identities, getting credit cards and other lending products, using demand deposit accounts to create histories and payments on things. I think that financial institutions are going to have to think about how they are monitoring for checks today, and really look a lot closer at cross-channel frauds and understanding who they are on-boarding along the way. [They need to look] for anomalies, and sometimes an anomaly could be someone who is just too perfect in their account behavior; it could be that it is actually a groomed account criminals are using for other types of fraud purposes.
FUOCO: The future is Visa has already announced and MasterCard is also looking at single use tokens for online transactions where the cardholder can instead of using the card number, a token number would be tied to that merchant and the card which will help reduce some of the fraud losses for online. So it will be interesting to see how that project and that announcement evolves and what kind of impact that has on the card-not-present fraud.
Migration to Debit
KITTEN: What about this migration to debit? Where do you see the U.S. as far as timelines, or is that difficult to project based on where we are with some of the legislation?
FUOCO: That is a little bit difficult to predict right now. Visa and MasterCard have set some liability shift dates for 2015, and then gas terminals and ATMs for 2017. Right now the financial institutions are feeling uneasy because they should already be working on EMV migration to meet those liability shift dates. Visa and MasterCard have not indicated that they are going to change those dates yet, but none of the major financial institutions or merchants are going to have a big push towards EMV until these other issues are resolved. It will be interesting to see if Visa and MasterCard change those dates as we get closer to them without having a lot of these other challenges resolved. Right now, there is no specific timeline. Even if we had a financial institution try to register a project with Visa to start their migration, Visa would recommended that they wait until these other challenges are resolved. So Visa and MasterCard themselves aren't really pushing major projects right now.
Payment Technology in the U.S.
KITTEN: Do you think the U.S. might leapfrog to mobile or some other type of payment technology rather than relying solely on cards?
FUOCO: I was at a Visa meeting not too long ago and that was the exact point brought up; why are a lot of other countries that have already had EMV in place for a while beginning to shift to a mobile application? The question is, should the U.S. just go straight to mobile solution instead of the chip card? Right now, we don't see that as being the trend, because honestly, to go to mobile, you still need that same technology that is going to be used in the mobile device. There is still a lot of work that we would have to do, so the direction right now is to go with the card. It will be a while before all the merchants are fully capable to handle a mobile channel. I think in the U.S. we may see a combination of both, but I don't think the chip card itself is going to go away. It will be a dual-purpose card, so it will have the chip technology, as well as the mag-stripe because it will take quite some time to get all the merchants and ATMs in the U.S. fully EMV capable. I think in the U.S. market we will look at the chip card, but also think we'll see some of the larger financial institutions do a mobile solution as well.
URBAN: I think it is optimistic to think that cards would just go away. Cards are so ubiquitous. People have multiple cards from multiple issuers for multiple reasons, and not 100 percent of those card using members are going to be ready to switch to a mobile phone right away. It's almost like if we look at checks within the U.S.; there are a lot of people who continue to use checks, even though it's declining, it is still a significant volume of activity. It just doesn't seem realistic to think that we won't move to EMV, support the rest of the world, and just catch up with technology to jump right into the phone. I think that is a little too much of a leap at this point in time. Certainly, I think it will be complementary and have particular uses, where someone will use a phone for transactions when they may want to use a card for others. So it will be interesting to see how that plays out.