The Challenge of Online Fraud

Since 2000, the total value of online shopping transactions has increased by 871%. According to the British Retail Consortium (BRC), this growth is set to continue with Internet shopping sales at a record £26.5bn for the first half of 2008. Valued at £34bn in 2007 in the UK, Internet retailing is experiencing massive growth. However, this growth has not been accompanied by adequate security measures for payments and many sites still only ask for card details. The lack of strong authentication has provided fraudsters with the perfect opportunity to commit card-not-present (CNP) fraud. The past year has seen an 18% rise in CNP fraud and £161.9m in losses between January and June 2008, according to the latest statistics from APACS.

This growth in CNP fraud is especially significant when compared to the increase in fraud across other channels. According to APACS, since 2007, fraud resulting from lost and stolen cards has increased by 11%, while fraud through identity theft saw only a 2% growth.¹ The consumer propensity to spend increasing amounts of money online, coupled with a lack of strong authentication means that the trend for increasing CNP fraud looks set to continue unless banks adopt a new approach.

In the past, many banks were able to absorb the losses created by fraudulent online transactions. However, with rising volumes of fraud and pressure on costs banks will struggle to carry these losses. In addition, there is more than direct bottom line impact at stake. Consumer awareness of online fraud is increasing and lack of security heavily impacts upon consumer confidence. Consequently, failure to address online fraud may have a significant impact on customer retention. As a result of this perfect storm of pressures, security measures against CNP fraud are moving up on the banks’ priority list.

Motivation to Act

Financial institutions are all too aware of the decreasing opportunity to differentiate their services. However, with security breaches constantly highlighted by the national press, banks are presented with an opportunity to allay consumers’ online fears and benefit their brand image at the same time. Stronger security will enable a bank to show customers that they are reacting to the threat, potentially improving customer retention as a result.

A recent survey by enterprise communications company, Thunderbird, shows that retaining customers should be a high priority for banks. The survey revealed that almost two-thirds (63%) of consumers are actively considering ‘switching’ banks in the next 12 months. This statistic proves the knife-edge that banks are competing on to keep customers happy. In fact, only a very small number of the consumers surveyed felt a sense of ‘loyalty’ to their banks (17%).

Another factor that should encourage banks to implement better security measures is the increasingly stringent regulations around CNP fraud. Members of European Parliament (MEPs) are currently campaigning for an amendment to the e-privacy directive that will require providers of electronic services to inform users of breaches of data protection. If the legislation is passed, companies will need to inform national regulators or other ‘competent authorities’ on ‘serious’ security breaches of personal data, which will then decide whether to inform consumers. Crucially, companies might also be asked to report the occurrence of security problems in their annual reports. While this legislation will initially only apply to public companies, there are calls to extend this to the private sector and to online banks and insurers in particular. The introduction of this amendment would create further transparency within the sector and enable banks to competitively differentiate if they employ a strong security approach.

What Needs to be Done?

In response to the CNP fraud challenge, banks need to ensure they implement effective security processes that are able to significantly reduce the risk associated with CNP transactions. The UK’s migration to EMV and the resultant fall in face-to-face and ATM fraud reassured the public that banks were investing in solutions to reduce payments risk. A similar investment in reducing CNP fraud is essential if banks want to retain the confidence of their customers.

Many UK banks have already addressed one area of online transactions’ weakness – online banking. The introduction of smart card or chip authentification programme (CAP) readers to provide two-factor authentication is a significant step taken by some UK banks over the last 18 months. Barclays, Nationwide and RBS have all distributed card readers to customers. By making customers strongly authenticate themselves using an unconnected smart card reader and their bank card for online banking, the banks have the identity confirmation required before transfers are initiated.

According to APACS, online banking fraud losses were reduced by 33% between 2006 and 2007 following the adoption of two-factor authentication. Although the latest APACS figures for the first half of 2008 show a marked increase in online banking fraud, this increase has largely been attributed to phishing. Two-factor authentication provides much stronger protection against phishing than username and password verification alone. In fact, a recent announcement by Barclays stated customers using two-factor authentication for online banking experience no fraud whatsoever.

For those banks that have not migrated to the CAP infrastructure, there are other solutions available to address online banking fraud, namely mobile phone authentication. There are several ways to use a mobile in online transaction authentication. A mobile phone can be used for strong authentication by the bank sending security details to the customer via SMS. SMS password confirmation serves as dual-channel identity authentication, making the transaction stronger, but not as secure as Chip and PIN. The need for reliable network coverage to enable timely receipt and processing of the SMS password is another possible limitation of this authentication method.

A customer’s handset can also be used as a two-factor authentication device by pushing an application onto it. The handset acts as a PIN-activated challenge-response device, providing a code to authenticate the online transaction. The advantage of this method is that there is no requirement for network coverage at the time of authentication.

It is clear that significant inroads have been made in securing online banking. However, this is only a small element of the financial activity that consumers conduct online and banks are yet to make any announcements regarding the extension of such security measures to the wider online environment for all types of transactions.

How are Other Market Players Getting Involved?

Card schemes are however taking the lead on initiatives that address e-commerce fraud. Verified by Visa and MasterCard SecureCode are initiatives that encourage customers to register in order to protect transactions with an additional password. The systems allow financial institutions to confirm a cardholder’s identity to the online retailer, thus making transactions more secure against fraudsters. APACS reports that take-up of these authentication services has increased by 600%, and 25 million credit and debit card holders have signed up to the scheme since 2006. However, there are 83 million credit and debit cards currently in circulation in the UK,² which means that as yet only 30% of UK cards are registered with either scheme. In addition, as the initiatives are password based, they are still vulnerable to phishing fraud.

Many UK banks have already invested in the software and hardware to support MasterCard and Visa’s CAP initiative through their investment in card readers and CAP compliant cards to secure online banking. Either CAP or mobile authentication could be used as a common platform to offer strong user identification within a cryptographically secure environment for all online transactions. The fact that the infrastructure to use two-factor authentication for e-commerce has already been put in place for online banking means that there is a strong business case to employ two-factor authentication more broadly online.

With the growth of online payments, increased consumer awareness of online security and the pressure on banks to retain customers, security advisors in banks are now in a strong position to advocate the business benefits of extending the success of strong authentication beyond online banking. Banks need to implement security measures which cover the whole online payments space, and support MasterCard and Visa’s move towards a more secure online shopping environment.

The Future of Online Security

The overwhelming increase in card-not-present fraud attacks is moving CNP security up financial institutions’ list of priorities year-on-year. The combination of financial losses from this type of fraud and the growing consumer impact of security breaches means that banks must consider taking preventative measures now. The investment in two-factor authentication for online banking is showing promise and should be regarded as a solid platform from which to progress a wider online security strategy to combat CNP fraud. For those banks that have not made the investment in CAP, mobile authentication is an attractive option. With few opportunities to differentiate services, it is time for banks to take security to the next level and implement two-factor authentication for e-commerce.