In March this year, the UK Cards Association announced figures showing that fraud losses on UK cards, cheques and online banking fell to its lowest since the year 2000. The largest drop was in counterfeit card fraud – where a card is cloned or skimmed – which in 2010 was cut by an impressive 41% to £47.6 million, compared with 2009. Encouraging news indeed.
These latest statistics show how industry investment in anti-fraud initiatives and more sophisticated fraud prevention tools is working – not just in the UK but also across Europe. Widespread use of anti-skimming equipment attached to automatic teller machines (ATMs) – where fraudsters typically copy details from the magnetic stripe of a genuine card – has significantly helped reduce counterfeit fraud, as has educating consumers on how to better protect themselves.
The introduction of Chip and PIN technology has clearly had an impact too, with a rising number of countries migrating to EMV, making it harder to use fake cards. In the UK, the cards industry has been working closely with the retail community to raise awareness of how they can safeguard their Chip and PIN terminals from criminal attacks.
Greater fraud data sharing among banks has also contributed to the demise of counterfeit fraud, along with the continuing roll-out of debit and credit cards with enhanced security features, such as an updated integrated card verification value (iCVV).
But for the downward trend in card fraud to continue, the industry can’t afford to relax its efforts. Despite the now widespread use of Chip and PIN in Europe, card fraud is still a big issue for many banks. EMV migration has been effective in minimising losses against card-present fraud, but until it becomes a universally applied standard across the world, fraud techniques surrounding skimming will remain attractive to fraudsters keen to exploit regional loopholes, such as in the US.
The counterfeiters are also looking for new ways to fleece consumers. The use of anti-skimming devices has eliminated fraud at the ATM in Luxembourg, for example, but the criminals are now targeting alternative channels. Recent reports of counterfeiters targeting UK tube and rail commuters using skimming devices on ticket machines, has fuelled the debate around universal adoption of Chip and PIN and whether cards should have magnetic stripes or not. Gangs are copying the magnetic stripes as passengers buy tickets and using them to create fake cards for use in countries with no Chip and PIN protection. The fact is that while cards with magnetic stripes continue to exist, there remains the opportunity for fraudsters to copy card details.
One simple solution is to mandate Chip and PIN technology worldwide, which would stamp out this fraud altogether. The Single Euro Payments Area (SEPA) regulation mandates EMV in Europe, but only as far as the issuing side. Therefore, there needs to be broader and more far-reaching regulation, as well as an industry agreement, on how to move forward with this issue.
An alternative approach is to issue cards without a magnetic stripe – a strategy that has seen considerable success in Luxembourg. Banks there have recently decided to replace Maestro cards with VPay cards, which only have Chip and PIN. Adopting this proactive security measure will no doubt place more pressure on non-EMV countries to follow suit.
The US is a prime example where EMV has yet to be rolled out, and it doesn’t appear to be on the horizon either. Implementing Chip and PIN technology over there would be so expensive that any roll-out would outweigh the advantages of reducing losses due to fraud. But initiatives – and even legislation – to ban magnetic stripe cards will mean countries like the US will have to introduce other ways for consumers to authorise payments and ensure the genuine card is being used. Current speculation says that should the US implement a card fraud strategy, it’s likely to be a mobile solution. However, this would again fragment the industry’s response to counterfeit fraud and could oblige Europe to follow their lead.
Until a common standard is introduced, counterfeit fraud will continue to appeal to criminals keen to take advantage of the gaps in Chip and PIN protection. In the meantime, banks need to ensure that if they cannot prevent a card from being reproduced for fraudulent use, then they should be able to monitor the transaction flow and stop the crime in its tracks. This requires effective fraud management processes, such as the creation of reliable customer-specific rules and back-office tools to block settlements.
Despite promising statistics on the decline in counterfeit fraud, the key to eliminating it is to fight it together. While the industry can sit and wait for a global consensus and more regulation, it really needs to initiate the first steps and present a united front. As banks grapple with card fraud and the innovative ways in which fraudsters operate, they also need to consider new payment methods, such as mobile and contactless payments, which are set for massive growth.
The industry has done well in reducing card fraud to date. However, this effort needs to continue if the new payment channels are to be dealt with effectively, alongside the ongoing fraud issues yet to be resolved.
Emil Büchler first joined SIX Card Solutions in 1999 with more than 12 years of experience in the cards industry. He is currently managing director of the Cards division, which is headquartered in Zurich, Switzerland, with subsidiaries in Germany, Luxembourg, Sweden, the UK and the US. In his role, Büchler has financial, personnel and strategic project responsibility for the Cards division, with an annual turnover of CHF195 million. In his previous positions at SIX Card Solutions, Büchler led the international growth strategy for the company while also overseeing the roll out of EMV cards in Switzerland in 2002. Before joining SIX Card Solutions, Büchler spent four years at EDS where he held various positions, including head of business solutions. During this time he had operational and financial responsibility for executing complex and comprehensive development projects.