With the nature of online, card-not-present payments accelerating to new heights during the COVID-19 pandemic, fraud risks emerged for issuers, acquirers and merchants operating in a remote environment. Behind the scenes, professionals like Kolin Whitley, Senior Director, North American Risk, Visa, are working to mitigate the risks as they emerge in real-time.
He shared his expertise in a virtual discussion with the Commercial Payments Solutions Division of M&T Bank.
Here’s a recap of what Whitley says you need to know about the payment risk challenges brought to the forefront since the pandemic, along with strategies for dealing with this new reality.
The Payment Challenges of COVID-19
The shift from manual paper-based payments to more online electronic payments has created a perfect storm in the world of payment fraud. Some of the main challenges that have emerged include:
- Maintaining data security in a remote world: This includes ensuring that issuers are adhering to the PCI compliance standards, safeguarding data, and providing a way for remote employees to protect the data they’re using day-to-day.
- Stimulus and unemployment claim fraud: Fraudsters stole identities to apply for unemployment insurance, get that prepaid card, cash it out, and then dispute the transaction with the issuing bank. This hit the U.S. with more than $800 million in this type of fraud, said Whitley. With millions and millions of applications coming through, banks didn’t initially have the tools to verify identity before issuing those cards.
- An increase in cyberattacks: Fraudsters were aware that many banks had people working from home without the same structures to deal with cyberattacks. Many of the attacks came from foreign actors.
- A massive migration from card-present to card-not-present: With card-not-present, you don’t have the same types of controls you do in a card-present environment. Without a chip card or EMV protection, you’re relying on scoring models to try to pick up unusual behavior.
- An increase in chargebacks or disputes from cardholders: In some cases, cardholders might have purchased something online and then disputed the transaction. Or those who booked travel plans and failed to get a refund filed a dispute with their issuer to try to get their money back.
- Using AI to track behaviors: In the wrong hands, AI can observe patterns of normal user behavior and then mimic that activity so that the bank won’t detect it as being unusual.
How the Payment Industry is Working to Combat Fraud
Visa and other payment networks have taken measures to decrease fraud rates, increase authorization rates, and streamline the customer experience. With COVID-19 inserting itself into a typical payment pattern, reaching those goals can be challenging. Here are some of the tools and processes Visa used to combat fraud:
- Risk Operations Center: This group monitors the Visa network activity 24/7 to identify any abnormality in payment traffic worldwide. It’s able to detect specific attacks in the system and react to them very quickly.
- Identity and analytics tools: These aim to prove that a person is who they claim to be and verify that the ongoing interaction between the cardholder, a merchant, and throughout the whole payment ecosystem is locked into that consumer’s identity.
- Transaction scoring: Every payment that goes through the Visa network gets a score that analyzes the likelihood of a fraudulent transaction. Issuing banks, or acquirers in some cases, receive those results to help identify transactions that seem high risk.
- A BOPIS plan (Buying Online, Pickup In-Store): Visa created best practices to educate merchants, that hadn’t dealt with that type of transaction before, on how to protect themselves. This included asking for identification at the time of pickup and/or providing apps or mobile browser-driven customer tools.
- Collaboration on investigations: Visa works with issuers, acquirers, merchants and law enforcement to help stop crimes and take down fraudsters.
How To Avoid Payment Fraud
- Be careful of scams: Never accept an unsolicited call from a bank asking you to verify your identity. Hang up the phone, turn over the back of your card, call the number on the back of your card to your actual bank to verify that communication.
- Maintain device security: Phishing attacks or false messages that try to get users to click on a link to deploy malware can be used to steal information to make unauthorized payments on your behalf. Always make sure security patches and operating systems are up to date. Also, download a VPN so you are on a secure network instead of a public Wi-Fi, which can be vulnerable.
- Check your credit report regularly: Look for any posted lines you’re not aware of, which could signal identity fraud.
- Use contactless transactions if available: Tap to pay is becoming hugely popular, especially because of COVID-19, and it also happens to be a secure way to pay.
- Choose credit cards over debit cards for online payments: If you do suffer fraud on a credit card, you’re not going to pay for it because there is zero liability. Your debit card can drain your bank account, and it can take time to recoup the money.
As Whitley says, “fraud always pursues the path of least resistance.” With so many changes happening at once during the pandemic, criminals tried to take advantage of weaknesses, and in some cases, succeeded. However, the payment risk experts at Visa and elsewhere remained vigilant throughout and are continuing to help businesses and issuers reduce risk.
Though it is difficult to prevent fraud completely, there are many options available to help you safeguard your online sales. Connect with a Merchant Services Business Consultant to determine what protection is best for your business.
This content is for informational purposes only and is not intended as an offer or solicitation for the sale of any financial product or service. It is not designed or intended to provide financial, tax, legal, investment, accounting, or other professional advice since such advice always requires consideration of individual circumstances. If professional advice is needed, the services of a professional advisor should be sought.