With the nature of online, card-not-present payments accelerating to new heights during the COVID-19 pandemic, fraud risks emerged for issuers, acquirers and merchants operating in a remote environment. Behind the scenes, professionals like Kolin Whitley, Senior Director, North American Risk, Visa, are working to mitigate the risks as they emerge in real-time. 

He shared his expertise in a virtual discussion with the Commercial Payments Solutions Division of M&T Bank.

Here’s a recap of what Whitley says you need to know about the payment risk challenges brought to the forefront since the pandemic, along with strategies for dealing with this new reality.

The Payment Challenges of COVID-19

The shift from manual paper-based payments to more online electronic payments has created a perfect storm in the world of payment fraud. Some of the main challenges that have emerged include:

  • Maintaining data security in a remote world: This includes ensuring that issuers are adhering to the PCI compliance standards, safeguarding data, and providing a way for remote employees to protect the data they’re using day-to-day.
  • Stimulus and unemployment claim fraud: Fraudsters stole identities to apply for unemployment insurance, get that prepaid card, cash it out, and then dispute the transaction with the issuing bank. This hit the U.S. with more than $800 million in this type of fraud, said Whitley. With millions and millions of applications coming through, banks didn’t initially have the tools to verify identity before issuing those cards. 
  • An increase in cyberattacks: Fraudsters were aware that many banks had people working from home without the same structures to deal with cyberattacks. Many of the attacks came from foreign actors.
  • A massive migration from card-present to card-not-present: With card-not-present, you don’t have the same types of controls you do in a card-present environment. Without a chip card or EMV protection, you’re relying on scoring models to try to pick up unusual behavior.
  • An increase in chargebacks or disputes from cardholders: In some cases, cardholders might have purchased something online and then disputed the transaction. Or those who booked travel plans and failed to get a refund filed a dispute with their issuer to try to get their money back.
  • Using AI to track behaviors: In the wrong hands, AI can observe patterns of normal user behavior and then mimic that activity so that the bank won’t detect it as being unusual. 

How the Payment Industry is Working to Combat Fraud

Visa and other payment networks have taken measures to decrease fraud rates, increase authorization rates, and streamline the customer experience. With COVID-19 inserting itself into a typical payment pattern, reaching those goals can be challenging. Here are some of the tools and processes Visa used to combat fraud:

  • Risk Operations Center: This group monitors the Visa network activity 24/7 to identify any abnormality in payment traffic worldwide. It’s able to detect specific attacks in the system and react to them very quickly.
  • Identity and analytics tools: These aim to prove that a person is who they claim to be and verify that the ongoing interaction between the cardholder, a merchant, and throughout the whole payment ecosystem is locked into that consumer’s identity.
  • Transaction scoring: Every payment that goes through the Visa network gets a score that analyzes the likelihood of a fraudulent transaction. Issuing banks, or acquirers in some cases, receive those results to help identify transactions that seem high risk. 
  • A BOPIS plan (Buying Online, Pickup In-Store): Visa created best practices to educate merchants, that hadn’t dealt with that type of transaction before, on how to protect themselves. This included asking for identification at the time of pickup and/or providing apps or mobile browser-driven customer tools. 
  • Collaboration on investigations: Visa works with issuers, acquirers, merchants and law enforcement to help stop crimes and take down fraudsters.

How To Avoid Payment Fraud

  • Be careful of scams: Never accept an unsolicited call from a bank asking you to verify your identity. Hang up the phone, turn over the back of your card, call the number on the back of your card to your actual bank to verify that communication.
  • Maintain device security: Phishing attacks or false messages that try to get users to click on a link to deploy malware can be used to steal information to make unauthorized payments on your behalf. Always make sure security patches and operating systems are up to date. Also, download a VPN so you are on a secure network instead of a public Wi-Fi, which can be vulnerable.
  • Check your credit report regularly: Look for any posted lines you’re not aware of, which could signal identity fraud. 
  • Use contactless transactions if available: Tap to pay is becoming hugely popular, especially because of COVID-19, and it also happens to be a secure way to pay. 
  • Choose credit cards over debit cards for online payments: If you do suffer fraud on a credit card, you’re not going to pay for it because there is zero liability. Your debit card can drain your bank account, and it can take time to recoup the money. 

As Whitley says, “fraud always pursues the path of least resistance.” With so many changes happening at once during the pandemic, criminals tried to take advantage of weaknesses, and in some cases, succeeded. However, the payment risk experts at Visa and elsewhere remained vigilant throughout and are continuing to help businesses and issuers reduce risk.

Though it is difficult to prevent fraud completely, there are many options available to help you safeguard your online sales. Connect with a Merchant Services Business Consultant to determine what protection is best for your business.



This content is for informational purposes only and is not intended as an offer or solicitation for the sale of any financial product or service. It is not designed or intended to provide financial, tax, legal, investment, accounting, or other professional advice since such advice always requires consideration of individual circumstances. If professional advice is needed, the services of a professional advisor should be sought.


Share this page

If you are interested in sending this page to a friend or relative, please enter the following:

* Indicates required fields
+ Add another

No personal information (including e-mail addresses) about you or your friend will be collected from this e-mail notification feature offered by M&T Bank.

Please Note:

By clicking "ok" below, you will leave mtb.com and enter a Third-Party Website.

Tenga en cuenta que:

Al hacer clic en “Aceptar”, abandonará mtb.com e ingresará en el sitio web de un tercero.

Please note that:

  • The Third-Party Website is governed by a different set of terms and conditions and privacy policy than mtb.com and you should review those terms, conditions and privacy policy prior to reviewing the content of the Third-Party Website
  • M&T is providing a link to the Third-Party Website as a convenience and does not necessarily control the content of, or endorse, the Third-Party Website, it's owner/operator or any information, products or services that are made available on or through it
  • M&T makes no representations or warranties regarding the information, products or services provided through the Third-Party Website

Such Third-Party Website's owner/operator may be regulated by governmental entities and laws that are different than those that regulate M&T.

Tenga en cuenta que:

  • El sitio web de un tercero está regido por un conjunto de términos y condiciones y una política de privacidad diferentes que mtb.com, por lo tanto, deberá revisar esos términos y condiciones y la política de privacidad antes de evaluar el contenido del sitio web de un tercero
  • M&T le proporciona un enlace al sitio web de un tercero para su comodidad y no necesariamente tiene control sobre el contenido, o se adhiere, al sitio web del tercero, su propietario/operador o ni a ninguna parte de la información, producto o servicio que se ofrezca a través de él
  • M&T no ofrece declaraciones ni garantías respecto de la información, productos o servicios prestados a través del sitio web de un tercero

El propietario/operador de ese sitio web de un tercero podría estar regulado por entidades gubernamentales o leyes que son diferentes a aquellos por los que está regulado M&T.