Credit fraud is like energy — it can never be destroyed, only altered. The most recent example comes thanks to Europay, MasterCard and Visa (EMV) card rollouts in the U.S.

Business Insider noted EMVCo’s research calculated that 394 million EMV cards are now active across the country, representing 26 percent of the market. However, they’re responsible for just 7 percent of all transactions.

Still, the move was enough to force a significant shift in criminal activity from card-present to online fraud: SecurityWeek reported that domestic-based interactions became 79 percent riskier in Q4 2016, according to the Forter/MRC Fraud Attack Index.

Failed Attempt?

While it’s tempting to scold EMV for failing to meet security expectations, the spike in online fraud is actually a sign that chip-and-PIN cards are working as intended. Magnetic stripe cards were easy for criminals to clone and then use in card-present transactions — where they have duplicate, physical cards in hand — but EMV technology makes this almost impossible. As a result, attackers have moved online where card-not-present (CNP) transactions don’t require a PIN or chip, just the right account details and lax e-commerce security.

ZDNet reported that while total U.S. fraud losses are down from a high of $22 billion in 2012 to $16 billion last year, fraud victims hit record numbers with 15.4 million in 2016. That translates to 40 percent more CNP transactions.

Account takeovers are also on the rise as criminals crack online retail and banking accounts, then change contact and security information to defraud victims again and again — ZDNet noted that last year, account takeover fraud rose 61 percent and cost $2.3 billion. Other types of online fraud are also on the rise, such as “liar-buyer” scams where criminals purchase items online and then report them undelivered to claim refunds.

Evolving Protection Against Online Fraud

For companies, the switch to EMV cards hasn’t been smooth sailing. While chip-and-PIN cards are mandatory to avoid compliance violations, there has been significant pushback from consumers. The Credit Union Times stated businesses on the forefront of EMV issuing and adoption are experiencing more application fraud than those reluctant to implement the new technology, even as fraudsters diversify their efforts to hack accounts.

While 41 percent of attackers use compromised true identities, 31 percent create synthetic identities and 27 percent manipulate IDs, according to a LexisNexis study. The result? It’s becoming harder and harder to tell the real from fake identities and victims from verified accounts.

Necessary adaptation comes in two parts. First, companies need to embrace the notion of criminal conservation — credit card fraud will never disappear. Second, it’s critical for corporations to adjust their security approach. The Credit Union Times explained, for example, that some financial institutions are now implementing four-factor authentication that includes:

  • Knowledge factors (e.g., name and password);
  • Possession factors (e.g., one-time key or RNG smartphone token);
  • Inherent factors (e.g., biometric data); and
  • Geographic factors (e.g., location).

Ideally, more factors and better overall app security should help weed out fake profiles and limit the ability of cybercriminals to masquerade as legitimate users.

EMV is a success; card-present fraud has dropped dramatically. But online fraud has risen sharply to fill the void. The law of criminal conservation means companies must now shift their efforts and adapt to identity-based attacks.

More from

Emotional Blowback: Dealing With Post-Incident Stress

Cyberattacks are on the rise as adversaries find new ways of creating chaos and increasing profits. Attacks evolve constantly and often involve real-world consequences. The growing criminal Software-as-a-Service enterprise puts ready-made tools in the hands of threat actors who can use them against the software supply chain and other critical systems. And then there's the threat of nation-state attacks, with major incidents reported every month and no sign of them slowing. Amidst these growing concerns, cybersecurity professionals continue to report…

RansomExx Upgrades to Rust

IBM Security X-Force Threat Researchers have discovered a new variant of the RansomExx ransomware that has been rewritten in the Rust programming language, joining a growing trend of ransomware developers switching to the language. Malware written in Rust often benefits from lower AV detection rates (compared to those written in more common languages) and this may have been the primary reason to use the language. For example, the sample analyzed in this report was not detected as malicious in the…

Why Operational Technology Security Cannot Be Avoided

Operational technology (OT) includes any hardware and software that directly monitors and controls industrial equipment and all its assets, processes and events to detect or initiate a change. Yet despite occupying a critical role in a large number of essential industries, OT security is also uniquely vulnerable to attack. From power grids to nuclear plants, attacks on OT systems have caused devastating work interruptions and physical damage in industries across the globe. In fact, cyberattacks with OT targets have substantially…

Resilient Companies Have a Disaster Recovery Plan

Historically, disaster recovery (DR) planning focused on protection against unlikely events such as fires, floods and natural disasters. Some companies mistakenly view DR as an insurance policy for which the likelihood of a claim is low. With the current financial and economic pressures, cutting or underfunding DR planning is a tempting prospect for many organizations. That impulse could be costly. Unfortunately, many companies have adopted newer technology delivery models without DR in mind, such as Cloud Infrastructure-as-a-Service (IaaS), Software-as-a-Service (SaaS)…