March 2, 2017 By Douglas Bonderud 2 min read

Credit fraud is like energy — it can never be destroyed, only altered. The most recent example comes thanks to Europay, MasterCard and Visa (EMV) card rollouts in the U.S.

Business Insider noted EMVCo’s research calculated that 394 million EMV cards are now active across the country, representing 26 percent of the market. However, they’re responsible for just 7 percent of all transactions.

Still, the move was enough to force a significant shift in criminal activity from card-present to online fraud: SecurityWeek reported that domestic-based interactions became 79 percent riskier in Q4 2016, according to the Forter/MRC Fraud Attack Index.

Failed Attempt?

While it’s tempting to scold EMV for failing to meet security expectations, the spike in online fraud is actually a sign that chip-and-PIN cards are working as intended. Magnetic stripe cards were easy for criminals to clone and then use in card-present transactions — where they have duplicate, physical cards in hand — but EMV technology makes this almost impossible. As a result, attackers have moved online where card-not-present (CNP) transactions don’t require a PIN or chip, just the right account details and lax e-commerce security.

ZDNet reported that while total U.S. fraud losses are down from a high of $22 billion in 2012 to $16 billion last year, fraud victims hit record numbers with 15.4 million in 2016. That translates to 40 percent more CNP transactions.

Account takeovers are also on the rise as criminals crack online retail and banking accounts, then change contact and security information to defraud victims again and again — ZDNet noted that last year, account takeover fraud rose 61 percent and cost $2.3 billion. Other types of online fraud are also on the rise, such as “liar-buyer” scams where criminals purchase items online and then report them undelivered to claim refunds.

Evolving Protection Against Online Fraud

For companies, the switch to EMV cards hasn’t been smooth sailing. While chip-and-PIN cards are mandatory to avoid compliance violations, there has been significant pushback from consumers. The Credit Union Times stated businesses on the forefront of EMV issuing and adoption are experiencing more application fraud than those reluctant to implement the new technology, even as fraudsters diversify their efforts to hack accounts.

While 41 percent of attackers use compromised true identities, 31 percent create synthetic identities and 27 percent manipulate IDs, according to a LexisNexis study. The result? It’s becoming harder and harder to tell the real from fake identities and victims from verified accounts.

Necessary adaptation comes in two parts. First, companies need to embrace the notion of criminal conservation — credit card fraud will never disappear. Second, it’s critical for corporations to adjust their security approach. The Credit Union Times explained, for example, that some financial institutions are now implementing four-factor authentication that includes:

  • Knowledge factors (e.g., name and password);
  • Possession factors (e.g., one-time key or RNG smartphone token);
  • Inherent factors (e.g., biometric data); and
  • Geographic factors (e.g., location).

Ideally, more factors and better overall app security should help weed out fake profiles and limit the ability of cybercriminals to masquerade as legitimate users.

EMV is a success; card-present fraud has dropped dramatically. But online fraud has risen sharply to fill the void. The law of criminal conservation means companies must now shift their efforts and adapt to identity-based attacks.

More from

Taking the complexity out of identity solutions for hybrid environments

4 min read - For the past two decades, businesses have been making significant investments to consolidate their identity and access management (IAM) platforms and directories to manage user identities in one place. However, the hybrid nature of the cloud has led many to realize that this ultimate goal is a fantasy. Instead, businesses must learn how to consistently and effectively manage user identities across multiple IAM platforms and directories. As cloud migration and digital transformation accelerate at a dizzying pace, enterprises are left…

IBM identifies zero-day vulnerability in Zyxel NAS devices

12 min read - While investigating CVE-2023-27992, a vulnerability affecting Zyxel network-attached storage (NAS) devices, the IBM X-Force uncovered two new flaws, which when used together, allow for pre-authenticated remote code execution. Zyxel NAS devices are typically used by consumers as cloud storage devices for homes or small to medium-sized businesses. When used together, the flaws X-Force discovered allow a remote attacker to execute arbitrary code on the device with superuser permissions and without requiring any credentials. This results in complete control over the…

What cybersecurity pros can learn from first responders

4 min read - Though they may initially seem very different, there are some compelling similarities between cybersecurity professionals and traditional first responders like police and EMTs. After all, in a world where a cyberattack on critical infrastructure could cause untold damage and harm, cyber responders must be ready for anything. But are they actually prepared? Compared to the readiness of traditional first responders, how do cybersecurity professionals in incident response stand up? Let’s dig deeper into whether the same sense of urgency exists…

Unified endpoint management for purpose-based devices

4 min read - As purpose-built devices become increasingly common, the challenges associated with their unique management and security needs are becoming clear. What are purpose-built devices? Most fall under the category of rugged IoT devices typically used outside of an office environment and which often run on a different operating system than typical office devices. Examples include ruggedized tablets and smartphones, handheld scanners and kiosks. Many different industries are utilizing purpose-built devices, including travel and transportation, retail, warehouse and distribution, manufacturing (including automotive)…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today