March 2, 2017 By Douglas Bonderud 2 min read

Credit fraud is like energy — it can never be destroyed, only altered. The most recent example comes thanks to Europay, MasterCard and Visa (EMV) card rollouts in the U.S.

Business Insider noted EMVCo’s research calculated that 394 million EMV cards are now active across the country, representing 26 percent of the market. However, they’re responsible for just 7 percent of all transactions.

Still, the move was enough to force a significant shift in criminal activity from card-present to online fraud: SecurityWeek reported that domestic-based interactions became 79 percent riskier in Q4 2016, according to the Forter/MRC Fraud Attack Index.

Failed Attempt?

While it’s tempting to scold EMV for failing to meet security expectations, the spike in online fraud is actually a sign that chip-and-PIN cards are working as intended. Magnetic stripe cards were easy for criminals to clone and then use in card-present transactions — where they have duplicate, physical cards in hand — but EMV technology makes this almost impossible. As a result, attackers have moved online where card-not-present (CNP) transactions don’t require a PIN or chip, just the right account details and lax e-commerce security.

ZDNet reported that while total U.S. fraud losses are down from a high of $22 billion in 2012 to $16 billion last year, fraud victims hit record numbers with 15.4 million in 2016. That translates to 40 percent more CNP transactions.

Account takeovers are also on the rise as criminals crack online retail and banking accounts, then change contact and security information to defraud victims again and again — ZDNet noted that last year, account takeover fraud rose 61 percent and cost $2.3 billion. Other types of online fraud are also on the rise, such as “liar-buyer” scams where criminals purchase items online and then report them undelivered to claim refunds.

Evolving Protection Against Online Fraud

For companies, the switch to EMV cards hasn’t been smooth sailing. While chip-and-PIN cards are mandatory to avoid compliance violations, there has been significant pushback from consumers. The Credit Union Times stated businesses on the forefront of EMV issuing and adoption are experiencing more application fraud than those reluctant to implement the new technology, even as fraudsters diversify their efforts to hack accounts.

While 41 percent of attackers use compromised true identities, 31 percent create synthetic identities and 27 percent manipulate IDs, according to a LexisNexis study. The result? It’s becoming harder and harder to tell the real from fake identities and victims from verified accounts.

Necessary adaptation comes in two parts. First, companies need to embrace the notion of criminal conservation — credit card fraud will never disappear. Second, it’s critical for corporations to adjust their security approach. The Credit Union Times explained, for example, that some financial institutions are now implementing four-factor authentication that includes:

  • Knowledge factors (e.g., name and password);
  • Possession factors (e.g., one-time key or RNG smartphone token);
  • Inherent factors (e.g., biometric data); and
  • Geographic factors (e.g., location).

Ideally, more factors and better overall app security should help weed out fake profiles and limit the ability of cybercriminals to masquerade as legitimate users.

EMV is a success; card-present fraud has dropped dramatically. But online fraud has risen sharply to fill the void. The law of criminal conservation means companies must now shift their efforts and adapt to identity-based attacks.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today