Credit fraud is like energy — it can never be destroyed, only altered. The most recent example comes thanks to Europay, MasterCard and Visa (EMV) card rollouts in the U.S.

Business Insider noted EMVCo’s research calculated that 394 million EMV cards are now active across the country, representing 26 percent of the market. However, they’re responsible for just 7 percent of all transactions.

Still, the move was enough to force a significant shift in criminal activity from card-present to online fraud: SecurityWeek reported that domestic-based interactions became 79 percent riskier in Q4 2016, according to the Forter/MRC Fraud Attack Index.

Failed Attempt?

While it’s tempting to scold EMV for failing to meet security expectations, the spike in online fraud is actually a sign that chip-and-PIN cards are working as intended. Magnetic stripe cards were easy for criminals to clone and then use in card-present transactions — where they have duplicate, physical cards in hand — but EMV technology makes this almost impossible. As a result, attackers have moved online where card-not-present (CNP) transactions don’t require a PIN or chip, just the right account details and lax e-commerce security.

ZDNet reported that while total U.S. fraud losses are down from a high of $22 billion in 2012 to $16 billion last year, fraud victims hit record numbers with 15.4 million in 2016. That translates to 40 percent more CNP transactions.

Account takeovers are also on the rise as criminals crack online retail and banking accounts, then change contact and security information to defraud victims again and again — ZDNet noted that last year, account takeover fraud rose 61 percent and cost $2.3 billion. Other types of online fraud are also on the rise, such as “liar-buyer” scams where criminals purchase items online and then report them undelivered to claim refunds.

Evolving Protection Against Online Fraud

For companies, the switch to EMV cards hasn’t been smooth sailing. While chip-and-PIN cards are mandatory to avoid compliance violations, there has been significant pushback from consumers. The Credit Union Times stated businesses on the forefront of EMV issuing and adoption are experiencing more application fraud than those reluctant to implement the new technology, even as fraudsters diversify their efforts to hack accounts.

While 41 percent of attackers use compromised true identities, 31 percent create synthetic identities and 27 percent manipulate IDs, according to a LexisNexis study. The result? It’s becoming harder and harder to tell the real from fake identities and victims from verified accounts.

Necessary adaptation comes in two parts. First, companies need to embrace the notion of criminal conservation — credit card fraud will never disappear. Second, it’s critical for corporations to adjust their security approach. The Credit Union Times explained, for example, that some financial institutions are now implementing four-factor authentication that includes:

• Knowledge factors (e.g., name and password);
• Possession factors (e.g., one-time key or RNG smartphone token);
• Inherent factors (e.g., biometric data); and
• Geographic factors (e.g., location).

Ideally, more factors and better overall app security should help weed out fake profiles and limit the ability of cybercriminals to masquerade as legitimate users.

EMV is a success; card-present fraud has dropped dramatically. But online fraud has risen sharply to fill the void. The law of criminal conservation means companies must now shift their efforts and adapt to identity-based attacks.