Online banking fraud on the decline

But credit card fraud abroad pushing up overall losses

Online banking fraud in the UK is down by third, but is still costing financial institutions £22.6m a year, according to new estimates from Apacs.

The year-on-year decrease is all the more surprising given that phishing attacks almost doubled from 14,156 in 2006 to 25,796 last year, the organisation said.

However, the report calculates that total card fraud losses rose by 25 per cent in 2007 to £535.2m, a key driver being a 77 per cent increase in fraud committed overseas by criminals using stolen UK card details.

Apacs reported that overseas fraud now accounts for 39 per cent of total card fraud losses, and typically occurs in countries which have yet to upgrade to chip and Pin.

"Although card fraud levels have now begun to go up again due to fraud abroad and card-not-present fraud losses, chip and Pin has proved an undoubted success in reducing card fraud on the UK high street," said Sandra Quinn, director of communications at Apacs.

"As more countries follow our lead and upgrade to chip and Pin, the opportunities for criminals to use our stolen magnetic stripe details overseas will decrease."

Chip and Pin continues to have a hugely positive effect on card fraud committed in the UK. Over the past three years losses on face-to-face transactions on the UK high street have fallen by two-thirds from £218.8m in 2004 to £73m last year.

The 2007 figures also show that fraud on lost and stolen cards and mail non-receipt fraud are at their lowest levels for 10 years, at £56.2m and £10.2m respectively.

Counterfeit fraud losses have increased by 46 per cent, but the vast majority of this is due to criminals stealing card details in the UK to make counterfeit magnetic stripe cards for use in countries yet to upgrade to chip and Pin.

This type of fraud will become more difficult if the European banking industry meets its target to complete its chip card rollout by 2010.

Security firms have mostly come out in agreement with Apacs' findings, claiming that legacy systems are the chink in the credit card security armour.

"The big flaw with cards at the moment is that there are legacy magnetic stripes on the cards," said Cameron Olsen, vice president of business development at Smart Technology Solutions.

"This technology is exceptionally insecure and there needs to be a strong push to do away with it.

"There is no evidence that chip technology has been cracked. The UK still uses Static Data Authentication [SDA] cards, but there will be a move towards Dynamic Data Authentication [DDA] at some point which will provide more security.

"The UK banks are now paying some of the price for going with SDA rather than DDA when they were rolling out chip and Pin."

However, authentication expert GrIDsure has slammed Apacs' reliance on chip and Pin, arguing that the 25 per cent increase in credit and debit card fraud shows that existing approaches to fraud are simply not working.

Card-not-present fraud now amounts to more than half of all card losses in the UK and abroad at £291m. GrIDsure claims that this is indicative of a flawed reliance on chip and Pin as the primary means to tackle fraud.

"Chip and Pin is fine as a starting point to address high street fraud, but fraud will continue to increase while we still have cards with magnetic stripes and static Pins," said Jonathan Craymer, chairman of GrIDsure.

"As the latest figures show, chip and Pin is doing nothing to address fraud overseas or from transactions online or via the phone.

"The US, for example, is showing no signs of moving to chip and Pin and, with e-commerce still on the rise, addressing only high street fraud is a major oversight."

Craymer believes that the industry must wake up to the reality that fixed Pins are not secure enough.

"Fraudsters are always going to be looking for new ways to make money, but there are simple, incremental changes that can be made to improve the existing system now," he said.

"It is absurd to suggest that we are getting better at tackling fraud. We need to take firm action right now to stop these fraudsters in their tracks."

Apacs also announced the launch of the new Payments Industry and Police Joint Intelligence Unit, which will enhance the work of the Dedicated Cheque and Plastic Crime Unit, a specialist police unit fully sponsored by the banking industry.