Infosec: 2007 online card fraud tops £500m

Retailers fighting an ever increasing threat

Ian Williams at Infosec Europe 2008, vnunet.com 23 Apr 2008

The value of 'card not present' fraud in 2007 is significantly higher than official figures suggest and is getting worse, according to credit card fraud protection company The 3rd Man.

Apacs reported recently that card not present fraud in 2007 reached £290.5m, an increase of 37 per cent on 2006.

However, this was the figure on UK issued cards only and excludes losses on non-UK issued cards. The 3rd Man reckons that the true figure is more like £500m.

This problem is being exacerbated by the global credit crunch affecting many retailers in the UK, particularly online where this type of fraud is most prevalent.

"Card not present fraud is a major problem which is not going away and is getting worse as criminals increase their efforts to steal from retailers," said Paul Simms, chief executive at The 3rd Man, at the Infosec security show in London.

Simms acknowledged that the introduction of chip and Pin dealt a hefty blow to criminals, but retailers have become a soft target for fraudsters who have changed their focus to card not present fraud, such as online and mail order shopping.

The 3rd Man said that behavioural data screening techniques are a key way of dealing with this problem and that only through the collaboration of banks, consumers and retailers can this type of fraud be minimised.

"Behavioural analysis detects around 80 per cent of all attempted frauds, but retailers can be stung by exactly the same fraud committed with another retailer," said Simms.

"By sharing their data they are protecting each other and in doing so will already save over £100m in 2008."

Shared databases can provide all stakeholders with valuable information such as fraudulent and highly suspicious data.

This includes listings of bad or questionable details such as email address es, delivery addresses, phone numbers, IP addresses and card numbers.

Simms believes that by sharing this data, the bank can be informed immediately when fraud is detected enabling them to contact the customer and resolve the situation before the money has been lost.