cuna mutual group proprietary; restricted © cuna mutual group, 2007 all rights reserved cuna mutual...

CUNA Mutual Group Proprietary; RESTRICTED© CUNA Mutual Group, 2007 All Rights ReservedCUNA Mutual Group Internal Use Only

Managing Plastic CardFraud

Presented by Brian Fisher, CUNA Mutual Group

Bridge to the FutureBridge to the FutureMCUL 2007 Executive SummitMCUL 2007 Executive Summit

Bridge to the FutureBridge to the FutureMCUL 2007 Executive SummitMCUL 2007 Executive Summit

Sponsored by

CUNA Mutual Group

Plastic Card Fraud UpdatePlastic Card Fraud Update

The Plastic Card Coverage is underwritten byCUMIS Insurance Society, Inc., a member of the CUNA Mutual Group.


Agenda

• What can we learn from 2006

• Major fraud trends driving losses

• Keys to fraud prevention

• How are you doing

CUNA Mutual Group

A Look at 2006A Look at 2006


$39.0 $40.0

$89.0 $98.7

$57.0

$0

$25

$50

$75

$100

$125

2002 2003 2004 2005 2006

(reported in)

(in

mill

ion

s)

Estimate of Losses Not Submitted by Credit Unions

Credit Union Submitted Losses

Submitted Plastic Card Losses – by report year


Reported Fraud Losses

• Submitted losses in 2006 reached $98.7M• 2006 was an 11% increase over 2005, but lower than

the $120M that was forecasted early in 2006• Losses without per card deductible changes would

have likely exceeded $100 million• Improvement is likely a direct correlation to best

practice implementation• 2006 is not completely comparable to past years

because of greater use of per card deductibles• 56% increase in submitted losses from 2004 ($57M)

to 2005 ($89M)


Plastic Card Submitted Losses by Card Type2004-2006 Plastic Card Submitted Losses by Card Type on a Report Quarter Basis

$0

$5,000,000

$10,000,000

$15,000,000

$20,000,000

$25,000,000

$30,000,000

$35,000,000

$40,000,000

Qtr 1 Qtr 2 Qtr 3 Qtr 4 Qtr 1 Qtr 2 Qtr 3 Qtr 4 Qtr 1 Qtr 2 Qtr 3 Qtr 4

2004 2005 2006

Debit Credit ATM


Fraud Challenges with Debit Cards

• Submitted losses between 2005 and 2006– Credit card losses dropped 27%– ATM card losses dropped 16%– Debit card losses increased 58%– Debit card went from $40M in 2005 to over

$63M 2006• Witnessed slower implementation of industry

best practices with debit cards• Believe growth should slow in 2007


Plastic Card Submitted Losses by Fraud Type2004-2006 Plastic Card Submitted Losses by Fraud Type on a Report Quarter Basis

$0

$5,000,000

$10,000,000

$15,000,000

$20,000,000

$25,000,000

$30,000,000

$35,000,000

$40,000,000

Qtr 1 Qtr 2 Qtr 3 Qtr 4 Qtr 1 Qtr 2 Qtr 3 Qtr 4 Qtr 1 Qtr 2 Qtr 3 Qtr 4

2004 2005 2006

Counterfeit Stolen Card Lost Card Not Received Account Takeover Application Fraud


Submitted Credit Union Losses by fraud type2002 Plastic Card Total Losses Submitted by Fraud Type

Account Takeover3.7%

Application Fraud0.5%

Card Not Received3.2%

Counterfeit32.6%

Lost14.8%

Stolen Card45.3%


Submitted Credit Union Losses by fraud type

2003 Plastic Card Total Losses Submitted by Fraud Type




Counterfeit39.8%

Lost13.5%

Stolen Card38.9%



2004 Plastic Card Total Losses Submitted by Fraud TypeAccount Takeover

2.0%



Counterfeit53.7%

Lost10.0%

Stolen Card28.3%



2005 Plastic Card Total Losses Submitted by Fraud TypeAccount Takeover

0.8%



Counterfeit71.2%

Lost6.4%

Stolen Card18.9%


Submitted Credit Union Losses by fraud type2006 Plastic Card Total Losses Submitted by Fraud Type




Counterfeit77.0%

Lost5.3%

Stolen Card15.2%

CUNA Mutual Group

The Driving ForcesThe Driving Forces


Global Organizations

• “Web Mobs” with known ties to US, UK, Spain, Brazil, Russia

• Technically Skilled, and under-employed

• Excellent utilization of technology against us

6


Business Model

• “an international clearinghouse of stolen credit cards and identity documents….”

• Delivers a framework for criminals to buy/sell data and share expertise

• Eliminates the need for individuals to master all aspects of the crime

7


Major Fraud Schemes and Themes

• Counterfeit losses have grown from $30M in 2004 to $75.7M in 2006

• Counterfeit losses account for 76.7% of 2006 submitted plastic card fraud losses

• Three major fraud schemes have led to a significant increase in counterfeit fraud

– Phishing & key loggers– Skimming– Merchant Data Breaches


Phishing

• 75 Million to 150 Million e-mail sent daily

• In 2005, roughly 30% of all US based institutions experienced losses related to phishing

• New tactics include utilizing caller ID masking known as “vishing”

• International fraud using text messaging to phish


Phishing with Key Loggers

• North East region• Obtains user name and password• Changes email address• Internal transfer of funds to checking• Attempts to wire funds to accounts

at other institutions with same or similar name to member’s


Data Compromise - Skimming

• Stealing magnetic stripe card data at the point of use– POS terminals– Gas pumps– ATMs– ATM vestibule door entry

• Large scale attacks against PIN based in Canada

• Seeing some migration into the US


Compromised ATM


Receiver in car…

•


Card Encoder


Data Compromise – Storage Breach

• Stealing magnetic stripe card data from the actual database storage– Merchant database– Processor database– External hacking– Internal theft

• Low implementation of Plastic Card Industry (PCI) standards

• Full track data still stored and stolen


In The News!

CUNA Mutual Group

How We WinHow We Win


Three Lines of Defense

• Walls – authorization system

• Weapons – fraud management systems

• Protectors – fraud operations / services

25


Authorization Protections

• Card Activation• CVV / CVC 1 and 2• Expiration Date Matching• Daily Dollar Limits• Parameter Blocks • Name Matching• AVS• VBV

27


Fraud Management System

• First half of fraud management solutions

• More robust the system the better detection capability

• “Advanced technologies” have become industry standard for monitoring

• Generates alerts or cases of suspicious activity

• 24 x 7 x 36528


Near Time Vs. Real Time

• Near time allows the 1st fraud transaction to be authorized – Alerts on subsequent transactions

• Real time impacts the authorization decision at the time of the transaction

32


Balancing Act

Member Impact

Stopping Fraud

33


Fraud Operations / Services

• What do you do with the alerts / cases from FMS?

• Fraud analysts activity:– Smile & Dial– Empowered to make decisions– Ability to block cards

• Recovery efforts• 24 x 7 365

34


How are YOU Involved?

• Are you actively managing your processor relationship?– Know your auth and FMS settings– Understand fraud trends– Conduct your own data analysis– Interact with your provider

• Measure your program and hold provider accountable for service– More on this later…….

35


Merchant Data Breach Response

• CAMS and MasterCard alerts

• Block and reissue strategies

• Monitoring strategies

• Can you afford to wait?

36


Merchant Breach Time Line

Early 2006 Database Compromise

June 2006 Initial Major Fraud Committed

August 2006 Fraud Reported

December 2006 Compromise Discovered

Jan 2007 Visa CAMS/MC Alerts

Charge Off

Ongoing fraud

37


Point of Compromise

• Location where the good member’s card data was stolen.

• Must be a card present (POS 90) transaction

• Fraud must also be a card present (POS 90) transaction

• Faster we find the POC, the more we win (or don’t lose)!

38

CUNA Mutual Group

How Are You Doing?How Are You Doing?

43


Key Metric….. “% $ Fraud Losses”

• Fraud Losses are measured as “a percentage of the total dollars that transact on a particular card portfolio.”

44


Calculation

$ Fraud = % $ Fraud Losses$ Sales Transacted

• Results Expressed in “Basis Points”– 1 Basis Point = 1 hundredth of 1%

• Can be used over any period of time– Commonly measured using monthly or quarterly

results

45


Industry Standard Measurement

• Adjusts automatically along with growth and increased card use

• Compares fraud losses to transaction dollars that drive interchange revenue

• Works across card types and programs

• Good Peer benchmark

46


Example

• Assume a debit portfolio has 55,000 cards• $10 Million/month in total sales

– Average interchange = 1.4% so -($10 Million X 1.4% = $140,000 interchange revenue/month)

• Assume 30 fraud cases/month, average loss is $1000 per fraud, so total loss = $30,000/month

• $30,000 Fraud / $10 Million Sales = .0030

• So- Fraud losses are currently 30 Basis Points

47


% $ Fraud Loss Benchmarks

• VISA professes that industry average = 6 BP fraud loss rate– $0.06 per $100 spent

• Most credit union issuers comfortable around 10 BPs

48

CUNA Mutual Group

Thank You!Thank You!

cuna mutual group proprietary; restricted © cuna mutual group, 2007 all rights reserved cuna mutual...

Documents

cuna mutual group bridge

plastic card losses

credit card losses

card type slide

fraud type slide

debit card losses

atm card losses

reported fraud losses