2012 payments fraud survey consolidated results

49
Payments Information & Outreach Office Federal Reserve Bank of Minneapolis 2012 Payments Fraud Survey Consolidated Results September 25, 2012

Upload: others

Post on 19-May-2022

1 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: 2012 Payments Fraud Survey Consolidated Results

Payments Information & Outreach Office Federal Reserve Bank of Minneapolis

2012 Payments Fraud Survey

Consolidated Results

September 25, 2012

Page 2: 2012 Payments Fraud Survey Consolidated Results

Topics

Survey Methodology & Respondent Profile

Fraud Attempts & Losses

Risk Mitigation

Opportunities to Reduce Payments Fraud

Conclusions

Page 3: 2012 Payments Fraud Survey Consolidated Results

Survey Methodology & Respondent Profile

3 ©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

Page 4: 2012 Payments Fraud Survey Consolidated Results

Payments Fraud Survey

Sponsored by the Federal Reserve Banks of Minneapolis, Boston, Dallas, & Richmond & the Independent Community Bankers of America (ICBA)

Conducted in April & May 2012

Survey participants include financial institution (FI) & non-FI members of regional payment & treasury management associations & ICBA

740 respondents – 93% were FIs, 7% were non-FIs

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

4

Page 5: 2012 Payments Fraud Survey Consolidated Results

Respondent Size by Revenue

The majority of respondents (58%) are relatively small with annual revenues less than $50 million

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

5

61

%

8%

9%

5%

4%

3%

0%

0%

9%

1%

15

%

13

%

6%

10

%

6%

23

%

10

%

13

%

2%

2%

0%

20%

40%

60%

Respondent Size by 2011 Revenue

FIs

Non-FIs

Page 6: 2012 Payments Fraud Survey Consolidated Results

FI Respondents

689 Financial Institution (FI) respondents

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

6

Banks 86%

Credit Unions

10%

Thrifts 4%

FI Mix

16%

17%

26%

18%

12%

7%

2%

1%

Under $50 million

$50-99 million

$100-249.9 million

$250-499.9 million

$500-999.9 million

$1-4.9 billion

$5-9.9 billion

$10 billion or more

FI Size by YE 2011 Assets

Page 7: 2012 Payments Fraud Survey Consolidated Results

FI Payment Products Offered

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

7

Target Customers Banks (N=592)

Credit Unions (N=66)

Thrifts (N=29)

Both consumers & business or commercial clients 88% 24% 62%

Primarily to consumers 6% 76% 38%

Primarily business or commercial clients 6% 0% 0%

10

0%

98

%

94

%

94

%

89

%

85

%

63

%

48

%

46

%

32

%

25

%

20

%

13

%

97

%

98

%

97

%

83

%

85

%

95

%

27

%

73

% 86

%

18

%

26

%

30

%

14

%

10

0%

96

%

93

%

79

% 93

%

93

%

50

%

39

%

32

%

25

%

18

%

14

%

18

%

10

0%

98

%

94

%

93

%

89

%

87

%

59

%

50

%

49

%

30

%

25

%

21

%

13

%

0%

20%

40%

60%

80%

100%

Wire Debit PIN

Check ACH Bill pymt

Debit signature

RDC Prepaid cards

Credit cards

Lockbox services

Inter- nat'l

pymts

Mobile pymts

P2P pymts

Payment Products Offered by % of FIs Banks

Credit Unions

Thrifts

All FIs

Page 8: 2012 Payments Fraud Survey Consolidated Results

Non-FI Respondents

Non-FI respondents from more than 14 industries; 47% were larger organizations with annual revenues over $1 billion

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

8

18%

12% 10% 10% 10%

8% 8% 6% 6% 6%

2% 2% 2% 2%

0%

5%

10%

15%

20%

Revenue $1B or more 47%

Revenue under $1B 53%

N=51

Page 9: 2012 Payments Fraud Survey Consolidated Results

Non-FI Payment Types Used

Over ¾ of businesses use check, ACH & wire payments

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

9

92

%

86

%

80

%

70

%

66

%

64

%

36

%

26

%

26

%

94

%

78

%

72

%

72

%

62

%

20

%

10

%

4%

2%

0%

20%

40%

60%

80%

100%

Check ACH credits

Wire Credit cards

ACH debits

Cash Debit signature

Debit PIN

Prepaid cards

Accepted

Disbursements

N=50

Typical Payment Counterparties % of Non-FIs

Payments to/from both consumers & businesses

53%

Payments to/from other businesses 39%

Payments to/from consumers 8%

Page 10: 2012 Payments Fraud Survey Consolidated Results

Payment Fraud Attempts & Losses

10 ©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

Page 11: 2012 Payments Fraud Survey Consolidated Results

FIs Most Prone to Signature Debit Card Frauds

96% of FIs experienced payment fraud attempts & losses

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

11

83

%

46

%

45

%

16

%

15

%

6%

2%

2%

0%

85

%

44

%

47

%

8%

13

%

5%

1%

2%

0%

0%

20%

40%

60%

80%

100%

Debit signature

Checks Debit PIN

ACH debits

Credit cards

Wire ACH credits

Cash Prepaid cards

Top 3 Payment Types with Highest # of Fraud Attempts & Losses % of FIs with Attempts or Losses

Attempts

Losses

Page 12: 2012 Payments Fraud Survey Consolidated Results

Non-FIs Most Prone to Check & Credit Card Frauds

77% of non-FIs experienced payment fraud attempts & 46% experienced losses

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

12

83

%

50

%

14

%

6%

3%

3%

3%

3%

0%

55

%

60

%

20

%

25

%

5%

10

%

5%

0%

0%

0%

20%

40%

60%

80%

100%

Checks Credit cards

ACH debits

Cash ACH credits

Debit signature

Prepaid cards

Wire Debit PIN

Top 3 Payment Types with Highest # of Fraud Attempts & Losses % of Non-FIs with Attempts or Losses

Attempts

Losses

Page 13: 2012 Payments Fraud Survey Consolidated Results

Fraud Losses & Trends

7% of respondents reported no fraud losses

69% of respondents estimated a financial-loss rate of < 0.3% of revenues

~85% of respondents reported fraud losses increased or stayed the same in 2011

Loss Range as a

% of Annual

Revenue

% of FIs (N=631)

% of

Non-FIs (N=43)

% of All

Resp. (N=674)

0% 4% 54% 7%

Over 0% < 0.3% 72% 35% 69%

0.3% - 0.5% 14% 2% 13%

0.6% - 1.0% 7% 5% 6%

1.1% - 5.0% 4% 5% 4%

Over 5.0% 1% 0% 1%

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 13

Loss Rate % of FIs (N=646)

% of

Non-FIs (N=43)

% of All

Resp. (N=689)

Increased 51% 9% 48%

Stayed the Same 34% 67% 36%

Decreased 16% 23% 16%

Column values may not add to 100% due to rounding

Page 14: 2012 Payments Fraud Survey Consolidated Results

Prevention Costs Versus Actual Fraud Losses

For most payment types, investments in fraud prevention exceed actual losses with two exceptions:

1) Debit signature

2) Mobile payments

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

14

76

%

72

%

67

%

54

%

51

%

35

%

34

%

31

%

22

%

20

%

25

%

24

% 44

%

46

%

10

%

61

%

15

%

4%

5%

4%

9%

2%

4%

55

%

5%

54

%

74

%

0% 20% 40% 60% 80%

Wire ACH Cash Debit PIN

Checks Prepaid cards

Debit signature

Credit cards

Mobile

% of FIs

Prevention Costs Actual Fraud Loss Don't Offer/Use Payment

76

%

74

%

71

%

55

%

32

%

23

%

15

%

9%

6%

19

%

26

%

18

%

28

%

21

%

14

%

9%

9%

12

%

5%

0%

12

%

18

% 4

7%

63

%

76

%

82

%

82

%

0% 20% 40% 60% 80%

ACH Checks Wire Credit cards

Cash Debit PIN

Debit signature

Prepaid cards

Mobile

% of Non-FIs

Page 15: 2012 Payments Fraud Survey Consolidated Results

Increased Fraud Losses

Half of the respondents with increased losses reported their loss rate up in 2011 by 1% to 5% compared to 2010

Increased losses were most common among card payments

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 15

Payment Types with Increased Losses

% Increase in Fraud Loss Rate

0% 1% 1% 5% 6% 6%

23% 43%

86%

Prepaid cards ACH credit

Cash ACH debits

Wire Credit cards

Check Debit PIN

Debit signature

% of FIs

0% 0%

33% 33%

0% 67%

0% 0% 0%

% of Non-FIs

67%

0%

0%

33%

18%

19%

12%

51%

Unsure

More than 10%

6 - 10%

1 - 5% FIs (N=324)

Non-FIs (N=3)

N=326 N=3

Page 16: 2012 Payments Fraud Survey Consolidated Results

11% 11%

44% 44%

56% 0% 0%

% of Non-FIs

Decreased Fraud Losses

~30% of respondents that reduced fraud losses cut their loss rate by over 10%

Reduced losses were most common among payments most vulnerable to fraud attempts & losses—cards & checks

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 16

2%

5%

10%

10%

30%

41%

69%

Wire

ACH credit

Credit cards

ACH debit

Checks

Debit PIN

Debit signature

% of FIs

Payment Types with Decreased Losses

% Reduction Achieved in Loss Rate

50%

20%

10%

20%

27%

28%

12%

32%

Unsure

More than 10%

6-10%

1-5% FIs (N=99)

Non-FIs (N=10)

N=97 N=9

Page 17: 2012 Payments Fraud Survey Consolidated Results

Reducing Fraud Losses

68% of respondents said key changes in risk management practices led to decline in losses

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 17

Key Changes Made FIs (N=68)

Non-FIs (N=6)

All (N=74)

Enhanced fraud monitoring system

72% 50% 70%

Staff training & education 62% 83% 64% Enhanced internal procedures & controls

46% 67% 47%

Adopted/increased use of risk management tools offered by financial service provider

43% 50% 43%

Enhanced method to authenticate customer &/or validate customer account

31% 50% 32%

96%

35%

29%

25%

100%

33%

33%

33%

Card trx

ACH trx

Wire trx

Check trx

FI, N=49 Non-FI, N=3

Trx Targeted by Enhanced Fraud Monitoring

Page 18: 2012 Payments Fraud Survey Consolidated Results

Perpetrators

External parties were most often responsible for successful fraud attempts

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

18

Portion of Successful Payments Fraud by Perpetrators Involved (% of Respondents)

100% 76% - 99% 51% - 75% 26% - 50% 1% - 25%

Internal Only 2% 2% 2% 4% 4%

Internal w/External Parties 3% 0% 1% 5% 4%

External Only 58% 7% 2% 3% 4%

Could Not Determine 8% 1% 1% 2% 6%

71% of respondents attributed all successful fraud to a single perpetrator category

29% of respondents attributed a portion of successful fraud to more than one perpetrator category

Page 19: 2012 Payments Fraud Survey Consolidated Results

Fraud Schemes Involving FI Customers’ Accounts

Most used schemes are counterfeit or stolen cards used at POS or online

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 19

1% 1% 2% 4% 5% 5% 5% 7%

20% 29%

41% 68%

80%

Wireless initiated payments Use of POA to defraud vulnerable person

Other Fraudulent checks converted to ACH

Use of fraudulent credentials/data Counterfeit currency

Telephone initiated payments Account takeover of customers' accounts

Other Internet payments Altered or forged checks

Counterfeit checks Counterfeit or stolen cards used online Counterfeit or stolen cards used at POS

Top 3 Most Used Schemes (% of FIs)

N=615

Page 20: 2012 Payments Fraud Survey Consolidated Results

Fraud Schemes Involving Payments Accepted by Non-FIs

Most used schemes involve checks—altered, forged & counterfeit

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 20

0%

0%

7%

10%

10%

13%

13%

20%

27%

30%

37%

53%

Telephone initiated payments

Wireless initiated payments

Fraudulent checks converted to ACH

Use of fraudulent credentials/data

Other

Other Internet payments

Cash register frauds

Counterfeit currency

Counterfeit or stolen cards used at POS

Counterfeit or stolen cards used online

Counterfeit checks

Altered or forged checks

Top 3 Most Used Schemes (% of Non-FIs)

N=30

Page 21: 2012 Payments Fraud Survey Consolidated Results

Fraud Schemes Involving Organization’s Own Banking Accounts

Most used schemes involve checks—altered, forged & counterfeit

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent. 21

7%

3%

13%

33%

27%

63%

63%

3%

7%

8%

27%

38%

39%

47%

Internal fraud scheme

Other

Breach of org's access or security controls

Fraudulent or unauthorized card trx

Fraudulent or unauthorized ACH debits

Altered or forged checks

Counterfeit checks

Top 3 Most Used Schemes (% of Respondents)

FIs (N=356)

Non-FIs (N=30)

Page 22: 2012 Payments Fraud Survey Consolidated Results

Source of Data Used in Schemes

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

22

Top 3 Information Sources Used in Fraud Schemes FIs

(N=590) Non-FIs (N=33)

"Sensitive" information obtained from lost or stolen card, check, or other physical document or device while in consumer's control

64% 39%

Physical device tampering e.g., use of skimmer on POS terminal or obtaining magnetic stripe information

38% 3%

Email and webpage cyber attacks e.g., phishing, spoofing & pharming to obtain "sensitive" customer information

33% 21%

Data breach due to computer hacking or cyber attacks 26% 15%

Information about customer obtained by family or friend 24% 3%

Organization's information obtained from a legitimate check issued by your organization

17% 67%

Lost or stolen physical documentation or electronic devices while in control of the organization

3% 9%

Employee with legitimate access to organization or customer information

1% 18%

Page 23: 2012 Payments Fraud Survey Consolidated Results

Risk Mitigation

23 ©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

Page 24: 2012 Payments Fraud Survey Consolidated Results

Internal Controls & Procedures Use by FIs

Over 80% of FIs use 12 of 15 internal controls

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

24

43%

53%

68%

80%

81%

88%

92%

92%

94%

94%

95%

95%

95%

98%

99%

3% 2%

1%

1%

4% 1%

1%

2%

2%

1%

1%

1%

0%

1%

0%

Employee hotline to report potential fraud

Dedicated computer for trxs w/ FI or FS provider

Separate banking accts by purpose or pymt type

Transaction limits for corporate card purchases

Restrict/limit staff use of Internet via org's network

Physical access controls to pymt processing functions

Transaction limits for payment disbursements

Review card-related reports daily

Logical access controls to network/pymt apps

Authentication/authorization controls-pymt process

Reconcile bank accounts daily

Verify controls applied via audit or mgmt review

Dual controls/separate duties w/in pymt processes

Address exception items timely

Periodic internal/external audits

Use Plan to Use by 2014 N=515 to 546

Page 25: 2012 Payments Fraud Survey Consolidated Results

55%

65%

68%

69%

71%

71%

71%

74%

76%

77%

79%

80%

81%

81%

82%

43%

32%

31%

31%

29%

29%

29%

26%

24%

22%

21%

20%

18%

19%

18%

2% 4%

2%

1%

0%

0%

0%

0%

0%

0%

0%

0%

1%

0%

0%

0% 20% 40% 60% 80% 100%

Restrict/limit employee Internet use from org's network

Employee hotline to report potential fraud

Separate banking accounts by purpose or pymt type

Transaction limits for corporate card purchases

Review card-related reports daily

Transaction limits for payment disbursements

Verify controls applied via audit or mgmt review

Periodic internal/external audits

Physical access controls to pymt processing functions

Address exception items timely

Logical access controls to network/payment apps

Authentication/authorization controls to pymt processes

Dedicated computer to conduct trx w/FI or FS provider

Dual control/separate duties w/in payment processes

Reconcile bank accounts daily

Very effective Somewhat effective Somewhat ineffective

95%+ rate all as effective; 55% to 80% rate as very effective

Internal Controls & Procedures Effectiveness Rated by FIs Using

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

25

N=220 to 530

Page 26: 2012 Payments Fraud Survey Consolidated Results

Internal Controls & Procedures Use by Non-FIs

Over 80% of non-FIs use 8 of 15 internal controls

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

26

41%

49%

56%

65%

73%

79%

79%

85%

88%

91%

94%

94%

94%

97%

97%

9%

3% 3%

3%

3%

0%

3%

3%

3%

3%

0%

3%

0%

0%

0%

Review card-related reports daily

Dedicated computer for trx w/ FI or FS provider

Employee hotline to report potential fraud

Restrict/limit staff use of Internet via org's network

Separate banking accts by purpose or pymt type

Transaction limits for payment disbursements

Reconcile bank accounts daily

Address exception items timely

Verify controls applied via audit or mgmt review

Transaction limits for corporate card purchases

Logical access controls to network/pymt apps

Authentication/authorization controls-pymt process

Periodic internal/external audits

Dual controls/separate duties w/in pymt processes

Physical access controls to pymt processing functions

Use Plan to Use by 2014 N=32 to 35

Page 27: 2012 Payments Fraud Survey Consolidated Results

50% 62%

72% 73% 73%

77% 79% 81% 83%

87% 93% 93% 94% 96% 100%

44% 38%

28% 23%

27% 23% 21% 19% 17%

13% 7% 7% 7% 4% 0%

6% 0% 0%

5% 0% 0% 0% 0% 0%

0% 0% 0%

0% 0% 0%

0% 20% 40% 60% 80% 100%

Employee hotline to report potential fraud Restrict/limit employee Internet use from org's network

Transaction limits for payment disbursements Separate banking accounts by purpose or pymt type

Dedicated computer to conduct trx w/FI or FS provider Transaction limits for corporate card purchases

Verify controls applied via audit or mgmt review Periodic internal/external audits

Logical access controls to network/payment apps Physical access controls to pymt processing functions

Address exception items timely Dual control/separate duties w/in pymt processes

Authentication/authorization controls to pymt processes Reconcile bank accounts daily

Review card-related reports daily

Very effective Somewhat effective Somewhat ineffective

Internal Controls & Procedures Effectiveness Rated by Non-FIs Using

90%+ rate all as effective; 70%+ rate most as very effective

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

27

N=11 to 31

Page 28: 2012 Payments Fraud Survey Consolidated Results

Customer Authentication Methods Use by FIs

Over 60% of FIs use 7 of 10 methods; 12% plan to adopt card chip authentication by 2014

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

28

2%

6%

21%

60%

65%

66%

72%

81%

84%

91%

12%

3%

5%

2%

8%

1%

1%

3%

1%

1%

Card chip authentication

Biometrics authentication

Verify customer ID is authentic (magnetic stripe)

Positive ID of purchaser for in-store/person trx

Real-time decision support during acct appl or POS

Magnetic stripe authentication

Verify CID codes on payment card

Customer authentication for online transactions

Signature verification

PIN authentication

Use Plan to Use by 2014 N=502 to 557

Page 29: 2012 Payments Fraud Survey Consolidated Results

Customer Authentication Methods Effectiveness Rated by FIs Using

Biometrics, PIN, positive ID & online authentication rated very effective by ~2/3 of FIs that use them

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

29

33%

37%

37%

44%

45%

61%

62%

64%

66%

67%

67%

55%

59%

46%

50%

37%

36%

34%

28%

33%

0%

8%

4%

11%

5%

2%

2%

2%

6%

0%

0% 20% 40% 60% 80% 100%

Card chip authentication

Magnetic stripe authentication

Verify CID codes on payment card

Signature verification

Verify customer ID is authentic (magnetic stripe)

Real-time decision support during acct appl or POS

PIN authentication

Customer authentication for online transactions

Positive ID of purchaser for in-store/person trx

Biometrics authentication

Very effective Somewhat effective Somewhat ineffective N=108 to 489

Page 30: 2012 Payments Fraud Survey Consolidated Results

Customer Authentication Methods Use by Non-FIs

Over 30% of non-FIs use 4 of 10 methods; 13% plan to adopt card chip authentication by 2014

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

30

0%

7%

11%

26%

27%

28%

32%

36%

49%

53%

13%

3%

3%

3%

0%

3%

7%

3%

6%

Biometrics authentication

Card chip authentication

Verify customer ID is authentic (magnetic stripe)

Magnetic stripe authentication

Real-time decision support during acct appl or POS

PIN authentication

Positive ID of purchaser for in-store/person trx

Signature verification

Verify CID codes on payment card

Customer authentication for online transactions

Use Plan to Use by 2014 N=30 to 35

Page 31: 2012 Payments Fraud Survey Consolidated Results

Customer Authentication Methods Effectiveness Rated by Non-FIs Using

All non-FIs that use PIN or card-chip authentication rate them as very effective

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

31

0%

25%

27%

40%

47%

50%

65%

75%

100%

100%

75%

73%

60%

40%

25%

35%

25%

0%

0%

0%

0%

0%

13%

25%

0%

0%

0%

0%

0% 20% 40% 60% 80% 100%

Biometrics authentication

Verify customer ID is authentic (magnetic stripe)

Signature verification

Positive ID of purchaser for in-store/person trx

Verify CID codes on payment card

Magnetic stripe authentication

Customer authentication for online transactions

Real-time decision support during acct appl or POS

Card chip authentication

PIN authentication

Very effective Somewhat effective Somewhat ineffective N=2 to 17

Page 32: 2012 Payments Fraud Survey Consolidated Results

Transaction Screening & Risk Mgmt Methods Use by FIs

Over 60% of FIs use 6 of 9 methods; 10% of FIs plan to adopt 3 of the methods by 2014

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

32

36%

44%

46%

63%

75%

80%

81%

86%

94%

10%

6%

7%

10%

11%

4%

1%

0%

3%

Centralized fraud info database - mult pymt types

Centralized fraud info database - one pymt type

Centralized risk management department

Fraud detection software w/ pattern matching

Provide customer edu. on pymt fraud risk mitigation

Participate in fraudster databases & receive alerts

Human review of payment transactions

Fraud detection pen for currency

Provide staff edu. on pymt fraud risk mit.

Use Plan to Use by 2014 N=522 to 564

Page 33: 2012 Payments Fraud Survey Consolidated Results

Trx Screening & Risk Mgmt Methods Effectiveness Rated by FIs Using

Centralized risk mgmt & fraud detection software rated very effective by ~60% of FIs that use them

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

33

26%

42%

48%

49%

52%

57%

57%

61%

62%

69%

55%

52%

48%

45%

43%

42%

39%

36%

6%

4%

0%

3%

3%

0%

1%

1%

2%

0% 20% 40% 60% 80% 100%

Provide customer edu.on payment fraud risk mit.

Participate in fraudster databases & receive alerts

Provide staff edu. on payment fraud risk mit.

Human review of payment transactions

Fraud detection pen for currency

Centralized fraud info database - one pymt type

Centralized fraud info database - mult pymt types

Fraud detection software w/ pattern matching

Centralized risk management department

Very effective Somewhat effective Somewhat ineffective N=185 to 525

Page 34: 2012 Payments Fraud Survey Consolidated Results

Transaction Screening & Risk Mgmt Methods Use by Non-FIs

Over 50% of non-FIs use 3 of 9 methods; 6% -9% plan to provide customer & staff education by 2014

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

34

3%

9%

11%

13%

15%

29%

50%

70%

86%

3%

3%

6%

7%

3%

0%

3%

9%

0%

Centralized fraud info database - mult pymt types

Centralized fraud info database - one pymt type

Participate in fraudster databases & receive alerts

Provide customer edu. on pymt fraud risk mit.

Fraud detection software w/ pattern matching

Fraud detection pen for currency

Centralized risk management department

Provide staff edu. on pymt fraud risk mit.

Human review of payment transactions

Use Plan to Use by 2014 N=31 to 35

Page 35: 2012 Payments Fraud Survey Consolidated Results

Trx Screening & Risk Mgmt Methods Effectiveness Rated by Non-FIs Using

7 of 9 methods rated as very effective by ½ of the non-FIs that use them

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

35

20%

44%

50%

50%

52%

59%

67%

100%

100%

80%

56%

25%

50%

48%

41%

33%

0%

0%

0%

0%

25%

0%

0%

0%

0%

0%

0%

0% 20% 40% 60% 80% 100%

Fraud detection pen for currency

Centralized risk management department

Participate in fraudster databases & receive alerts

Provide customer edu.on payment fraud risk mit.

Provide staff edu. on payment fraud risk mit.

Human review of payment transactions

Centralized fraud info database - one pymt type

Fraud detection software w/ pattern matching

Centralized fraud info database - mult pymt types

Very effective Somewhat effective Somewhat ineffective N=3 to 29

Page 36: 2012 Payments Fraud Survey Consolidated Results

FI Risk Services Use by Non-FIs

60% of non-FI respondents use 8 of 13 risk services offered by FIs; ACH risk services are highest among services companies plan to adopt by 2014

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

36

16% 19%

27% 42%

53% 61%

67% 69%

74% 77%

82% 85%

97%

3% 16%

0% 3%

6% 6%

0% 3%

0% 3%

0% 0%

0%

Account masking services ACH payee positive pay Post no check services

ACH positive pay Check payee positive pay

Card alert services for commercial/corporate cards Fraud loss prevention services, e.g., insurance

ACH debit filters Account alert services

ACH debit blocks Check positive pay/reverse positive pay

Multi-factor authentication to initiate payments Online information services, e.g., statements

Use Plan to Use by 2014 N=31 to 34

Page 37: 2012 Payments Fraud Survey Consolidated Results

FI Risk Services Effectiveness Rated by Non-FIs Using

All positive pay, payee positive pay & acct masking services rated very effective by 90%+ of companies using them

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

37

43% 62% 63%

72% 78%

86% 90% 92% 93% 96% 100% 100% 100%

43% 38%

32% 28%

11% 14% 10%

8% 7% 4% 0% 0%

0%

14% 0%

5% 0%

11%

0% 0% 0% 0% 0% 0% 0% 0%

0% 20% 40% 60% 80% 100%

Fraud loss prevention services, e.g., insurance Account alert services

Card alert services for commercial/corporate cards Online information services, e.g., statements

Post no check services ACH debit filters

Multi-factor authentication to initiate payments ACH positive pay

Check positive pay/reverse positive pay ACH debit blocks

Check payee positive pay ACH payee positive pay

Account masking services

Very effective Somewhat effective Somewhat ineffective N=5 to 32

Page 38: 2012 Payments Fraud Survey Consolidated Results

FI Risk Services Offered by FIs & FS Providers

Over 85% of the FIs offer the two services used by most businesses surveyed; 50% of the FIs offer 5 of the 13 services

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

38

15% 17% 19% 20%

30% 34%

44% 52% 53%

65% 87%

93%

9% 9%

2% 9%

9% 7%

7% 5% 4%

8% 3%

2%

ACH payee positive pay Check payee positive pay

Post no check services ACH positive pay

Check positive pay/reverse positive pay ACH debit filters

Card alert services for commercial/corporate cards ACH debit blocks

Account masking services Account alert services

Multi-factor authentication to initiate payments Online information services, e.g., statements

Offer Plan to Offer by 2014 N=495 to 531

FI plans to offer services align

with demand by businesses, e.g., ACH risk services

Page 39: 2012 Payments Fraud Survey Consolidated Results

Barriers to Reducing Payments Fraud

Most identified some aspect of “cost” as the main barrier

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

39

Barriers FIs Non-FIs All Lack of staff resources 56% 70% 57%

Consumer data privacy issues/concerns 39% 33% 39%

Cost of implementing in-house fraud detection tool/service 39% 7% 37%

Cost of implementing commercially available fraud detection tool/service

38% 19% 37%

Lack of compelling business case (cost vs. benefit) to adopt new or change existing methods

37% 48% 37%

Corporate reluctance to share information due to competitive issues

15% 22% 15%

Unable to combine payment information for review due to operating w/ multiple business areas, states or banks

15% 19% 15%

Page 40: 2012 Payments Fraud Survey Consolidated Results

Opportunities to Reduce Payments Fraud

40 ©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

Page 41: 2012 Payments Fraud Survey Consolidated Results

New Methods Needed

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

41

New or Improved Methods Most Needed FIs

(N=537)

Non-FIs

(N=32)

All

(569)

Controls over Internet payments 66% 41% 65%

Replacement of card/magnetic stripe technology 62% 31% 60%

Consumer education on fraud prevention 62% 47% 61%

More aggressive law enforcement 51% 41% 50%

Information sharing on emerging fraud tactics being

conducted by criminal rings 45% 63% 46%

Controls over mobile payments 45% 44% 44%

Industry specific education on best prevention practices

for fraud 34% 28% 34%

Industry alert services 29% 31% 29%

Image survivable check security features for biz checks 16% 19% 16%

Page 42: 2012 Payments Fraud Survey Consolidated Results

Authentication Adoption Methods Preferred

Majority favor a “Chip & PIN” requirement & multi-factor authentication

Adoption of EMV technology (Chip) is just getting underway in the U.S.

©2012 Federal Reserve Bank of Minneapolis - Materials are not to be used without consent 42

Authentication Method Preferences

FIs Non-FIs All

Chip & PIN requirement 60% 39% 59%

Multi-factor authentication 57% 46% 56%

Chip for dynamic authentication

43% 31% 42%

PIN requirement 39% 42% 39%

Out-of-band/channel authentication to authorize payment

38% 15% 37%

Token 38% 62% 39%

Mobile device to authenticate person

28% 27% 27%

Biometrics 24% 8% 23%

Page 43: 2012 Payments Fraud Survey Consolidated Results

Legal or Regulatory Change

Top three changes identified by respondents that would help reduce payments fraud:

Place responsibility to mitigate fraud & shift liability for fraudulent card payments to the entity that initially accepts the card payments

Increase penalties to perpetrators for attempted & successful fraud

Place more responsibility on consumers & customers to reconcile & protect their payments data

43 ©2012 Federal Reserve Bank of Minneapolis - Materials are not to be used without consent

Page 44: 2012 Payments Fraud Survey Consolidated Results

Conclusions

44 ©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

Page 45: 2012 Payments Fraud Survey Consolidated Results

Conclusions

Considered as a whole, the 2012 payments fraud survey results suggest the following: Payments related fraud remains a significant concern

of FIs & others

For FIs, signature debit card is the payment instrument most vulnerable to attempted fraud & FI losses

Over half of FIs reported that signature debit card losses from fraud exceeded their investment in mitigation to prevent such fraud; this seems to suggest a cost-effective opportunity to increase these fraud prevention investments

©2012 Federal Reserve Bank of Minneapolis - Materials are not to be used without consent 45

Page 46: 2012 Payments Fraud Survey Consolidated Results

Conclusions (continued)

For non-FIs, check continues to be the payment instrument most vulnerable to attempted fraud & losses

Corporate account take-over can result in significant losses, but it was not identified as a commonly occurring fraud scheme that affected a high percentage of respondents to this survey

Most FIs & others report total fraud losses that represent less than 0.3% of their annual revenues

Strategies to detect & prevent fraud effectively require the use of multiple mitigation methods & tools – i.e., a “layered” strategy

©2012 Federal Reserve Bank of Minneapolis - Materials are not to be used without consent 46

Page 47: 2012 Payments Fraud Survey Consolidated Results

Conclusions (continued)

Two-thirds of respondents that reduced their fraud losses cited enhanced fraud monitoring systems & employee education & training

Offering risk mitigation services to customers is a growing area of opportunity for FIs

Cost is the main barrier that prevents FIs & others from investing more in mitigating payments fraud

FIs & others are focused now on the need for alternatives to magnetic stripe authentication technology to secure card payments

©2012 Federal Reserve Bank of Minneapolis - Materials are not to be used without consent 47

Page 48: 2012 Payments Fraud Survey Consolidated Results

Regional Survey Results

48 ©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

Page 49: 2012 Payments Fraud Survey Consolidated Results

Regional Survey Results

Federal Reserve Bank Contacts

Marianne Crowe Federal Reserve Bank of Boston Payment Strategies http://www.bostonfed.org/bankinfo/payment-strategies/index.htm

Matt Davies Federal Reserve Bank of Dallas Financial Institution Relationship Management http://www.dallasfed.org/banking/firm/fi.cfm

Claudia Swendseid or Amanda Dorphy Federal Reserve Bank of Minneapolis Payments Information & Outreach Office http://www.minneapolisfed.org/about/whatwedo/paymentsinformation.cfm

Pamela Rabaino Federal Reserve Bank of Richmond Payments Studies Group http://www.richmondfed.org/

©2012 Federal Reserve Bank of Minneapolis. Materials are not to be used without consent.

49