13 2012 ONLINE FRAUD REPORT Online Payment Fraud Trends, Merchant Practices and Benchmarks TH ANNUAL CyberSource Online Fraud Report Report & Survey Methodology Summary of Participants’ Profiles The survey was conducted via online questionnaire by Mindwave Research. Participating organizations completed the survey between September 13th and October 12th 2011. All participants were either responsible for or influenced decisions regarding risk management in their companies. 12% of the survey participants use CyberSource fraud management solutions. This report is based on a survey of U.S. and Canadian online merchants. Decision makers who participated in this survey represent a blend of small, medium and large-sized organizations based in North America. Merchant experience levels range from companies in their first year of online transactions to some of the largest retailers and digital distribution entities in the world. Merchants participating in the survey reported a total estimate of more than $83 billion for their 2011 online sales. Online Fraud Survey Wave Total number of merchants participating 2007 2008 318 400 2009 2010 352 334 2011 325 Annual Online Revenue Less than $5M $5M to Less than $25M $25M or More 56% 15% 29% 55% 14% 31% 56% 15% 29% Duration of Online Selling Less than One Year 1-2 Years 3-4 Years 5 or More Years 5% 11% 5% 6% 5% 13%12% 16%11% 12% 16%13% 14%19% 15% 66% 64% 65% 64% 68% Risk Management Responsibility Ultimately Responsible Influence Decision 55%58% 54%55% 50% 45%42% 46%45% 50% 53% 18% 29% 54% 14% 32% Get Tailored Views of Risk Management Pipeline Metrics ™ For sales assistance or to get a view crafted for your company’s size and industry, please contact CyberSource at +1 888 330 2300 (international: +1 650 432 7350) or online at www.cybersource.com/contact_us. For additional information, whitepapers and webinars: Fraud Management Solutions: visit www.cybersource.com/products_and_services/fraud_management/ Global Payment Solutions: visit www.cybersource.com/products_and_services/global_payment_services/ Payment Security Solutions: visit www.cybersource.com/products_and_services/payment_security/ © 2012 CyberSource Corporation. All rights reserved. iii CyberSource Online Fraud Report Table of Contents EXECUTIVE SUMMARY. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 STAGE 1: AUTOMATED SCREENING. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Fraud Detection Tools Used During Automated Screening.. . . . . . . . . . . . . . . . . . . . . . . . . . . 3 Planned Automated Screening Tool Usage 2012. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Automated Decision/Rules Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 STAGE 2: MANUAL REVIEW. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Manual Order Review Rates. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Tools Used/Planned During Manual Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 Review Operations Efficiency. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 STAGE 3: ORDER DISPOSITIONING (ACCEPT/REJECT)��������������������� 9 Post-Review Order Acceptance Rates. Overall Order Rejection Rates. . . . . . International Orders Riskier. . . . . . . Estimating Valid Order Rejection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 . . 9 . 10 . 10 STAGE 4: FRAUD CLAIM MANAGEMENT������������������������������� 11 Types of Fraudulent Transactions. . Friendly Fraud. . . . . . . . . . . . . Fighting Chargebacks. . . . . . . . . Fraud Rate Metrics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 11 11 12 TUNING & MANAGEMENT. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Clean Fraud Still a Problem. . . . . . . Tracking Mobile Fraud. . . . . . . . . . Size of Fraud Management Budgets. . Budget Allocation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 14 14 15 Conclusion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 RESOURCES & SOLUTIONS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 ABOUT CYBERSOURCE.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 © 2012 CyberSource Corporation. All rights reserved. v CyberSource Online Fraud Report Executive Summary Managing online fraud continues to be a significant and growing cost for merchants of all sizes. To better understand the impact of payment fraud for online merchants, CyberSource sponsors annual surveys addressing the detection, prevention and management of online fraud. This report summarizes findings from our 13th annual survey. Note: this report provides benchmarks on total fraud rates (chargebacks and credits issued directly to consumers by merchants). As such, these metrics tend to be higher than those reported by banks and card schemes, which generally base reported rates on chargeback activity only. Estimated $3.4 Billion Lost to Online Fraud In 2011, merchants reported losing an average of 1.0% of total online revenue to fraud. Although 2011 showed an uptick in revenue loss rate versus the prior year, merchants reported a 33% decrease in the percent of orders lost to fraud, 0.6%. Using 2011 industry market projections1 on eCommerce in North America, we estimate that the total revenue loss translates to approximately $3.4 billion, a $700 million increase over 2010 results (see Chart #1). Chargebacks Account for less than 50% of Fraud This year’s survey probed the percent of fraud losses accounted for by chargebacks. Overall, merchants continue to report that chargebacks accounted for less than half of fraud losses — 41%, on average. The majority of fraud loss is due to merchants issuing a credit to reverse a charge in response to a consumer’s claim of fraudulent account use, or because of subsequent information from additional orders that indicate likelihood of fraud on the recently placed order. For digital goods with instant fulfillment, credits could be issued afterwards, once fraud has been detected. International Order Acceptance is Riskier Accepting international orders is riskier than domestic orders. Merchants reported an international fraud rate by order rate of 2.0%, more than three times higher than domestic. In response to the higher perceived risk, merchants rejected international orders at a rate nearly three times higher than domestic orders (7.3% vs. 2.8%, respectively). In 2011, the order rejection rate continued to increase as it has done since 2009. Merchants reported that they reject an average of 2.8% of orders due to suspicion of payment fraud. % Revenue Lost to Online Fraud Online Revenue Loss Due to Fraud Estimated $3.4B in 2011 1 4.0% 4.5 3.5% $4.0 2.9 3.0% $3.7 $3.1 2.5% 2.0% 1.7 1.8 1.6 1.4 1.5% 1.4 1.4 1.2 0.9 1.0% 1.0 3.0 $2.6 $3.4 $3.3 3.5 $ Loss in Billions % Online Revenue Lost 4.0 3.2 $2.8 $2.7 2.5 $2.1 2.0 $1.7 $1.9 1.5 1.0 0.5% 0.5 0.0% 0.0 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 1 Based on eMarketer projections, with an 8% uplift to account for the merchant segments covered by the survey but not by eMarketer’s market sizing. 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 © 2012 CyberSource Corporation. All rights reserved. 1 CyberSource Online Fraud Report Manual Review Rates are Slightly Up Mobile Fraud Risk is Mostly Unknown After remaining at 72% in the last two years, the percent of merchants conducting manual review increased to 75% in 2011, with 27% of orders routed to manual review (vs. 24% in 2010). Merchants continue to rely heavily on manual review teams as a defense against fraud, with the review teams accessing an average of 4.2 systems to research and disposition the order (vs. 4.0 in 2010). This year, we asked about merchant perception of fraud in the mobile channel, which we defined as either commerce on a mobile-optimized website or through a mobile app. Overall, 92% of merchants do not know their mobile fraud rates, 7% perceive that mobile fraud rates are the same or lower than online fraud, while 1% perceive mobile fraud to be slightly higher. Total Risk Management Pipeline View Opportunities to Streamline Fraud Management As eCommerce sales continue to grow, scalability will become more of a pressing issue. Merchants continue to face the challenge of screening more online orders while keeping manual review staffing and fraud rates as low as possible. Yet 82% of merchants reported that their fraud budgets will stay the same or decrease, and only 18% reported that they will not be increasing their order review staff. With more volume and limited resources, emphasizing and improving automated fraud detection capabilities is a top priority for 55% of the merchants surveyed. The need for better automation is understandable when 75% of manually reviewed orders are ultimately accepted. To be successful, fraud managers will need to adopt tools and practices to reduce the number of orders being routed to review, as well as enable their review teams to operate more efficiently. Businesses that concentrate solely on minimizing chargebacks may not see the complete financial picture. Online payment fraud impacts profits from online sales in multiple ways. Besides direct revenue losses, the cost of stolen goods/ services and associated delivery/fulfillment costs, there are the additional customer experience “costs” of rejecting valid orders, staffing manual review, administration of fraud claims, as well as challenges with scaling fraud management operations as business grows. Merchants can realize certain efficiencies by taking a total risk management pipeline view of operations and costs. While the fraud rate is one metric to monitor (and maintain within industry and card scheme limits), an end-toend view is required to achieve the optimal financial outcome. In 2011, these “profit leaks” in the Risk Management Pipeline™ impact as much as 30% of orders for mid-sized merchants and as much as 13% of orders for larger merchants — driven primarily by too many orders being manually reviewed, which restricts profits, operating efficiency and scalability. This report details key metrics and practices at each point in the pipeline to provide you with benchmarks and insight. Custom views of these benchmarks and practices are available through CyberSource — see end of report for contact information. Risk Management Pipeline Order Automated Screening PROFIT LEAKS Manual Review Staffing & Scalability Lost Sales 75% of merchants review orders; these merchants review 27% of orders, on average 2.8% Avg. Reject Rate for U.S./ Canadian orders (all merchants) 52% of fraud management budget is spent on review staff costs 75% of these merchants have no plans to change manual order review staffing during 2012 2 Accept / Reject Fraud Claim Management Fraud Loss & Administration 1.0% Average Fraud Loss 41% from chargebacks 59% from credit issued Retained Revenue CyberSource Online Fraud Report Stage 1: Automated Screening Order Automated Screening Manual Review Accept / Reject Fraud Claim Management Retained Revenue Tuning and Management Fraud Detection Tools Used During Automated Screening We define fraud detection tools as those used to assess the probability of risk associated with a transaction. They are categorized into four groups: validation services, proprietary data, purchase device tracing, and multi-merchant data. Results from these tools drive the decision to accept, reject or review the transaction, either through an automated rules-based system or manually. In 2011, 56% of merchants surveyed utilize an automated screening system. Of these, 68% of merchants report using at least 3 tools in their automated screening solution and an average of 4.9 tools overall. Larger merchants processing higher order volumes use an average of 8 tools. Sheer order volume could necessitate automated screening or more sophistication to address fraud, as well drive fraudsters to target these merchants more often. In addition, larger merchants consistently show higher utilization of more tools, as shown in Chart #2, which highlights the most popular fraud detection tools used. Ninety-seven percent of merchants use one or more validation tools. Some are provided by the card schemes, such as Card Verification Number (CVN), Address Verification Service (AVS), and payer authentication services (Verified by Visa, MasterCard SecureCode), and others are provided by third-party verification services. Not surprisingly, CVN and AVS show the most widespread adoption, as they are provided at no additional cost. But in terms of effectiveness, with the larger merchants, few cited CVN and AVS in one of their top three tools in terms of effectiveness (see Chart #3). This could be explained by the relative ease of obtaining CVNs on the black market, and the limited availability of AVS data outside of North America. In terms of leveraging customer history, 67% of merchants currently use or are planning to use their own proprietary data. In particular, the use of company-specific fraud-scoring models and customer website behavior analysis grew in 2011. 2 Fraud Detection Tool Usage 2011 All Merchants Validation Services (Net) Card Verification Number (CVN) Address Verification Service (AVS) Postal address validation services Verified by Visa/MasterCard SecureCode Telephone # verification/reverse lookup Social networking sites Paid-for public records services Credit history check Out-of-wallet or in-wallet challenge/response systems 39 25 22 10 7 9 6 55 5 2 Proprietary Data/Customer History (Net) 41 Purchase Device Tracing (Net) 48 40 25 16 Multi-Merchant Data/Purchase History (Net) Shared negative lists – shared hotlists Multi-merchant purchase velocity Other 17 14 67 43 14 38 13 35 8 30 11 22 20 20 11 Customer order history Negative lists (in-house lists) Order velocity monitoring Fraud scoring model – company specific Customer website behavior analysis Positive lists IP geolocation information Device “fingerprinting” 97 79 77 13 20 18 30 17 15 15 15 4 8 Merchants $25M+ Online Revenue Validation Services (Net) Card Verification Number (CVN) Address Verification Service (AVS) Postal address validation services Verified by Visa/MasterCard SecureCode Telephone # verification/reverse lookup Social networking sites Paid-for public records services Credit history check Out-of-wallet or in-wallet challenge/response systems 100 86 86 47 24 20 22 8 6 9 4 12 14 37 4 12 2 Proprietary Data/Customer History (Net) 89 Customer order history Negative lists (in-house lists) Order velocity monitoring Fraud scoring model – company specific Customer website behavior analysis Positive lists 62 8 75 29 39 6 14 20 18 84 68 IP geolocation information Device “fingerprinting” 20 43 Multi-Merchant Data/Purchase History (Net) 40 51 Shared negative lists – shared hotlists Multi-merchant purchase velocity % Using OR Planning to Use 10 63 62 Purchase Device Tracing (Net) Other 12 4 29 27 22 18 34 % Currently Using % Planning to Implement © 2012 CyberSource Corporation. All rights reserved. 3 CyberSource Online Fraud Report 3 Most Effective Fraud Management Tools Multi-merchant data and purchase history is less utilized in comparison to the other three categories, but can be quite useful to merchants. Statistically, the average top ten Internet merchant sees only 1/100th of the actual annual online transaction activity, at best. Multi-merchant data gives a wider view of activity to detect subtle fraud patterns, by providing a broader pool of transactions for merchants to analyze for linkages and potential fraud. Validation Services (Net) 33 Paid-for public records services 26 Address Verification Service (AVS) 25 Card Verification Number (CVN) Contact customer to verify order 24 Verified by Visa OR MasterCard SecureCode 18 17 Credit history check 10 Telephone # verification/reverse lookup 7 Contact card issuer/Amex CVP 5 Postal address validation services Validation using social networking sites Tool selected as one of “TopThree” most effective fraud tools by 25%+ of those using it 4 Google Maps lookup 0 Out-of-wallet or in-wallet challenge/response systems 0 Proprietary Data/Customer History (Net) Fraud scoring model – company specific 39 Negative lists (in-house lists) 38 29 Order velocity monitoring 27 Customer order history Customer website behavior analysis Positive lists Multi-merchant data can be difficult to obtain without the use of a third-party provider, due to legal and privacy regulations. Similarly, shared negative lists are subject to legal regulations and are only as good as the information provided by others — and in some cases the data can be outdated or inaccurate. Shared data is only effective if there is a sufficiently large volume of current, accurate data to correlate and analyze. The use of shared negative lists fell by 3% among large merchants, yet use of multi-merchant purchase velocity increased by 16% (vs. 2010). For merchants of all sizes, shared negative lists grew by 2%, and multi-merchant purchase velocity grew by 6%. Planned Automated Screening Tool Usage 2012 4 3 Device Fingerprinting Highest on “Plan to Buy” Lists Purchase Device Tracing (Net) Fifty-seven percent of surveyed merchants plan to add one or more new fraud detection tools in the next twelve months. Device fingerprinting and customer website behavior analytics are the two tools that most merchants expect to evaluate for adoption in the next year. 46 Device fingerprint results 45 Device “fingerprinting” 37 IP geolocation information Multi-Merchant Data/Purchase History (Net) 44 Multi-merchant purchase velocity 34 Shared negative lists — shared hotlists 0% 10% 20% 30% 40% 50% Base: Merchants with annual online sales ≥$25M who use tool: automated or manual (excludes None) Customer website behavior analysis is one of the newer fraud tools available. It attempts to assess whether or not the customer’s visit and website activity is consistent with that of a typical user. For instance, the time spent on checkout or the number of pages viewed varies greatly between a typical user and a fraudster using a bot. Although adoption is currently relatively low, it may increase as fraudsters learn how to circumvent traditional mitigation tools. Purchase device tracing are tools that attempt to validate the device and location of the network from which the order is being placed. They continue to show broader adoption. For the 4 fraudster, bypassing device fingerprinting and IP geolocation requires more sophistication than just obtaining stolen customer identity and payment data. As a result, device fingerprinting and IP geolocation were cited most often by large merchants as one of their top three effective tools. As in past years, card scheme payer authentication services figure prominently in merchants’ future plans. The 2011 survey results show that 25% of merchants currently use one or more of the available payer authentication services, and 20% say they are interested in deploying within the next twelve months. Despite significant interest in implementing payer authentication systems over the past few years, we have seen relatively slow adoption of payer authentication since we started tracking this tool in 2003. But with recent bank and regulatory mandates on using payer authentication, particularly abroad, merchant adoption is expected to increase, at least for those merchants that have localized websites. Automated Decision/Rules Systems Automated Order Screening Fifty-six percent of merchants utilize an automated decisioning system. These systems apply a merchant’s business rules to CyberSource Online Fraud Report evaluate risk on incoming orders in real-time. As companies grow in size and the number of fraud detection tools increases, leveraging these assets as part of an automated order screening solution will become increasingly imperative. Decision systems can help organizations quickly analyze data from incoming transactions and assess their risk, thereby enabling merchants to scale their businesses as order volumes increase. BEST PRACTICE advice To improve fraud detection and combat fraud, focus on gathering as much data as possible on every transaction, no matter how trivial it may seem. The larger the data pool, the more likely you are to detect fraud. Because fraud patterns are dynamic, automated screening systems allow merchants to implement changes quickly; 54% of merchants say that changes are implemented instantly. Furthermore, over 80% of the merchants surveyed have a confidence level of 75% or higher that the changes implemented will have the intended results. Using this broad dataset as the foundation, correlate each individual transaction element with historical instances of fraud to determine its predictive value. Moreover, correlate the various combinations of these elements with fraud, to uncover the subtle interplay between data elements that are indicative of fraud. Results of Automated Screening By applying a rigorous statistical approach to your data, you can derive analytic models that present a strong, multi-layered defense against fraud attacks. The automated order screening process generates three outcomes: 1) order acceptance without further review, 2) orders flagged for further review and 3) automatic order rejection. Some merchants allow this initial automated screen to cancel orders without further human intervention. Forty-eight percent of all merchants cancelled some orders as a result of their automated screening process and 60% of large merchants indicated they cancelled some orders at this stage (see Chart #4). 4 Are Inbound Orders Rejected Based Solely On Automated Screening? All Merchants Merchants $25M+ Online Revenue 35% Yes 48% 43% No 52% No 40% Yes 60% 13% 17% Yes, but generally ONLY if customer is on our negative list Yes, if automated tests indicate too much risk OR customer is on our negative list No, generally all suspicious orders are outsorted for manual review Base: Merchants using automated services/technologies © 2012 CyberSource Corporation. All rights reserved. 5 CyberSource Online Fraud Report Stage 2: Manual Review Order Automated Screening Manual Review Accept / Reject Fraud Claim Management Retained Revenue Tuning and Management Orders which do not pass the automated order screening stage typically enter a manual review queue. During manual review, additional information is often collected to determine if orders should be accepted or rejected due to excessive fraud risk. Manual review is often the largest portion of an organization’s fraud management operations, representing just over half of the budget. Staff overhead is costly, limits scalability and could potentially impact customer satisfaction as order volume increases, due to the inherent latency associated with manual review processes. Seventy-five percent of merchants surveyed do not anticipate a change in staffing levels in 2012, yet retail eCommerce is forecasted to grow by 11.3% in 20122. This presents significant challenges to profit growth, especially if the total number of orders to be manually reviewed increases in lockstep with the total increase of online sales. Merchants could divert more staff time to order review, or increase staffing levels, but both options would increase overhead costs. Alternatively, merchants can allow more time to process orders, but they would need to consider impacts to customer service in the event of shipping delays. Another option would be to fine-tune their automated decisioning system to accurately disposition more orders up front, thereby sending fewer orders to manual review. 5 Manual Review Trends 80% 70% 72 69 75 72 60% 50% 40% 32 28 30% 22 20 20% 27 24 17 17 10% 0% 2009 2008 2010 2011 % Merchants Performing Manual Order Review % Orders Reviewed by Merchants Practicing Review % of Orders Reviewed Overall (Net Review) Average % of Orders Manually Reviewed 6 (for merchants engaged in review) 50% Manual Order Review Rates Seventy-five percent of merchants surveyed conduct manual review, a percentage that has remained relatively stable over the last few years. For those merchants that do conduct manual reviews, the percentage of all orders that are manually reviewed increased slightly, to 27% (see Chart #5). Review rates for merchants with up to $25 million in online sales are more than double those of larger merchants (see Chart #6). Lower order volume and the lack of an automated order screening system may account for the higher review rates — only 43% of these smaller merchants have an automated order screening system. 2009 45 40% 30% 37 28 2010 2011 35 33 33 27 24 22 22 21 20% 12 10% 2 eMarketer, “U.S. Retail Sales, 2009 – 2015” 9 0% Overall <$5M $5M – <$25M $25M – <$100M Annual Online Revenue 6 15 12 $100M+ CyberSource Online Fraud Report Tools Used/Planned During Manual Review Although many of the same fraud detection tools are used for both automated and manual reviews, the review team typically leverages additional tools and processes when attempting to validate an order. “Customer order history” and “Contacting the customer” continue to be employed most often. The tools that have seen the highest growth in adoption are Google Maps for investigating delivery addresses, along with IP geolocation (see Chart #7). In addition to the aforementioned tools, “Using device fingerprinting results” (where results of device fingerprinting information are exposed in the manual review screens) and “Postal address validation services” have seen more adoption with large merchants in 2011. “Using device fingerprinting results” was the most cited by merchants as a technology they would most likely be implementing in 2012. Review Operations Efficiency Reviewer Efficiency 7 Fraud Detection Tool Usage 2011 All Merchants Validation Services 91 Contact customer to verify order 65 55 10 54 7 Telephone # verification/reverse lookup Google Maps lookup 48 10 19 Postal address validation services 40 Contact card issuer/Amex CVP 33 24 6 Social networking sites Paid for public records services Credit history check 17 5 8 Customer order history 41 21 Positive lists 14 75 27 Multi-Merchant Data/Purchase History 17 Shared negative lists – shared hotlists 50 23 75 4 80 7 73 Google Maps lookup 55 7 62 7 Contact card issuer/Amex CVP 55 4 50 7 Social networking sites Paid for public records services 14 92 Proprietary Data/Customer History 83 Customer order history 63 7 Negative lists (in-house lists) Customer website behavior 38 Positive lists 37 18 14 IP geolocation information 33 28 Shared negative lists – shared hotlists Other % Using OR Planning to Implement 50 37 Multi-Merchant Data/Purchase History 18 2 % Currently Using 6 5 Overall <$5M $5M – <$25M $25M – <$100M $100M+ Annual Online Revenue 2009 2010 2011 Merchants reported that reviewers accessed or input data into an average of 4.2 systems, with 10% of merchants reporting usage of 10 or more systems. The inability to seamlessly integrate or automatically interface with these multiple systems negatively impacts reviewer productivity, which is exacerbated as the number of systems in use increases. Final Order Disposition 72 62 11 Purchase Device Tracing Device fingerprint results 25 5 97 Postal address validation services 45 0 Validation Services Telephone # verification/reverse lookup 100100 60 50 50 25 Contact customer to verify order 10 60 30 4/2 Merchants $25M+ Online Revenue Credit history check 100 100 53 46 11 36 IP geolocation information Other 125 8 Purchase Device Tracing 150 150 8 19 35 Customer website behavior Device fingerprint results 150 81 69 10 Negative lists (in-house lists) 8 Orders Manually Reviewed per Day, Per Reviewer 8 Proprietary Data/Customer History The median number of orders a reviewer processes in a day ranged from 6 for small merchants to 100 for large merchants (see Chart #8). Large merchants who have case management systems typically achieve twice the throughput per reviewer in the manual review stage, in part due to more sophisticated review systems and experienced investigators. % Planning to Implement (in the next 12 months) Automated screening and manual order review ultimately result in order acceptance or rejection. A relatively high percentage of orders manually reviewed are ultimately accepted (see next section). This highlights the need for merchants to continue improving automated screening accuracy and reduce their reliance on expensive manual review processes. A look at order reject and acceptance rates follows in Stage 3 of the pipeline review. © 2012 CyberSource Corporation. All rights reserved. 7 CyberSource Online Fraud Report BEST PRACTICE advice To optimize the manual review process, focus on how your reviewers can access the information they need in the most intuitive and direct way possible. Use a case management system that can consolidate all of the information relating to the order in one place. Provide a structured framework and checklist for investigating orders to your review team, which help to streamline the process and ensure consistency in dispositioning orders. Finally, measure the performance of your review team by looking at key metrics (such as orders reviewed per day, length of time in queue, chargebacks from the manual review process and by reviewer), to identify areas for improvement at both the reviewer and team level. 8 CyberSource Online Fraud Report Stage 3: Order Dispositioning (Accept / Reject) Automated Screening Order Manual Review Accept / Reject Fraud Claim Management Retained Revenue Tuning and Management Post-Review Order Acceptance Rates Of the orders that are manually reviewed, on average, 75% of them are ultimately accepted. Over half of the merchants surveyed state that they accept over 90% of the orders placed into review (see Chart #9). With three out of every four orders accepted, these merchants are incurring significant expense to review legitimate orders (see Chart #10). Either excessively high acceptance or rejection rates can indicate more orders than necessary are being diverted to manual review, a situation that can be corrected by tuning automated screening rules/detectors to isolate and systematically disposition more of these orders. 90% 80% % Acceptance Rate 1-9% 3 10-19% 3 20-29% 2 30-39% 2 40-49% 70-79% 60% 50% 40% 30% 31 25 28 19 17 20% 10% Overall <$5M $5M – <$25M $25M – <$100M $100M+ Annual Online Revenue Accepted Rejected Overall Order Rejection Rates 7 (Overall and by Merchant Size) 4 3.9 4% 3.3 5 13 80-89% 7 2.7 2.8 2.6 2.8 3.0 2.7 2.1 49 90-99% 11 Average % Orders Rejected Due to Suspicion of Fraud 1 3% 100% 69 Order reject rates can either reflect true fraud risk or signal a potential “profit leak” in terms of customer insults. In 2011, merchants reported rejecting an average of 2.8% of orders domestically (see Chart #11). 50-59% 60-69% 81 72 9 4 0% 83 75 70% 0% % of Merchants Reporting This Level of Post-Review Acceptance 10 Post-Review Acceptance Trends 2.3 2% 1% 0% Overall <$5M $5M – <$25M $25M – <$100M $100M+ Annual Online Revenue 2010 2011 © 2012 CyberSource Corporation. All rights reserved. 9 CyberSource Online Fraud Report Merchants with more than $100 million in online sales continued to make progress in reducing rejection rates, while smaller merchants with less than $5 million in online sales showed slightly higher rejection rates. As expected, merchants selling higher ticket, physical goods tend to reject more orders (i.e., consumer electronics, apparel/jewelry) in comparison to digital goods (see Chart #12). 13 Order Rejection Trends 14% 12% 11.1 10.9 10% 7.7 8% Average % Orders Rejected Due to Suspicion of Fraud 4.2 4% 2.9 2.4 2.7 2.8 2% 5.9 2010 5% 0% 2011 4.7 4% 3% 7.3 6% (Overall and by Industry) 6% 7.6 12 3.6 3.8 2.9 2.4 1.8 1% 0% Apparel/ Jewelry 2010 2011 3.1 3.0 2.5 Consumer Electronics 2009 % of International Orders Rejected 3.2 2% Overall 2008 % U.S./Canada Orders Rejected due to Suspicion of Fraud 3.9 2.7 2.8 2007 Household/ General Merchandise Physical Goods Digital Goods & Services All Services International Orders Riskier The order rejection rate for international orders is nearly three times higher than domestic orders — 7.3% vs. 2.8%, respectively (see Chart #13). Fraud screening is more challenging for international orders, as standard validation tools may not be readily available or may be more costly to implement Address and telephone records, credit checks, and public records vary by country. The actual fraud rate experienced on international orders supports a cautious approach to order acceptance, as merchants report the fraud risk on international orders is significantly higher than that of domestic orders. Estimating Valid Order Rejection Orders are rejected due to suspicion of fraud, but within that pool, inevitably, are valid orders from customers that were erroneously rejected. In addition to the lost sales from these good customers, merchants try to avoid this type of “customer insult,” as lost customers and negative word of mouth can adversely impact future revenues. Fifty-two percent of large merchants surveyed attempt to estimate valid order rejection rates, but it is difficult to measure accurately or with a degree of confidence. Of the merchants that provided input on how they track valid order rejections, most cited tracking customer complaints or customer feedback on the orders. However, any of these methods understates the true “false positive” rate. BEST PRACTICE advice To focus the review team’s efforts on truly questionable orders, maximize the number of automated decisions. To this end, analyze the profiles of orders that are accepted during manual review and determine if there are common characteristics from which you could build effective “auto-pass” screening rules. As a general rule of thumb, half of the orders that are manually reviewed should be accepted. Order acceptance and rejection rates that skew above 50% signal opportunities to shift more of the manual order evaluations to automated screening. 10 CyberSource Online Fraud Report Stage 4: Fraud Claim Management Automated Screening Order Manual Review Accept / Reject Fraud Claim Management Retained Revenue Tuning and Management Types of Fraudulent Transactions Friendly Fraud We define fraudulent orders as either chargebacks or a credits issued to consumers claiming fraudulent use of their accounts. As a result, actual fraud rates reported tend to be higher than those cited by banks or card schemes. Fraudulent orders have a significant impact on bottom line profits. Although chargebacks are the most often cited metric, merchants report that chargebacks actually account for only 41% of all fraud claims (see Chart #14). “Friendly fraud” occurs when a merchant receives a claim because the cardholder denies making the purchase or receiving the order, yet the goods or services were actually received. In some instances, the order may have been placed by a family member or friend that has access to the buyer’s cardholder information. Chart #15 shows that 60% of merchants perceive friendly fraud has increased over the past two years. 14 % of Fraud Claims: Chargebacks vs. Credit Issued by Merchant 2011 vs. 2010 15 “Friendly Fraud” over the Last Two Years (Overall and by Merchant Size) Remained the Same 100% 90% 41 80% 70% 59 62 64 80 60% 73 59 63 52 49 35% Increased 60% 50% 40% Decreased 59 30% 20% 41 38 36 20 10% 27 41 37 48 0% 2010 2011 Overall 2010 2011 <$5M 2010 2011 $5M – <$25M 2010 2011 $25M – <$100M 2010 2011 $100M+ Annual Online Revenue Credits Issued 5% 51 Chargebacks Fighting Chargebacks Merchant practices vary with respect to contesting chargebacks (“re-presentment”). On average, merchants re-present 56% of their fraud-coded chargebacks, with nearly 30% re-presenting all of their chargebacks (see Chart #16). Considering the financial impact of both fraud claim routes (chargebacks and credit issuance/reversal), some merchants encourage direct consumer contact to address fraud claims and thus avoid chargebacks from the acquiring bank/processor. © 2012 CyberSource Corporation. All rights reserved. 11 CyberSource Online Fraud Report Fraud Rate Metrics 16 Average % Total Fraud-Coded Chargebacks Re-presented % of Merchants Reporting This Re-presentment Rate (Overall and by Merchant Size) 14 0% 80% 73 3 10-19% 70% 60% 5 1-9% 59 56 14 20-29% 53 1 30-39% 50% 5 40-49% 40% 9 50-59% 30 30% 1 60-69% 20% 7 70-79% 10% 80-89% 0% 90-99% Overall <$5M $5M – $25M – $100M+ <$25M <$100M When monitoring the level and trend of online fraud loss, we focus on three key metrics: 1) fraud rate by revenue (revenue lost to fraud as a percent of total online sales); 2) fraud rate by order (percent of accepted orders which turn out to be fraudulent); and 3) the average value of a fraudulent order relative to a valid order. Fraud rates vary widely by merchant and depend on a variety of factors, such as onlinte sales volume, type of products or services sold online, how such products/services are delivered and paid for, and the merchant’s fraud prevention capabilities. It is important that merchants track key fraud metrics over time and evaluate their performance relative to their peer group (both size and industry). Fraud Rate by Revenue 5 7 28 100% Annual Online Revenue Merchants report that they win, on average, 40% of the chargebacks they dispute, resulting in a net recovery rate of 27%. Using the average percent of chargebacks that are disputed (56%), multiplied by the average win rate of 40%, results in a net recovery rate of 22% (meaning 22% of all fraudcoded chargebacks are recovered). However, given the wide disparity in the chargeback re-presentment rate, when these are calculated on a merchant-by-merchant basis and then averaged, the re-presentment win rate rises to 27% (see Chart #17). Revenue loss measurement includes not only the value of orders on which fraudulent chargebacks are received, but also the cost of any credits issued to avoid such chargebacks. In 2011, the average fraud rate by revenue was 1.0%. The largest merchants reported smaller revenue loss rates (0.4%) while conversely, smaller merchants reported up to three times higher (see Chart #18). (Overall and by Merchant Size) 2010 1.4% Fraud Chargeback Re-presentment: Win Rate / Net Recovery Rate 2011 1.1 1.1 1.1 1.1 1.0 1.0 0.9 0.8% (Overall and by Merchant Size) 0.6% % Challenged 80% 1.0% 2011 1.2 1.2% 17 18 Average Fraud Rate by Revenue 2011 vs. 2010 % Net Recovery* 0.4 0.4% 0.4 70% 0.2% 60% 0% 50% 56 Avg Win Rate 20% 10% Avg Win Rate 40% 40% 30% Overall 44% 27 45% 73 Avg Win Rate 59 Avg Win Rate 34% 33 22 25% 30 Avg Win Rate 53 29 15 0% Overall <$5M $5M – <$25M $25M – <$100M $100M+ Annual Online Revenue *Net Recovery is expressed as a % of all fraud-coded chargebacks challenged 12 <$5M $5M – <$25M $25M – <$100M Annual Online Revenue $100M+ CyberSource Online Fraud Report Fraud Rate by Order Another key metric is the number of accepted orders that later turn out to be fraudulent, expressed as a percent of total accepted orders. In 2011, the fraud rate by order was 0.6%, and ranged from 0.4% to 1.2% (see Chart #19). 20 Fraud Rate by Order Domestic vs. International 5.0% 19 Average Rate by Order 2011 vs. 2010 (Overall and by Merchant Size) 4.0 4.0% 3.6 3.0% 2010 1.5% 2.7 2011 1.1 1.0% 0.9 1.1 1.2 0.7 2006 0.9 0.6 2007 2008 2009 2010 2011 International Orders 0.4 0% <$5M 0.9 Domestic Orders 0.5 Overall 1.1 2.0 0.0% 0.8 0.6 0.5% 1.3 1.0% 0.9 0.9 2.1 2.0 2.0% $5M – <$25M $25M – <$100M $100M+ Annual Online Revenue Fraudulent Order Value Historically, fraudulent orders tend to have higher values than valid orders. In 2011, merchants reported a median fraudulent order value of $250, vs. $150 for the valid order value. International Orders Carry Higher Risk Fifty-eight percent of merchants surveyed accepted orders from outside the U.S. & Canada in 2011, with international sales accounting for 17% of total orders, on average. Because of the higher risk associated with cross-border transactions, one in four merchants surveyed stopped accepting orders from at least one country outside of North America. Fraud rates for international orders are more than three times higher than domestic orders (2.0% vs. 0.6%, respectively). However, the fraud rate for international orders has remained relatively stable since 2009 (see Chart #20). BEST PRACTICE advice To minimize overall chargebacks, take steps to reduce your exposure to friendly fraud. Clearly articulated terms and conditions that the customer must acknowledge at the outset often provide an effective front-line deterrent. Follow this with other safeguards, such as confirmation emails, activation links, or other online validations that require customer input or action. For example, if your business is subscription-driven, send an email to the address provided, with a link to activate the account. This serves two purposes: first, if the email address is phony, then the fraudster will be unable to activate the account. Second, if the email account is valid, once the activation URL is clicked, you’ll have a trail that you can use in the event that the cardholder disputes charges. Any or all of these safeguards will put you in a better position to deter fraud or re-present any subsequent chargeback, as you will have documentation of actions taken by the customer. Balance the safeguards required against the customer experience — excessive customer friction would negatively impact your legitimate customers. By configuring your order flow with the appropriate checks properly in place, you can maximize legitimate revenue while deterring friendly fraud. © 2012 CyberSource Corporation. All rights reserved. 13 CyberSource Online Fraud Report Tuning & Management Order Automated Screening Manual Review Accept / Reject Fraud Claim Management Retained Revenue Tuning and Management Clean Fraud Still a Problem We define “clean” fraud as fraudulent orders that look and behave like valid orders because they pass the typical fraud checks put in place by a merchant. Forty-six percent of merchants say that the fraudulent orders they’ve seen are “cleaner” than what they experienced a year ago (see Chart #21). This is down slightly from 2010 levels, but continues to be the biggest change that merchants have noticed in 2011. Fraudulent Orders Continue to Look More Like Valid Orders No 54% 21 lower than online fraud, while 1% believe that it’s higher. With such a large percentage that “don’t know,” it will be interesting to see how these results change as mobile becomes more of an established channel. Size of Fraud Management Budgets How much are online merchants spending to mitigate fraud risk? In 2011, survey results show that 25% of merchants spend 0.5% or more of their online revenues to manage online payment fraud, while 75% spend less than 0.5%. In 2011, across all merchants the median ratio of fraud management expense to sales was 0.1%. These spending estimates focus on the cost of managing fraud risk (internal and external systems and services, management development, and review staffing). Direct fraud loss (chargebacks, lost goods and associated shipping costs), as well as the opportunity cost associated with valid order rejection, are not included (see Chart #22). Yes 46% = % of merchants that claim current fraudulent orders are cleaner than those from 12 months ago (Percent of Merchants Operating at Defined Expense Level) 58 60% Tracking Mobile Fraud As the mobile channel continues to grow, merchants will need to understand how fraud impacts mobile commerce. One school of thought believes mobile is riskier (new channel, harder to identify the device or IP address), while another school of thought believes the opposite (closed mobile network, passcodes on phones, omnipresent device). Twenty-seven percent of merchants reported that they have a mobile commerce website, while 20% reported having a mobile app (Note: there is a high overlap of merchants that offer both). However, 92% do not know their fraud rates in the mobile channel. 7% believe that mobile fraud is the same or 14 22 How Much Merchants Spend on Fraud Management 51 50% 2009 % of revenue spent*: 0.3% 47 2010 % of revenue spent*: 0.2% 2011 % of revenue spent*: 0.1% 40% *Median 30% 20% 15 17 17 16 8 10% 10 8 10 11 13 13 6 0% 0% - <0.2% .2% – <.5% .5% – <1% 1% – <4% % of Annual Online Revenue Spent to Manage Fraud (Staff, Systems, Tools, etc., excluding Fraud Loss) 4%+ CyberSource Online Fraud Report Budget Allocation For many years, merchants have consistently spent just over half their fraud management budgets on review staff, and 2011 was no different — on average, 52% was allocated to order review staff (see Chart #23). 23 Average % Spending Allocation for Fraud Management 2011 3rd Party Tools Outsourcing 4% MR tasks/ workflow 21% Oder Review Staff 25 Other 2% Improving automated detection and sorting capability Process Analytics 18% Internal Tools & Systems 21% Top Priority Strategy /Area of Focus 2012 Automated Detection 55% Streamlining the tasks/workflow occurring during the manual review process Improving process analytics Outsourcing portions of review/ screening operations Other Planned Staffing Levels for 2012 52% 27% Increase Same Decrease 18% 75% 7% Only 18% of merchants reported that they would be increasing their staffing levels, as review staff costs remain the dominant cost driver of fraud operations. In terms of budget, over 80% reported that their budgets would remain flat or decrease in comparison to last year (see Chart #24). With such a heavy reliance on manual review coupled with No Change continued online sales growth, order review teams will come under more pressure to review more orders in the same amount 78% of time. Without the right tools and processes in place, orders in queue will become a growing concern. As department budgets remain tight, merchants will need to re-double their efforts to automate more of the fraud management process while keeping valid order conversion high and fraud loss low. BEST PRACTICE 24 Expected Budget Change for Fraud Management 2012 Increase No Change 78% 19% Decrease Average % Fraud Mgmt Budget Expected to INCREASE % 15 Average % Fraud Mgmt Budget Expected to DECREASE % 15 4% Automated detection and outsorting continues to be the most cited area for process improvement attention in 2012, followed by streamlining manual review (see Chart #25). Reducing the need for manual review and increasing the efficiency and effectiveness of reviewers is key to growing online business profits and managing the total cost of online payment fraud. advice To optimize your fraud management operations, maximize automated order screening capabilities while streamlining workflow for your review team. Use a decisioning system where business users can create screening criteria based on order attributes, as well as results and information provided from a host of verification and validation services. Look for portals where case management systems are seamlessly integrated with relevant third-party data sources. It’s imperative that reviewers access one consolidated tool rather than having to leverage multiple systems. Finally, define and measure your key performance indicators throughout the fraud management lifecycle. Understand your performance baseline and objectives, so you can identify where you can fine-tune your fraud management operations. That which gets measured, gets improved. © 2012 CyberSource Corporation. All rights reserved. 15 CyberSource Online Fraud Report Conclusion (note: Chart 27 does not reflect all of the industries cited by merchants). Each merchant is unique in terms of their business objectives, fraud tolerance and risk, which is reflected in the results shown in the charts. To provide an overall assessment and basis of comparison, we took a snapshot of average merchant performance across four key performance indicators (KPIs): manual review rate, order rejection rate, percent of orders lost to fraud (Fraud Rate — by Order), and percent of revenue lost to fraud (Fraud Rate — by Revenue), as shown in Charts #26 and #27. Managing fraud is an ongoing balancing act where merchants constantly weigh tradeoffs among fraud loss, customer experience, and cost. If fraud is reduced, what happens to the number of rejected orders? Will good customers be impacted? If more orders are accepted, what happens to fraud, and how will manual review support this? Having a structured framework to address these tradeoffs can help merchants identify gaps and improve overall fraud management processes. KPIs vary by merchant size and by industry. In general, the largest merchants tend to fare better. This may be driven by potentially more resources, tools and experience in combating online fraud, whereas smaller merchants may not have the resources at their disposal. KPIs are more varied across industry, which is to be expected 26 Order Reject Rate and Fraud Rates by Merchant Size 1.2 Manual Review Rate (avg = 27%) Order Reject Rate (avg = 2.8%) 45 Fraud Rate – by Order (avg = 0.6%) Fraud Rate – by Revenue (avg = 1.0%) 3.9 Percent 33 1.2 1.1 2.8 0.7 1.1 2.7 0.5 Average 2.3 12 <$5M $5M – <$25M 0.4 15 0.4 $25M – <$100M $100M+ 27 Order Reject and Fraud Rates by Industry Manual Review Rate (avg = 27%) Order Reject Rate (avg = 2.8%) 4.7 1.0 Fraud Rate – by Order (avg = 0.6%) Fraud Rate – by Revenue (avg = 1.0%) 1.5 3.9 37 3.8 Percent 26 1.3 0.7 0.7 1.0 28 1.0 29 0.7 3.2 3.0 0.6 1.0 28 Average 0.5 0.8 1.8 13 Consumer Electronics 16 Apparel/Jewelry Household / General Merchandise Physical Goods Digital Goods & Services All Services CyberSource Online Fraud Report Resources & Solutions To find information on CyberSource’s industry-leading fraud management solutions, self-paced webinars, and other whitepapers on electronic payment management, visit our online Resource Centers: Americas: Visit www.cybersource.com. For sales assistance, call +1 888 330 2300 (international: +1 650 432 7350) or email [email protected] (Latin America: [email protected]) Europe | Middle East | Africa: Visit www.cybersource.co.uk. For sales assistance, call +44 (0) 118 929 4840 or email [email protected] stands ready to back your team, or even manage complete portions of your operation. All of our services are backed by business performance guarantees. • Performance Monitoring provides supports for configuring rules and detectors, and monitoring process performance. • Screening Management includes Performance Monitoring, plus our experienced review staff to manage manual order review per your policies. Available 24/7. CyberSource Payment Management Solutions Japan: In addition to our fraud management solutions, CyberSource offers a comprehensive portfolio of modular services and tools to help your business manage your entire payment pipeline to optimize sales results. All are available via one connection to our web-based services. Visit www.cybersource.co.jp. For sales assistance, call +81 (0) 3 3548 9873 or email [email protected] Global Payment Acceptance Asia Pacific: For sales assistance, call +65 6671 5020 or email [email protected] CyberSource Fraud Management Solutions CyberSource’s industry-leading fraud management solutions enable businesses to detect fraud sooner and accurately, as well as streamline fraud management operations. With a hosted fraud management system and managed risk services that can supplement or manage complete portions of your review process, CyberSource provides flexible and powerful options that best meet your business needs. CyberSource Decision Manager: Rule Console and Fraud Detectors Having more data enables you to gain more insightful correlations to detect sophisticated fraud. Decision Manager is a hosted system providing access to a full range of data generated from global fraud detectors, multi-merchant and cross-industry correlations, truth data and more. Decision Manager comes with a business rule console that controls automated screening and case routing, an advanced case management system, and reporting and analytics. Automatically screen more bookings up front, while providing your review team with access to fraud detectors and customized rules to help them review more orders, faster and more accurately. Managed Risk Services CyberSource Managed Risk Services enables you to scale your expertise and capacity without adding fixed headcount. Our staff of fraud analysts, review teams and chargeback experts Accept payments worldwide using a merchant account from your preferred provider: worldwide credit and debit cards, regional cards, direct debit, bank transfers, electronic checks and other payment types such as PayPal and Bill Me Later. CyberSource also provides professional services to help you integrate payment with front-end and back-office systems. Payment Security Remove payment data from your network, which is a great way to streamline PCI compliance and mitigate security risk. • Payment Tokenization and Hosted Payment Acceptance Services: enables you to process payments without storing or even transmitting payment data. • Payment System Centralization: Our team of experts will help you consolidate multiple payment systems into a single, easy to manage system. Link legacy systems to web-based services for rapid service expansion. Optionally, CyberSource will also host, support and manage these centralized payment systems in our secure datacenters. Professional Services CyberSource maintains a team of experienced payment consultants with proven systems integration expertise. Our client services team is additionally available to help you monitor, tune, or fully outsource portions of your payment operations. © 2012 CyberSource Corporation. All rights reserved. 17 About CyberSource CyberSource, a wholly-owned subsidiary of Visa Inc., is a payment management company. Over 390,000 businesses worldwide use CyberSource and Authorize.Net brand solutions to process online payments, streamline fraud management, and simplify payment security. The company is headquartered in San Francisco and maintains offices throughout the world, with regional headquarters in Singapore (Asia Pacific); Tokyo (Japan), Miami/Sao Paulo (Latin America and the Caribbean), and Reading, U.K. (Europe/Middle East/Africa). CyberSource operates in Europe under agreement with Visa Europe. For more information, please visit www.cybersource.com. AmericaS CyberSource HQ Phone: +1 888 330 3200 +1 650 432 7350 Email: [email protected] Latin America email: [email protected] Europe CyberSource Ltd Phone: +44 (0) 118 929 4840 Email: [email protected] Asia Pacific CYBS Singapore Pte Ltd Phone: +65 6671 5020 Email: [email protected] Japan CyberSource KK Phone: +81 (0) 3 3548 9873 Email: [email protected] © 2012 CyberSource Corporation. All rights reserved.
© Copyright 2026 Paperzz