TAMPA, Fla.—The increase in card not present fraud following the EMV liability shift deadline is not surprising, but what is raising eyebrows is the rise in debit card fraud over the past six months.
Lou Grilli, director of payments strategy at CSCU, told CUToday.info that following the October 2015 liability shift deadline that card not present fraud is up 12%, making it now the largest category of payments fraud.
Grilli’s comments are part of a series of interviews by CUToday.info marking the one-year anniversary of the EMV liability shift.
“That is certainly not unexpected,” said Grilli. “But what is surprising is that data shows that debit card fraud is increasing in the past six months while credit card fraud is decreasing. So fraud is shifting from credit cards to debit.”
Grilli believes the reason for the shift is that crooks, sitting on a “treasure trove” of compromised debit card data, want to use that as quickly as possible before a sizeable percentage of U.S. payments transactions become chip on chip—chip terminal and chip card. Currently, only about 21% of transactions are chip on chip.
“The fraudsters know EMV cards are being issued and POS terminals updated so they are ramping up their fraudulent activity on debit until this window of opportunity closes,” he said.
Credit Conversions Simpler
Grilli said that most issuers moved quickly on credit because that was easier due to EMV routing issues debit had faced. But issuers also wanted to move on credit, he said, because fraudster focus had been higher on credit. Issuers’ greater focus on credit EMV conversion has reduced the target on credit.
The U.S. migration to EMV, according to Grilli, won’t have a noticeable impact on counterfeit card fraud until chip on chip transactions reach about 60% of all POS payments.
That jump in debit fraud may be behind some credit unions that have been reissuing as plastic expires to now consider a mass reissue. Grilli said that CSCU has been hearing from a number of credit unions that they are considering just that.
“Once their card base gets 50% converted, many say they may begin performing mass reissues,” said Grilli.
Grilli said credit unions are concerned about rising fallback fraud, where crooks take stolen card data, place it on a chip card but then damage the chip so that the service code tells the POS terminal to accept the card as mag stripe.
“This is definitely something that is localized to where crooks know fallback fraud will work, where issuers will allow this type of transaction,” he said.
Another fraud target issue arising in the post-liability-shift payments world is PIN-less debit—where merchants accept a debit card transaction without the PIN for purchases under a certain amount, generally $50. Grilli said crooks have spotted this opportunity and are targeting retailers using PIN-less debit with phony debit cards.
“This is real problem, to the point where some credit unions are declining authorization for PIN-less debit because the crooks are killing them on transactions under $50,” said Grilli. “Fraudsters are purchasing $25 gift cards or doing $45 reloads on prepaid cards using fraudulent cards as funding. They just run out of the store and don’t even have to enter a PIN.”
Looking back on predictions about where issuers and merchants would be one year following the liability shift deadline, Grilli pointed to what many analysts have stated—merchants are behind schedule while issuers are ahead.
Lack Of Merchant Movement Surprising
Grilli referred to popular predictions that said issuers would reissue about 70% of their cards by the end of 2016. Grilli said that MasterCard data shows the percentage of converted cards, debit combined with credit, now stands at 80%, while Visa says the figure is between 80%-86%.
Grilli said that last year he would not have guessed that merchant POS terminal conversions would stand at 25% to 30% today.
“But now knowing the issues many merchants have faced with getting their terminals certified, these numbers are less surprising,” said Grilli. “I think merchants did not underestimate the time it would take to get their terminals in place, it was the issue of certification time, and backlog, they did not plan for.”
Overall, considering the U.S. EMV migration post liability shift deadline, Grilli gives issuers a B+ for their work, grading out merchants with a “needs improvement.”
“For fraudsters, I give them an A for effort,” joked Grilli.
Additional Stories In The EMV Series