TAMPA, Fla.—More credit unions are taking an aggressive step in the fraud fight, proactively blocking debit transactions in certain areas of the country—and at certain retailers—where fraud rates are high.
The moves are being made, asserts Lou Grilli, director of payments strategy at CSCU, due to a last-minute rush by crooks to use stolen debit card data before new EMV cards render the compromised plastic useless. But Grilli cautions that such moves must carefully balance protecting members’ data against alienating cardholders when they unexpectedly find out at checkout that their card doesn’t work.
Grilli emphasized, too, that credit unions taking these steps must ensure to get the message in front of members about why the fraud prevention tactics are being taken and where, and that member-facing staff know what is going on and why.
“This kind of fraud-fighting measure requires the CU to walk a tightrope, really a balancing act,” said Grilli. “This can be tough to pull off. But I understand the situation—you can’t afford big fraud losses, especially if you are a small credit union, so you have to do something to protect yourself, take some extra steps.”
Cards Declined
But when members, especially those who are traveling, have their card unexpectedly declined at checkout, that experience is not beneficial for the card portfolio, said Grilli.
“There are a lot of people who use their debit card as their primary card, and some don’t have a credit card. They get declined and it is embarrassing. Maybe they walk out of the store, use cash, or worst of all, use a competitor’s card. When that happens, it may be hard to get your card back to top of wallet,” said Grilli.
What has led to the rise in debit fraud—and the resulting need for FIs to do more about it—is not only the fact that debit portfolio conversions to EMV are lagging behind credit, leaving far more stolen debit card data available for thieves to use, but also PIN-less debit. More merchants are moving to PIN-less debit, where stores route higher-interchange signature transactions over less-costly PIN rails. Experts say thieves prefer to use stolen debit card data in a PIN-less debit environment.
“What has been going on with credit unions proactively blocking transactions in certain areas of the country and among certain retailers has been eye opening,” acknowledged Grilli. “I have not seen a lot of this in the past, but I began noticing that it may be occurring, so I started looking around. When I did, I quickly found several examples.”
CUs And Banks Blocking
In a brief web search in January Grilli said he found four instances of financial institutions proactively blocking debit transactions. He said County National Bank in Michigan at the time was declining all debit (PIN and signature) transactions in California, and all debit on Walmart.com.
Grilli said he also found that Heritage South CU in Tennessee is blocking debit signature in seven states and all debit in another 10 states.
“In the third example, with True Sky Credit Union (Oklahoma City, Okla.), they are being a little more selective, but still blocking all debit on Walmart.com,” explained Grilli. And the fourth financial institution, Trailhead CU in Portland, Ore., is blocking one specific merchant in two states.
CUToday.info last year spoke with the University of Iowa Community CU in North Liberty, Iowa, which explained that it had blocked all debit in parts of Florida and surrounding states because it was experiencing six-digit fraud from PIN-less debit.
As more merchants move to PIN-less debit to lower interchange costs, crooks see more opportunities to use fake cards that don’t require a signature or a PIN.
UICCU said it not only was blocking by region, but also in some stores, particularly Walmart.
Grilli believes Walmart has become a favorite target for crooks ever since it moved to PIN-less debit last year, and due to Walmart.com and its in-store pickup policy.
“Fraudsters know they can go into Walmart and for a transaction under $50 no signature or PIN is required. So they buy gift cards and merchandise that is easily re-sellable,” said Grilli. “Walmart is convenient for the crooks, because stores are everywhere and they are big, which makes it easier for thieves to remain somewhat anonymous.”
Walmart.com, too, is making it more convenient for crooks with its online ordering and in-store pickup. Grilli explained that thieves can test numerous cards online, find those that work, buy a bunch of gift cards and merchandise, and then go into the store and pick up their loot.
“This way they don’t have to try a fake card at checkout and maybe get turned away,” said Grilli. “They can make several of these online transactions before the fake card is detected and shut down.”
Communication Critical
If a credit union chooses to block debit transactions in certain areas and stores, Grilli said it must communicate the business move clearly to members. He said that communication must reach the entire cardholder base, be clear about what stores and areas are blocked, and most important, why this is being done.
“They have to immediately send a message that explains the move is being made to protect members,” said Grilli.
The credit union must also inform the call center team and those who speak with members daily so staff understand the situation and can speak intelligently on the matter.
“If a member calls in and says their card was unexpectedly declined on a transaction, staff can say, ‘Yes, we are aware that fraud is rising in California, so we have blocked transactions there to protect you.’”
Arizona, California and Florida, sources say, are areas in which card fraud has been markedly rising.