Mastercard’s Playbook On Fighting Online Fraud’s Big Surge

The shift to online commerce in the wake of the coronavirus pandemic is unprecedented.

We’re doing more of everything online, especially transacting.

Subscriptions, groceries, even buying shoes are all being introduced to digital channels in ways and volumes they haven’t been before.

In an interview with Karen Webster, Laura Quevedo, senior vice president of Security & Decision Products at Mastercard, said that just as the surge toward spending online is unparalleled, there isn’t a concrete playbook in place for merchants, issuers or banks to grapple with the ramp-up in chargebacks and fraud — even friendly fraud — that will be sure to follow.

“Many merchants are trying very quickly to establish themselves with an online presence,” said Quevedo. “There’s a lot of fluidity in terms of movement to and in the online environment. We know that when all these transactions go online, so do the criminals.”

Hiding In Plain Sight?

That rising tide of fraud will come in tandem with, and even try to mimic, legitimate activity by consumers grappling with various ways the coronavirus has impacted and will impact daily life.

There’s a legitimate wave of disputes and chargebacks that are hitting the travel and entertainment verticals as consumers cancel trips, postpone weddings or try to get credit for flights that simply cannot be taken right now.

We’re in a brave new world of examining what should be refunded, even what can be refunded. Picture, then, the happy couple-to-be whose wedding contract (looking out six months from now) stipulates a deposit paid for 150 guests, yet social distancing might mean that tally gets cut in half. What happens then?

As Quevedo said, “many consumers may have agreed to terms and conditions in their contracts without ever realizing some of the finer points of what they have agreed to.”

In the middle of it all are the issuers and merchants.

In some cases, hit hard by the economic devastation of the pandemic, they may not have enough money in the proverbial till to issue a refund.

Quevedo said it’s important — now more than ever — to open up lines of communication that extend across merchants, cardholders and financial institutions to prevent these kinds of disputes from ever making it into the system.

The Issuer Side Of The Equation

Issuers may be eying the coming chargeback and dispute storm, but right now, said Quevedo, they’re concentrating on prioritizing claims processing.

“They’re trying to help their cardholders,” she said. “They’re trying to talk to their cardholders first, take those claims, assure them that they’re going to be addressed before they actually get them into the chargeback processing cycle.”

The chargebacks may have to wait until the resources are there to start processing them, perhaps when merchants are finally able to work on site and away from the confines of home — and then the surge will begin.

Quevedo pointed to Mastercard’s collaboration tools, including the Ethoca Digital Receipts offering, which can increase transparency about online purchases and in turn help consumers keep track of what they buy.

That solution, she said, has been shown to reduce inbound transaction inquiries from consumers to their bank by between 15 percent to 30 percent, and it reduces friendly fraud (the kids are at home, of course, and who knows what they’re charging on mom and dad’s card).

“With so many people being locked down and homebound and potentially spending their time ordering online,” she told Webster, “we may see an increase in friendly fraud. We’re certainly hearing from our customers that they’re concerned about it.”

Separately, she said, issuers report roughly 60 percent of disputed transactions reviewed across Ethoca Eliminator in the call center channels (a tool that arms card issuer agents with the merchant purchase information they need to alleviate cardholder transaction confusion when they call in) are resolved without resorting to chargebacks.

Battling The Fraudsters

Girding for the battle against the fraudsters means remaining vigilant about both old and new vectors of attack. In some cases, said Quevedo, the fraudsters are plying their trades through social engineering and creating synthetic IDs.

In other cases, they may be devising bank identification number (BIN) attacks or using card generators to create many potential card numbers.

Those attacks, as noted in this space previously, rely on probing card-authorization systems to see which ones are valid numbers.

Quevedo noted that there has been a surge in BIN attacks, however, it is too early to see the impacts on subsequent fraud.

“Whether they’re holding onto those cards and waiting for later remains to be seen,” she said.

Connected intelligence can also go a long way in battling the fraudsters, as they seek to siphon off funds from banks and account holders, or trick merchants and issuers through the dispute process.

“It’s key to emphasize the importance of authentication” as so much activity moves online, said Quevedo.

That’s especially true as people and merchants are scrambling to open new accounts online and conduct know-your-customer (KYC) activities in near real time.

Even as they try to simplify the process, she told Webster, banks must establish multiple layers of protection, chiefly through identity verification. Mastercard’s NuData uses a series of direct identity challenges and biometrics to establish that the party on the other side of the transaction is who they say they are.

The Consumer As Part Of The (Anti-Fraud) Team

Collaborative efforts involve the consumer as well, said Quevedo. Anytime a consumer really takes a very close interest in monitoring the activity on their cards, it will definitely help to avoid fraud. She noted that consumers can opt to turn their cards on and off.

In addition, Mastercard offers ID Theft Protection to U.S. Mastercard cardholders free as part of their Mastercard benefits package. She noted that through the end of July, Mastercard committed to providing U.S. small business owners with access to necessary resources to help protect their business and their employees through free cyber vulnerability assessments and identity theft protection for the 28 million small businesses eligible to participate in the Small Business Administration’s Paycheck Protection Program (PPP).

Looking ahead amid the pandemic and beyond, she said that for banks and merchants, “it’s really important that they have multiple fraud strategies in place. Now more than ever, it’s critically important to make sure that you have your bases covered — and your basics covered.”