How you can eliminate online payment fraud

If you sell goods or services online, especially high-risk categories like digital goods, gambling and financial services, you’re a prime target to fraudsters.

Introduction

Online payment fraud prevention is an endless game of Whack-A-Mole. Whenever payment technology advances or user preferences evolve, fraudsters are the first to identify the weaknesses, and as soon as one vulnerability is resolved, another appears. This is why it is crucial to keep abreast of all developments related to payment fraud; the favoured attack vectors, the most vulnerable platforms, and the best protection methods.

PwC’s Global Economic Crime and Fraud Survey 2022 reveals that 46% of surveyed organizations reported experiencing some form of fraudulent activity in the last 24 months. The report also shows that organizations in Europe are significantly more likely than those in other regions to experience fraud perpetrated by external actors (56%).

What are external actors? That varies, from hackers (31%) and customers (29%) to organized crime (28%), vendor/suppliers (20%) or even competitors (14%), consultants (10%) and foreign states (9%).

The types of fraud businesses experience depends on the industry they operate in. Customer fraud is most prevalent in the financial services (44%) and retail (37%) industries, whereas cybercrime is the most experienced type of fraud in the telecom (50%), health (40%), public sector (36%) and manufacturing (32%) industries.

Cybercrime and threat attacks become more elaborate

Within the EMEA region, Europe is a very mature market with relatively low growth in attack rates. However, as Europeans increasingly move towards mobile commerce, a surge in desktop attacks has become evident. Overall, at 13% YOY, EMEA has seen the highest growth in desktop attacks compared to other regions.

Strong Customer Authentication (SCA) is having a positive effect on fraud attacks. Still, recent research from LexisNexis shows that the EMEA region saw a clear uptrend in the volumes of both human-initiated and automated bot attacks during the second half of 2021. Specifically, human-initiated attack volume is up 7% YOY, while automated bot attack volume has grown by a whopping 16% YOY. In particular, the (automated bot) attacks, seen in EMEA, mostly focus on logins. The goal of which is to gain access to accounts and use the data mined to facilitate fraud through social engineering.

The techniques employed by cybercriminals grow ever more sophisticated, and companies of all shapes and sizes face a mountain of threat levels. Since the COVID-19 pandemic, 62% of merchants report seeing new fraud types emerge. Luckily, business awareness regarding fraud has also grown, and over half of businesses surveyed have increased their fraud protection budget accordingly. Business awareness of fraud has increased most for companies in the digital goods (62%), subscription (58%) and retail (53%) industries.

Though larger merchants that sell through multiple channels experience the highest level of successful fraud attempts, how likely your company is to be targeted by fraudsters depends on many factors. Those include the sales channel and industry you work in, the fraud awareness maturity of your market, the security of your IT infrastructure, as well as consumer behaviour and regional regulatory environment.

Cross-border sale of digital goods: high demand, high risk

In Europe, the number of internet users trying to get cross-border access to content has nearly doubled over the span of four years (from 8% in 2015 to 15% in 2019). The increase in demand is being driven by the lack of access to digital goods.

Digital goods is a term commonly used to describe intangible products and services that can be acquired and consumed online. The fulfilment process is fully digital and occurs in real-time. Examples of digital goods and services include:

• Prepaid phone credit
• Digital gift cards
• Game vouchers
• Media files
• E-books
• Fonts
• Digital subscription services
• Internet coupons
• Virtual goods / in-game items
• Online courses
• Music & video streaming services
• Website themes etc.

Data from the Eurobarometer survey shows that audiovisual and other electronically supplied copyright-protected content, such as music streaming and downloading, e-books and games, are among the most popular content sought by consumers across borders.

The growth of international e-commerce is also fuelling fraud attacks. Recent observations by the European Banking Authority show that fraudulent cross-border transactions represent 81% of fraudulent card payments reported by issuers and 94% of fraudulent card payments reported by acquirers.

Among the cross-border payments, the payments with counterparts located outside the European Economic Area are more frequently subject to fraud compared to the payments executed inside the EEA. In fact, the share of fraud in the total volume of card payments outside the EEA – as reported by issuers – is three times higher than inside the EEA, and 85 times higher than the fraud share for the domestic transactions.

A quick word on geo-blocking

Businesses often reject transactions that originate from specific countries. A practice known as geo-blocking. While blacklisting certain regions is a way of reducing fraud risk, this does come with a major downside. The more transactions you reject, the higher the risk is of rejecting transactions from good customers. Moreover, many European companies may not realize that unjust geo-blocking is actually illegal. The European Union’s regulation against unjustified geo-blocking, which entered into force on 3 December 2018, addresses unjustified online sales discrimination based on customers’ nationality, place of residence or place of establishment within the internal market.

To be clear, the regulation does not oblige merchants to allow access to their content, nor sell or deliver across the whole EU. Rather, it prohibits merchants from discriminating against customers based on their nationality, place of residence or place of establishment, if the merchant already delivers to their particular Member State.

Combatting online fraud: using the right tools for the job

Get rid of low-hanging fruit

To protect yourself against cybercrime, there are quite a few things you can get started on right away, such as educating your staff about fraud, training them to be ever-vigilant, and implementing a strictly enforced a password policy. It is also important to maintain a secure IT infrastructure and keep security patches up-to-date.

As an online merchant, you’re not expected to become an expert in all this. After all, it’s not your core business. But there are fraud prevention experts out there who know just what your particular risks are.

Use the right protection

Merchants who do best in fighting fraud are the ones who rely on a multi-layered approach to fraud mitigation solutions. By layering the processes of identity verification, identity authentication and transaction risk assessment, the merchant experiences fewer false positives and fewer successful fraud attempts than those who don’t adopt a multi-layered approach.

Conversely, the same findings show that merchants who use multiple solutions, but not in a layered approach, experience more false positives and more successful fraud attempts as those who use very few solutions.

As a seller of digital goods, the only way to really protect your businesses from fraud is by making use of intelligent, lightning-fast fraud protection. Every single transaction needs to be checked, without increasing the number of false declines or negatively impacting the customer’s checkout experience in any way.

Besides speed and thoroughness, other benefits to look for in high-quality payment fraud protection services are a chargeback guarantee, access to a dedicated revenue manager, full compliance with GDPR, and the use of advanced supervised Machine Learning. When properly supervised, Machine Learning can be used to detect trends, optimize algorithms, and update schemas.

Still, doing all of the above is not enough. When implementing overly broad anti-fraud measures like 3DS2, merchants also inadvertently introduce unnecessary friction in the checkout process.  This is problematic. After all, merchants only get one chance to offer a positive customer experience, and failure to offer a frictionless experience may result in unnecessary cart abandonment as well as lower conversion rates. As an online seller of (digital) goods, your goal is to facilitate transactions by removing any and all friction whenever possible, while at the same time, securing transactions with the highest level of security.

Eliminate fraud risk, without adding friction

How can merchants introduce measures to prevent fraud, without adding friction at checkout? At Alphacomm, we’ve developed Protectmaxx, a smart, frictionless, fraud solution (API) that completely eliminates chargebacks. In fact, Protectmaxx is so secure, we’re able to offer 98% acceptance for digital goods and a 100% chargeback guarantee on all the popular payment methods that your customers trust and love.

By being smart about fraud risk and fully understanding every single detail of SCA regulations, we’re able to selectively apply different fraud checks to different transactions and only when required. The result is a customer experience that is smooth, inspires loyalty and significantly increases customer lifetime value.

Protectmaxx is a robust anti-fraud API that seamlessly integrates with any ecommerce platform. Depending on the business needs, Protectmaxx can be used for either advanced fraud scoring or as a premium solution that provides full indemnification via a 100% chargeback guarantee that is unique in the industry. Moreover, Protectmaxx is fully PCI- and GDPR-compliant.