18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES...

22
OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE December 2018 Independently produced by: Sponsored by:

Transcript of 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES...

Page 1: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

December 2018

Independently produced by: Sponsored by:

Page 2: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

2

javelinstrategy.com 925.225.9100

TABLE OF CONTENTS

Overview ............................................................................................................................................................................. 3 Executive Summary ........................................................................................................................................................ 4

Key Findings ....................................................................................................................................................... 4 Recommendations ........................................................................................................................................... 5

The State of False Positive Declines ......................................................................................................................... 6 False Positives and E-Commerce .............................................................................................................................. 7

Impact on Consumer Behavior .................................................................................................................... 11 The Future of Card Fraud ............................................................................................................................................ 13 Addressing False Positives .......................................................................................................................................... 15

Use Behavior to Separate Legitimate and Fraudulent Users .......................................................... 15 Add Context to Card Authorization ......................................................................................................... 15 3-D Secure 2.0 ..................................................................................................................................................16 Responsive Alerts and Notifications ........................................................................................................ 17

Appendix ............................................................................................................................................................................19 Methodology ..................................................................................................................................................................... 21

TABLE OF FIGURES

Figure 1: Incidence of False Positive Declines, by Reason for Decline ........................................................ 6 Figure 2: Prevalence of Declines, by Intensity of CNP Purchase Activity .................................................. 7 Figure 3: Household Income of Declined Cardholders, by Channel Where Most Recent Decline Occurred .............................................................................................................................................................................. 8 Figure 4: Incidence of False Positive Declines, by Cardholder Age ............................................................. 9 Figure 5: Impact of False Positive Declines on Merchant Patronage, by Generation .......................... 10 Figure 6: How Most Recent False Positive Decline Was Resolved ............................................................... 11 Figure 7: Resolution of Transaction After False Positive Decline, by Generation .................................. 12 Figure 8: Forecast for Card-Not-Present and Point-of-Sale Fraud ............................................................. 13 Figure 9: Non-Card Accounts Compromised, 2016–2017 ............................................................................... 14 Figure 10: Percentage of Card Transactions in the Past 30 Days Occurring Through Each Channel ...............................................................................................................................................................................19 Figure 11: Impact on Merchant Patronage, by Channel Where Decline Occurred ..................................19 Figure 12: Prevalence of Credit and Debit Card Declines, by Household Income ................................ 20

Page 3: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

3

javelinstrategy.com 925.225.9100

FOREWORD This report, sponsored by NuData Security, a Mastercard company, explores the relationship

between card fraud and false positive declines in e-commerce transactions, along with the effects

of those declines on consumers.

This report was adapted from Addressing the Threat of False Positive Declines, published by

Javelin Strategy & Research in October 2018. Javelin Strategy & Research maintains complete

independence in its data collection, findings, and analysis.

OVERVIEW In the fight against credit card and debit card fraud, merchants and issuers unwittingly create

unintended casualties when they decline a legitimate cardholder’s transaction because of

suspected fraud. No one wins when a “false positive” decline happens, and yet such denials occur

with alarming frequency. In 2017, fraud-related false positives affected roughly 1 in 15 (6.7%)

consumers, and the challenge of addressing this threat will only grow as fraudsters shift their

tactics to target online and mobile retailers. Effectively combatting false-positive declines

requires a collaborative approach between merchants and card issuers to share data enabling

both parties to distinguish between fraudulent and legitimate cardholders.

Page 4: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

4

javelinstrategy.com 925.225.9100

EXECUTIVE SUMMARY Key Findings With card-not-present fraud on the rise, merchants need to prepare for false positives to shift online. As fraudsters and legitimate cardholders move their activity online, the challenge of accurately authorizing card-not-present (CNP) transactions will grow, with CNP fraud expected to increase by more than 75% during the next five years. As criminal organizations shift their focus from using counterfeit cards at the point of sale, online and mobile merchants will face even more pressure from fraudsters. By 2022, CNP fraud is forecast to affect 6.67% of consumers annually, up from 3.79% in 2017. Consumer accounts with merchants are under attack. In addition to stolen-card data, fraudsters are turning to compromised online consumer accounts to provide ready-made sets of payment data and personally identifiable information (PII) that can be used for fraudulent transactions. From 2016 to 2017, compromise of online accounts outside of financial services — mostly those held with merchants — increased from about 530,000 to 1.79 million instances. Young cardholders are most likely to be hit by all types of declines. With less-established financial habits and a penchant for products associated with high risk of fraud, cardholders younger than 35 are the most likely segment to run afoul of anti-fraud rules. Unfortunately, these same individuals are the most likely segment to respond negatively to false-positive declines by dropping the declined card to the bottom of their wallets and avoiding the merchants where the fraud occurred.

Most false positives result in fallback to a secondary card. In a little more than half of false-positive declines, the respondent was able to complete the transaction at the same merchant using a different card. While this is perhaps the least disruptive outcome to the account holder’s experience, it is likely to have a notable impact on the future use of the card.

Recommendations Begin risk assessment from the start of a session. Screening all site visitors for suspicious behavior and unusual device characteristics can provide crucial intelligence before they even get to the step of initiating a transaction. Use invisible authenticators to minimize friction. Assessing users’ behavior, device, and location before the transaction can enable merchants to more judiciously apply authentication challenges, minimizing the risk that legitimate users will be forced to authenticate themselves or have their transaction wrongly declined because it was incorrectly identified as suspicious. Embrace 3-D Secure 2.0. By enabling merchants and card issuers to share additional information around online and mobile transactions, the updated protocol can support more intelligent authorization strategies by looking at such factors as the device used to initiate the transaction and user characteristics. This can not only help identify fraudulent transactions but also improve authorization rates for both merchants and issuers by providing enough context to confidently approve what would previously have been borderline or declined transactions.

Page 5: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

5

javelinstrategy.com 925.225.9100

Use behavioral analytics to block bots and fraudsters. Behavioral analytics — evaluating the way that the user navigates through the website or app — is aimed at identifying malicious users, who either display a suspicious degree of familiarity with the page and who are likely to display similar characteristics when they navigate to it repeatedly, or who are using automated tools to facilitate a large number of fraudulent purchases. Use behavioral biometrics to invisibly verify legitimate users. Behavioral biometrics – also known as behaviometrics – assess how the user interacts with the input device — i.e., the mouse, keyboard, or touchscreen — and can help to confirm that the individual navigating around the page is the same, trusted person who has made purchases through the site before. This method not only provides a positive indication of the users’ legitimacy but also can help detect more sophisticated attacks, such as those that use remote access Trojans (RATs) to hijack a legitimate user’s device and that could otherwise bypass device recognition measures. Implement risk-based authentication to minimize friction. With the added intelligence provided by tools such as device fingerprinting and behavioral analytics/biometrics, risk-based authentication allows merchants to more strategically decide when to deploy step-up challenges. Depending on the sophistication of the merchant’s authentication platform, the level of risk detected and the user’s device capabilities, these challenges can range from “tap to approve” push notifications to out-of-band biometric authentication.

Offer temporary exceptions for customer-defined controls. For transactions that run afoul of customer-defined controls, enabling the user to establish a temporary exception can strike a balance between preventing unnecessary declines and keeping the customers’ controls relevant. Use solutions like device fingerprinting and geolocation to provide additional context around attempted transactions. Scrutinizing the device for risk indicators, such as similar devices attempting transactions on different accounts or anomalous device characteristics, can provide a valuable defense against many fraudulent tactics, such as automated attacks using botnets, even if the particular device has never appeared at the merchant before. For known customers, comparing the location of the customer’s phone to the location of the attempted transaction (mobile co-location) can help issuers address the last remaining types of point-of-sale card fraud — i.e., lost and stolen cards — and even help merchants assess risk around card-not-present transactions.

Page 6: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

6

javelinstrategy.com 925.225.9100

THE STATE OF FALSE-POSITIVE DECLINES In the fight against credit card and debit card fraud, merchants and issuers unwittingly create unintended casualties when they decline a legitimate cardholder’s transaction because of suspected fraud. No one wins when an aptly named “false positive” decline happens, and yet such denials occur with alarming frequency. In 2017, fraud-related false positives affected roughly 1 in 15 (6.7%) cardholders, the second-most prevalent cause for a transaction made by a legitimate cardholder being declined — slightly behind insufficient balance/credit (Figure 1).

The increasing complexity of card-not-present (CNP) fraud and the rapidly increasing volume of online and mobile commerce requires merchants to implement sophisticated strategies to strike an effective balance between fraud prevention and a smooth customer experience. Increasing the sensitivity of transaction risk assessment measures for card-not-present transactions can have the intended effect of clamping down on CNP fraud but also increases the risk of incorrectly declining legitimate users’ transactions. Addressing this kind of fraud without hampering legitimate users’ ability to use their cards requires more sophisticated tools, including greater information sharing between merchants and issuers through protocols such as 3-D Secure 2.0.

1 in 15 Cardholders Experienced a Fraud-Related False Positive in the Past 12 Months Figure 1: Incidence of False-Positive Declines, by Reason for Decline

Source: Javelin Strategy & Research, 2018

Page 7: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

7

javelinstrategy.com 925.225.9100

FALSE POSITIVES AND E-COMMERCE Even though vast numbers of merchants generate a considerable percentage of their sales through digital channels, merchants’ and issuers’ transaction risk assessment tools are poorly suited for accurately identifying legitimate transactions made by the most digitally savvy users. Consequently, heavy card-not-present (CNP) shoppers — the 20% of cardholders who make 15 or more online and mobile purchases per month — are twice as likely as other shoppers to have transactions declined because of suspected fraud (Figure 2).

The high rate of false-positive declines among heavy online and mobile shoppers is particularly important because those shoppers are likely to be returning customers whose loyalty can be undercut by false-positive declines. Conversely, because these users are likely to have visited a site before, they are more likely to demonstrate recognizable behavior or use a device that has already been associated with a legitimate transaction.

Given the ease of moving business from one online competitor to another, the stakes are highest for online and mobile businesses with inadequate mechanisms to help identify and treat legitimate cardholders who engage in online transactions differently. Consequently,

Heavy Online Shoppers Face Nearly Tripled Risk of False-Positive Declines Figure 2: Prevalence of Declines, by Intensity of CNP Purchase Activity

Source: Javelin Strategy & Research, 2018

Page 8: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

8

javelinstrategy.com 925.225.9100

e-commerce merchants face the most significant risk of attrition: 51% of declined cardholders report that they decreased their patronage of the merchant, compared with 38% for cardholders who were declined at a physical store. Moreover, cardholders who were declined while making online purchases tend to be in attractive customer segments. In fact, online declines are most likely to affect the affluent:

53% of cardholders who were declined while making a purchase online make more than $100,000 annually. With these users heavily relying on credit cards, wrongly declining their transactions and forcing them to a secondary card can sacrifice profitable customers. While consumers of all income levels see roughly comparable prevalence of debit card declines, more affluent customers are significantly more likely to experience the decline of their credit card (Figure 8).

E-Commerce False Positives Predominantly Affect the Affluent Figure 3: Household Income of Declined Cardholders, by Channel Where Most

Recent Decline Occurred

Source: Javelin Strategy & Research, 2018

Page 9: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

9

javelinstrategy.com 925.225.9100

Given the challenges of serving the most digitally savvy demographics, it should be no surprise that young consumers tend to be disproportionately affected by false positives. Cardholders age 25 to 34 experienced the highest rate of fraud-related false-positive declines in the past year (Figure 4). Several factors are probably behind the higher decline rate. With less-established financial habits, card issuers simply have less reliable history for a business to draw on when assessing whether a transaction is within an acceptable variance. This affects dynamic risk assessment tools that rely on historical

transaction data to aid in flagging or approving transactions. Consequently, young consumers’ financial activity is likely to appear erratic compared with users who have more established habits. Additionally, the high rate of declines for young consumers might be tied to the popularity of digital goods such as e-gift cards or tickets. Because these goods also tend to be favored by fraudsters thanks to high resale values and immediate purchase fulfilment, merchants and issuers rightly treat this type of transaction activity as high risk, frequently catching legitimate customers in the crossfire.

Younger Cardholders Are Most Affected by Legitimate and False-Positive Declines Figure 4: Incidence of False-Positive Declines, by Cardholder Age

Source: Javelin Strategy & Research, 2018

Page 10: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

10

javelinstrategy.com 925.225.9100

Whether the decline occurs because of an erroneous risk assessment by the merchant or the card issuer, wrongly declining younger consumers can have a particularly strong impact on these individuals’ loyalty to both the merchants and the card. More than half of

millennials (also known as Gen Y) who have experienced a false-positive decline report that they reduced or stopped shopping at the merchant that blocked their transaction, compared with just 14% of Baby Boomers (Figure 5).

More Than Half of Declined Millennials Reduce Merchant Patronage Figure 5: Impact of False Positive Declines on Merchant Patronage, by Generation

Source: Javelin Strategy & Research, 2018

Page 11: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

11

javelinstrategy.com 925.225.9100

Impact on Consumer Behavior Across all cardholders, a little more than half of fraud-related false positives result in consumers moving their transactions to a secondary card, which allows them to complete the transaction at the same merchant (Figure 6). While this is the most uncomplicated outcome for consumers, it’s problematic for financial institutions, because it

can push a competitor’s card to the top of a consumer’s wallet, especially if a consumer wishes to avoid the potential embarrassment or inconvenience of a repeated decline if they continue shopping with the original card. In the long term, cards that help consumers avoid false-positive declines and complete transactions might permanently unseat the consumer’s initial choice of credit card or debit card.

Most False Positives Result in Consumers Shifting to a Secondary Card Figure 6: How Most Recent False Positive Decline Was Resolved

Source: Javelin Strategy & Research, 2018

Page 12: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

12

javelinstrategy.com 925.225.9100

With fewer alternative cards than consumers who have more established finances, millennials are the most likely age segment to be forced into completing the transaction with a non-card payment method (Figure 7). This

adds additional friction to the payment process and almost certainly contributes to the millennial generation’s tendency to reduce card use and merchant patronage after false-positive declines.

Millennials Are the Most Likely Segment to Shift to Non-Card Payment Figure 7: Resolution of Transaction After False Positive Decline, by Generation

Source: Javelin Strategy & Research, 2018

Page 13: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

13

javelinstrategy.com 925.225.9100

THE FUTURE OF CARD FRAUD In the wake of the United States’ transition from magnetic stripe cards to EMV (Europay, Mastercard and Visa) chip cards, fraud has begun shifting aggressively from the point of sale to remote sales channels, principally online and mobile marketplaces. As criminal organizations focus on CNP fraud, this divergence will continue. During the next five years, card fraud will continue to shift aggressively toward card-not-present fraud from the point of sale, with CNP fraud expected to affect nearly 7% of consumers each year by 2022 (Figure 8).

Demand for the data necessary to commit online card fraud increases the potential profit for hackers who target e-commerce retailers to compromise card data in breaches, such as the one that was discovered at Macy’s in July 2018.1 Recently, hackers have been targeting third-party tools, such as providers of shopping carts or website analytics, which are then embedded in merchants’ websites, allowing the hackers to cast a much wider net than individually targeting merchant sites. For some groups, this has been wildly successful, with the MagentoCore.net payment-card skimmer infecting more than 7,000 e-commerce sites globally from March to

CNP Fraud to Dominate Fraud Landscape Figure 8: Forecast for Card-Not-Present and Point-of-Sale Fraud

1 http://fortune.com/2018/07/11/macys-data-breach/, accessed September 17, 2018. 2 https://threatpost.com/magentocore-card-skimmer-found-on-mass-numbers-of-e-commerce-sites/137117/, accessed September

17, 2018. 3 https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/magentocore-payment-card-data-stealer-

uncovered-on-7339-magento-based-websites, accessed September 17, 2018.

Source: Javelin Strategy & Research, 2018

Page 14: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

14

javelinstrategy.com 925.225.9100

August 2018.2 This group, believed to be behind a number of major e-commerce data breaches, hijacks the control panel of Magento websites, modifying the victim’s website to embed their malware, which records keystrokes as consumers enter their payment information.3

This kind of attack is nothing new in the world of compromised card data. Hackers routinely target payment processors as a means to compromise the physical terminals of a network of smaller businesses, rather than hacking each business directly. In addition to the theft of card data, merchants also offer soft targets for hackers to compromise users’ accounts with previously breached passwords, phishing, or other social

engineering schemes. By taking over victims’ accounts with merchants where they already have existing relationships, fraudsters can gain access to valid sets of payment information that are already attached to accounts trusted by merchants. This particular type of fraud spiked massively in 2017, with the number of consumers who had an online merchant account taken over jumping from 530,000 in 2016 to more than 1.79 million in 2017 (Figure 9). Detecting these fraudulent transactions can prove challenging for financial institutions’ transaction analytics platforms because they occur at merchants where fraud victims have transacted before, making the purchases appear similar to legitimate ones that rightly were approved by the issuer.

Fraudsters Increasingly Target Accounts Outside of Financial Services Figure 9: Non-Card Accounts Compromised, 2016–2017

Source: Javelin Strategy & Research, 2018

Page 15: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

15

javelinstrategy.com 925.225.9100

ADDRESSING FALSE POSITIVES Use Behavior to Separate Legitimate and Fraudulent Users Assessing users’ behavior from the beginning of the session through submitting payment can prove to be a valuable tool in differentiating between legitimate and malicious users. Depending on the type of behavioral assessment used, it can either provide confirmation that users are, in fact, who they say they are, complementing other authentication measures in place, or indicate that they are fraudsters attempting to misuse stolen credentials or payment information. Behavioral analytics — evaluating the way that the user navigates the website or app — is aimed at identifying malicious users, who either display a suspicious degree of familiarity with the page and who are likely to display similar characteristics when they navigate to it repeatedly, or who are using automated tools to make a large number of fraudulent purchases. Behavioral biometrics — also known as behaviometrics — assesses how the user interacts with the input device — i.e., their mouse, keyboard, or touchscreen, and can help to confirm that the individual navigating around the page is the same trusted customer who has made purchases through the site before. In addition to providing a positive indication of the user’s identity, in the event of attempted fraud, behavioral biometrics help detect sophisticated fraud schemes that can bypass other commonly used fraud detection systems. For instance, remote access Trojans (RATs) that hijack a user’s legitimate device, paired with stolen credentials, enable

fraudsters to overcome knowledge-based authentication combined with device identification, but also have idiomatic behavioral patterns due to the lag inherent in remotely operating a device. This kind of attack is easily detectible with behavioral biometrics. Assessing users’ behavior before transaction can enable merchants to more judiciously apply authentication challenges, minimizing the risk that legitimate users will be forced to authenticate themselves or have their transactions wrongly declined because they were incorrectly identified as suspicious. Identifying legitimate, but unusual, behavior — such as shipping an expensive item to a new address — becomes substantially easier once authorization decisions are able to take into account whether the users placing the orders are behaving in familiar ways and are using trusted devices.

Add Context to Card Authorization In addition to behaviometrics, tools such as device recognition and mobile co-location can add context to card transactions that give indications of the legitimacy of the purchase. Device fingerprinting can be particularly valuable in addressing automated attacks conducted with tools like botnets. Even if the device has not previously visited the merchant’s site, suspicious indicators like attempts to conceal a device’s location can indicate that fraudsters are using a proxies or emulating clean devices to conceal their identities while attempting to access customer accounts or use stolen payment information. For legitimate users who have previously visited the site, device fingerprinting can indicate to merchants that an apparently high-

Page 16: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

16

javelinstrategy.com 925.225.9100

risk transaction is actually legitimate since it originates from a device that has been associated with past valid purchases. By providing a foundation of trust, this enables merchants to avoid an outright decline on the transaction, instead moving to step-up authentication if necessary or simply approving the transaction if the device has a strong enough reputation. Conversely, if suspicious activity — perhaps a login or attempted high-value transaction — occurs on a known user’s account, using device fingerprinting to identify that the device attempting the transaction does not match the user’s normal habits can give merchants more confidence that the suspicious activity is, in fact, arising from an attempt to hijack the account, enabling them to block the transaction with less risk of a false-positive decline and alert the user that action to secure the account may be required. Mobile co-location checks the location of the cardholder’s mobile phone against the attempted location of the purchase. The cardholder’s presence nearby gives a strong indication that the transaction is being made by the actual account holder. While also useful for merchants and for issuers, this can be especially powerful for minimizing travel-related red flags because unexpected purchases outside the cardholder’s usual range are a significant source of fraud-related false positives. However, it should be noted that there are limitations to these methods. Unless the supplemental data is sourced from a third party, such as a merchant under 3-D Secure

2.0 or a proprietary data sharing network, the user will probably need to opt in to the service. Accounts where the cardholder is not associated with the primary mobile phone for the account — often the case when a parent lists a child as an authorized user on an account — will not be able to derive as much value from these solutions.

3-D Secure 2.0 Even before the move to EMV in the U.S., the rising threat of card-not-present fraud raised concern among issuers, merchants, and card networks and prompted the development of the 3-D Secure protocol in the early 2000s. Unfortunately, the original version of 3-D Secure required users to enroll in the service, establishing a separate password to authenticate transactions. When users tried to initiate a transaction at a merchant that supported 3-D Secure, they were presented with a pop-up window prompting them to enter their password and approve the transaction. Not only did this insert excessive friction into the transaction process — resulting in elevated levels of cart abandonment — but it also created a phishing risk, with fraudsters creating lookalike windows to try to capture user information. Additionally, version 1.0 supported only browser payments and could not operate through mobile apps. With U.S. consumers facing minimal liability for fraudulent card transactions, few users saw the value in memorizing a new password and disrupting their shopping experience for the sake of potentially avoiding a case of fraud. However, in markets where consumers faced greater personal risk from fraud, the platform established more of a foothold.

Page 17: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

17

javelinstrategy.com 925.225.9100

The updated protocol, which is expected to fully go live in 2019, offers a much more flexible approach to authentication, and merchants will be able to transmit additional data about the transaction to a cardholder’s financial institution. This data includes fields such as device attributes, channel, and payment history. With the sharing of additional information, financial institutions can make more intelligent decisions about authorization based on the data they already collect for authenticating their cardholder. This can help address the threat of fraudulent transactions in digital channels by identifying anomalous locations, devices, or behaviors on transactions that might not otherwise appear as high risk. The converse is also true: Apparently high-risk transactions that would otherwise be declined can be treated with more confidence if they appear to be initiated from a device consistent with the cardholder’s other activity. In the event that additional authentication is needed for gray transactions, version 2.0 supports stronger and more customer-friendly authentication methods, such as biometrics and one-time passwords, that eliminate the need for users to memorize an additional password. Thus, they are less likely to result in cart abandonment. While issuers will see the most benefit from 3-D Secure 2.0 if they fully support the protocol and can make use of shared information with merchants, merchants can use 3DS on some networks even for issuers who have not yet enrolled. For instance, when a 3DS transaction is submitted on the Mastercard network to an issuer that does not currently support the protocol, Mastercard is able to act as a “stand-in” for the issuer and assess the risk associated

with the data elements passed through the protocol, providing a response to the merchant and enabling low-risk transactions to be approved without requiring additional action from the cardholder. Because transactions that are authorized using 3-D Secure shift the chargeback liability to the card issuer, merchants have a strong reason to adopt the tool, as they typically bear the liability for fraudulent transactions that occur through card-not-present channels.

Responsive Alerts and Notifications For transactions that appear suspicious enough to not merit automatic approval but do not have enough apparent risk to justify declining the attempt, contacting the cardholder and confirming whether the transaction is legitimate minimizes the risk of inconveniencing users with a false-positive decline. While SMS notifications have the advantage of being able to reach essentially any consumer, regardless of whether they own a smartphone or have downloaded their issuer’s mobile app, push notifications are preferable from the perspective of user experience and for resistance to interception. Responsive alerts are particularly valuable with the growing prevalence of customer-defined controls: tools that allow cardholders to set restrictions on the circumstances under which transactions on their card will be approved, such as on/off switches within a mobile app, geographic ranges, maximum value, or restrictions on types of merchants. While these can provide cardholders with a more active role in securing their accounts against fraud, they also increase the risk of false positives by setting hard restrictions that consumers are likely to forget. When customers initiate a

Page 18: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

18

javelinstrategy.com 925.225.9100

transaction that violates one of the rules they established, alerting them of the attempted transaction reminds them that they established the rule and should prompt them about whether they would like to create a temporary

exception. This can prevent a declined transaction from interrupting their card usage when the transaction is legitimate, and it can engage with cardholders when their controls stop a fraudulent transaction.

Page 19: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

19

javelinstrategy.com 925.225.9100

APPENDIX

False-Positive Volume Closely Mirrors Legitimate Transaction Activity Figure 10: Percentage of Card Transactions in the Past 30 Days Occurring Through Each Channel

Online Merchants Face Greater Risk of Attrition Than Brick-and-Mortar Stores Figure 11: Impact on Merchant Patronage, by Channel Where Decline Occurred

Source: Javelin Strategy & Research, 2018

Source: Javelin Strategy & Research, 2018

Page 20: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

20

javelinstrategy.com 925.225.9100

Affluent Consumers Much More Likely to Have Major Credit Card Declined Figure 12: Prevalence of Credit and Debit Card Declines, by Household Income

Source: Javelin Strategy & Research, 2018

Page 21: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

21

javelinstrategy.com 925.225.9100

METHODOLOGY

Consumer data in this report was primarily collected from the following:

A random-sample panel of 5,000 respondents conducted online in November 2017. The overall margin of error is +/- 1.39 percentage points at the 95% confidence level for questions answered by all respondents.

A random-sample panel of 3,000 respondents conducted online in October 2017. The overall margin of error is +/- 1.79 percentage points at the 95% confidence level for questions answered by all respondents.

A random-sample panel of 3,200 respondents conducted online in November 2014. The overall margin of error is +/- 1.65 percentage points at the 95% confidence level for questions answered by all respondents.

Page 22: 18-5015J-Overcoming False Positive Declines in E-Commerce ... · OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE 5 javelinstrategy.com 925.225.9100 Use behavioral analytics to block

OVERCOMING FALSE POSITIVE DECLINES IN E-COMMERCE

22

javelinstrategy.com 925.225.9100

ABOUT JAVELIN STRATEGY & RESEARCH

Javelin Strategy & Research, a Greenwich Associates LLC company, is a research-based consulting firm that advises its clients to make smarter business decisions in a digital financial world. Our analysts offer unbiased, actionable insights and unearth opportunities that help financial institutions, government entities, payment companies, merchants and other technology providers sustainably increase profits. Authors: Al Pascual, Senior Vice President, Research Director Kyle Marchini, Senior Analyst, Fraud Management Contributor: Crystal Mendoza, Production Manager Publication Date: December 2018

ABOUT NUDATA SECURITY NuData Security is a Mastercard company that helps businesses accurately verify users based on their online interactions and prevent false declines. By analyzing over 350 billion events annually, NuData harnesses the power of behavioral and biometric analysis, enabling its clients to identify the human behind the device accurately. Its award-winning technology allows companies to verify users before a critical decision, let good users go through seamlessly, stop account takeover, and reduce customer insult . NuData’s products are used by some of the biggest brands in the world to prevent fraud while offering a great customer experience.

© 2019 GA Javelin LLC (dba as “Javelin Strategy & Research”) is a Greenwich Associates LLC company. All rights reserved. No portion of these materials may be copied, reproduced, distributed or transmitted, electronically or otherwise, to external parties or publicly without the written permission of Javelin Strategy & Research. GA Javelin may also have rights in certain other marks used in these materials.