IMGCAP(1)]
Last year in this space, I talked about the massive TJX data breach, considered the largest-ever compromise of credit and debit card account data. My message then was that bankcard fraud rings are growing more sophisticated and that debit-industry players need to start using their own data as effectively as fraudsters to regain the upper hand.
More than a year after the TJX heist, which affected more than 100 million debit and credit cards, fraud rings continue to refine their data-acquisition efforts, while the debit card industry has made almost no progress to improve its fraud-prevention infrastructure. Many debit card issuers and processors still are using decade-old approaches to fraud detection.
It is time to sound the alarm: Large-scale debit fraud will strike again.
To protect against it, industry players should make strategic investments of management attention and money to develop new approaches to understanding the total fraud equation in an increasingly sophisticated environment.
Only by analyzing the data locked inside many card-processing operational systems can professionals charged with detecting debit card fraud get a better understanding of the changing fraud landscape. Based on our experience, there are three areas where industry players can begin to better quantify their fraud-detection efforts: fraud-detection score validation, fraud rule development and fraud operational efficiency evaluation.
At Analytic Innovations, we have analyzed a number of different fraud scores in the marketplace and discovered a wide variability in the predictive power of those scores. Using these findings, we created a financial equation that industry players can use to calculate their cost per fraud detected at different score cut-offs.
By crossing confirmed fraud with scored transactions, card issuers and processors can calculate how effectively their neural network predicts fraud and how efficiently their case cut-off score is set across several dimensions. This analysis helps debit card issuers understand how much it costs for each fraud-tainted account they detect in their portfolios.
The next strategic investment debit card-industry players should consider is the cost to develop and measure the effectiveness of fraud-detection rules–either alone or in combination with available fraud-prediction scores. Our discussions with clients uncovered a need for a more quantitative approach to developing fraud-detection rules and measuring their success in predicting fraud.
Finally, debit card-issuing or processing organizations should evaluate the efficiency of their fraud-detection operations, looking specifically for the operational causes of fraud losses.
Issuers and processors can use the raw data from fraud operations to determine the average number of fraudulent transactions before triggering rules-based alerts on potential fraud cases. They also can use the data to gauge the effectiveness of queue prioritization at moving the highest-risk transactions quickly to an analyst for review, and to ascertain the adequacy of analyst staffing and the accuracy of analysts in diagnosing and blocking accounts they suspect are fraudulent. Armed with this data trended over time, organizations can begin to judge the strengths and weaknesses of their fraud-detection operation.
Another year has gone by, and debit card issuers and processors still are using primarily legacy approaches to fraud detection. These may have been adequate when the business was still developing, but as the industry still stands, fraud rings grow ever more sophisticated over time. The fraud cycle will swing back. Will you be ready? CP
(Jeff Trachtman is vice president and manager of Analytic Innovations LLC's fraud
risk analysis division. Analytic Innovations provides data-driven risk management and marketing services. Trachtman can be reached at jefft@analyticinnovations.com.)
