Overall, merchants are doing a reliable job of fighting back the onslaught of e-commerce fraud, but there are some places where the defenses have dramatically broken down.
Indonesia suffers the most e-commerce fraud at 35% of online transactions made using fraudulent credit cards, according to new research from Forter, an Israeli e-commerce fraud prevention technology provider. By comparison, U.S. e-commerce rates are closer to 1%, according to Forter's earlier research.
Forter analyzed more than 1 million global e-commerce transactions to determine which countries were most affected last year by fraudulent online shopping activity. Venezuela was not far behind Indonesia with fraudulent e-commerce activity at 33%, with South Africa at 25%, Brazil at 11% and Romania at 10%.
All other countries fared better than these five, but trends at the point of sale including EMV, tokenization and fingerprint authentication will likely draw more of fraudsters' attention to the Web.
Forter grouped multiple e-commerce categories travel, marketplaces, luxury items, services and apparel to illustrate overall fraud trends rather than break down numbers to specific types of businesses. The rankings categorized e-commerce transactions by country as opposed to singling out the origin of attack through Internet Protocol addresses.
"The only numbers the researchers reveal are the rounded percentages because merchants are really only interested in knowing the trends," said Noam Inbar, vice president of business development for Forter. "It also helps a consumer to see this and be more careful about where the merchants they deal with are doing business."
The U.S. was not included in the global research because its e-commerce fraud numbers "are much lower than the numbers shown in the research," Inbar added. Forter conducted research earlier this year examining the e-commerce
Though the shift to EMV is likely to affect U.S. fraud rates online, it should not reach the dramatic levels observed in Indonesia and Venezuela.
"The U.S. will never be in that boat with high-fraud countries," said Julie Conroy, research director and fraud expert with Boston-based Aite Group. "I feel pretty confident that with the analytics we have at the network level and the multiple levels of security we have seen merchants deploy, we have some pretty sophisticated capabilities out there."
There is no doubt the e-commerce fraud rate will jump higher in the U.S. after EMV, and "it will get worse before it gets better," Conroy said. "But we'll never be anywhere near that 35% level here."
E-commerce fraud is a global business, so the criminals driving up fraud numbers in the most dangerous countries are also targeting the U.S., Conroy added.
Forter did not disclose the fraud rates for the countries with the least amount of e-commerce fraud, though listed Denmark as the safest, followed by New Zealand, Finland, Norway and Switzerland. All were below a world average that hovers around 2%.
Forter cautioned against avoiding e-commerce because of these international fraud rates. "We've seen a lot of merchants automatically drop from the international market because they are seeing too much fraud," Inbar said.
A better approach would be for merchants to analyze e-commerce transactions with rules to minimize fraud, Inbar added.
The research confirmed that fraud rates within a country coincide directly with that country's culture and political tendencies. A more corrupt government translates to higher fraud rates and weaker Internet infrastructure, Inbar said. A country like Denmark has low fraud rates because it has a stable economy, low crime rates, a transparent government and better overall consumer welfare.
Comparing the continents, Forter found that Africa suffers e-commerce fraud rates as much as 10 times higher than the world average, with South America second at about three times higher.
In addition, Forter concluded that fraud rates associated with the Android mobile operating system are more than twice as high as those with Apple's iOS system.
"Fraud rates are higher on Android because it is easier to penetrate, get into the system and steal credentials from card storage and then make fraudulent transactions," Inbar said.
The research on operating systems examined card credential theft, not malware or other techniques, Inbar added.
