Restaurants, electronics sellers and digital-goods merchants are seeing sharp spikes in fraud as criminals find creative new ways to interfere in online and mobile commerce.
Through account takeovers and stolen payment details, criminals are intercepting and reselling merchandise — and ordering food for themselves — as they use restaurants to test bogus payment credentials, experts say.
Visa is reacting by tightening the fraud ratios merchants are allowed, in an effort to encourage better retailer fraud controls. Beginning October 1, Visa will lower the threshold for acceptable fraud levels to 90 basis points for merchants and 75 basis points for acquirers (down from 100 basis points for each), a Visa spokesperson said.
Merchants whose fraud ratios go above 100 basis points will be subject to Visa’s longstanding merchant fraud-monitoring programs, including Visa Fraud Monitoring, Visa Chargeback Monitoring and Visa Acquiring Monitoring. Fines for merchants who exceed the new limits have not been altered, Visa said. It's the first time Visa has changed its fraud-ratio limits in about a decade.
Merchants that typically see lower fraud rates probably won’t notice a thing, but retailers whose fraud ratios vary could be in trouble, observers say.
“Merchants with higher-than-average chargeback rates—such as those selling digital goods and subscriptions—are always balancing right on the edge of the 1% threshold, so moving the level down by 10 basis points will be extremely challenging for them,” said Julie Conroy, research director at Aite Group.
As more commerce moves to online and mobile channels, scammers are finding new targets, according to firms that track e-commerce fraud.
“Visa’s change means that a short-term spike in fraud can more easily push a company’s business over acceptable fraud thresholds, causing costly fines, the inability to dispute chargebacks or potentially being dropped from Visa’s network,” said Liron Damri, co-founder and president of Forter, a fraud-tools provider with offices in New York and Israel.
Merchants that don’t prepare for Visa’s new fraud thresholds could see a chain reaction of problems when the new guidelines go into effect, Damri warned.
“We’ll likely see many businesses start being more restrictive in their fraud systems to try and stay under the fraud threshold, ultimately declining more customers and losing potential revenue,” he said.
Food-delivery firms saw a 79% increase in fraud attacks last year over the previous year, while attacks on apparel and accessories marketers rose 47%, and jewelry and luxury firms saw a 19% spike in fraud attacks, according to Forter, which examined global transactions worth $50 billion.
One problem is that many merchants don’t have a good sense of their current fraud-ratio status, said Kevin Lee, trust and safety architect at Sift, a Seattle-based firm that uses machine learning to detect unusual types of fraud in e-commerce, mobile and other business channels.
“Merchants at the upper end of the allowable fraud ratio now could be in for a rude awakening in October,” Lee said.
Airbnb was one of Sift’s first customers. The San Francisco-based travel company hired Sift to ferret out a wide range of payments abuses, including fraud around bogus accounts, scammers collaborating on fake transactions and “toxic interactions” between buyers and sellers in forums, Lee said.
“With new business models, we’re seeing a lot of new types of abuses and fraud, and merchants are hiring us to keep their fraud ratios under control,” he said.
To spot new and evolving fraud approaches, Sift aggregates data from 30,000 different apps and web sites and uses machine learning plus behavioral analytics to spot suspicious new patterns and trends.
“Sift looks at a customer’s behavior in real time during the transaction flow, and lets the merchant know instantly whether to accept or decline a transaction, or step up authentication,” Lee said.
The risk for merchants is erring too much on the side of caution and turning away legitimate transactions, he said.
“The biggest problem with controlling chargebacks is that you’re often doing it at the risk of chilling your business model,” Lee said.
Visa’s decision to implement its new fraud-ratio rule right before the holiday shopping season could pose additional hardships for unprepared merchants, Lee suggested.
“Merchants will be in a tougher spot, dealing with new fraud ratio requirements in the pre-holiday period,” Lee said.
Some merchants may take a wait-and-see approach with Visa’s new fraud ratio thresholds.
“Not all merchants are that interested in keeping fraud levels below 1%, probably because they don’t want to make the investment or because they routinely have higher margins,” said Tim Sloane, vice president of payments innovation at Mercator Advisory Group.
Those merchants who don’t take action may have to scramble if they end up in Visa’s fraud-monitoring program, Sloane suggested.
“This [move] will squeeze them to invest. The risk is if they manage this poorly, they may start to decline good customers,” he said.
