Technical Assistance Send a message via the Q & A box Or Call WebEx Technical Support: (US & Canada) (International)

Transcription

1 Technical Assistance Send a message via the Q & A box Or Call WebEx Technical Support: (US & Canada) (International) Attendee instructions on how to use Audio Broadcast Do not close the Audio Broadcast panel If you are not able to listen to the audio on your computer speakers, press the stop button, wait 5 seconds then press play. Make sure to adjust the volume button on your computer speakers and also adjust the volume on your sound card. To do this, go to the Start Menu, click Control Panel, then click Sound & Audio Devices and adjust accordingly. If you do not have speakers, please refer to your login instructions for the Teleconference Domestic and International Numbers and Access Code. You may request the Teleconference Number by clicking Request under the attendee box on your left hand side.

2 Can you hear the sound check? It has begun

3 To send a question: Locate the Q & A box on the bottom right hand corner of the WebEx platform. Type in your question and click send!

4 Financial Crime Trends: What You Should Know About Credit/Debit Card Fraud

5 Today s Presenters

6 BRENDAN BROTHERS Co-Founder Verafin Co-founded Verafin (BSA/AML Compliance & Fraud Detection software company) in 2003 Frequent speaker at industry conferences and key presenter for Verafin s anti-financial crime thought leadership webinar series Verafin has more then 750 financial institution customers across North America

7 JAY STARK VP, Fraud Management RBC Royal Bank Certified Fraud Examiner Ex-Chair of the Canadian Bankers Association, Banking Crime Prevention & Investigation Office Responsible for setting RBC Royal Bank fraud management strategic direction RBC is Canada s largest bank with more than 18 million customers in 55 countries.

8 a brief synopsis The World of Debit Cards

9 Why Debit Fraud is a Growing Concern Annual debit transaction volume in US 38 billion transactions (2009) Over 1 billion debit & credit cards Over 10 million merchant POS terminals

10 The 2010 Federal Reserve Payments Study 2010 Federal Reserve Payments Study December 2010 changes in the composition of economic activity, regulatory developments, and population growth may also have influenced these trends. Exhibit 2: Distribution of the Number of Noncash Pa yments Checks paid 32% Debit card 26% Checks paid 22% 35% Debit card Prepaid card 5% Prepaid card 4% ACH 15% 23% Credit card ACH 18% 20% Credit card The check collection process has become substantially more electronic since the last survey. Depository institution accountholders use of check image deposit services ( remote deposit capture ) and replacement of paper exchange with image exchange between depository institutions has expanded. Approximately 13 percent of checks were

11 Means of Committing Debit Fraud Lost and stolen card Account Takeover + Card not received Internet, mail or telephone order Counterfeit card

12 Counterfeit Card Card information is obtained through skimming or data breaches Information is used to create counterfeit card Customer still has original card

13 Authentication of Debit Card Transactions Something you have (plastic card) Something you know (PIN) or something you are (signature) Because of the weakness of mag stripe - there are lots of ways to fraudulently get the first one

14 Mag Stripe Info is Like Gold to Fraudsters Can conduct fraudulent transactions with the info Can use the info to create a counterfeit card Can sell mag stripe info and/or counterfeit card on black market

15 Debit Fraud Losses Are Becoming More Widespread Number of banks that incurred debit card fraud losses % % Debit card fraud losses estimated at $788M in 2008 Source: ABA

16 Debit Fraud Losses Are Becoming More Widespread Nilson Report: $6.7 billion (2009, global) Aite Group: $8.6 billion (US only) Mercator Advisory Group: $16 billion (total cost)

17 Global Debit Card Trends

18 Australia Source: APCA (Australia Payments Clearing Association)

19 Canada Source: Interac

20 United Kingdom Source: Financial Fraud Action UK

21 EMV (a.k.a. Chip-and-PIN) More secure than mag stripe + PIN because reading chip does not provide enough info to duplicate it Over 1 billion EMV cards have been issued globally.

22 EMV (a.k.a. Chip-and-PIN) Researchers have found flaws - stolen card can be used without PIN FIs should have additional protection from transaction monitoring systems

23 Canada EMV All POS and ATM transactions will be EMV-only by 2015

24 Implications for Organized Crime EMV cards provide a challenge Crime will migrate to other areas online (e-commerce, mail/phone order) stolen cards check fraud vulnerable geographies (US)

25 Criminal Gangs Expected to Target US We may become the only substantial economic power dependent on a payments standard that is less secure than that of the rest of the world. That means that criminals, intent on profiting from card fraud, will continue to migrate to the United States. EMV Gets a Push From Fed Banks, Industry Groups Richard Oliver, Executive Vice President Federal Reserve Bank of Atlanta Source: American Banker, September 2010

26 Debit Fraud Scenarios

27 Elder Abuse

28 For many people, debit fraud stems from the simple act of having one s card stolen or abused.

29 Meet Jack and Jill. They live with Jack s grandma, taking care of her health needs, and her finances.

30 Grandma is Delores Fairbanks. She built up a small fortune in the clothing industry.

31 Jack and Jill have a simple plan. Every now and again after Grandma has gone to bed, one of them slips out with her debit card to do a little personal shopping.

32 As time goes by without Grandma noticing, they get bolder. Before long they ve stolen thousands of dollars from the elderly woman.

33 Elder Abuse Indicators Age of customer Unusual volume and value of transactions for customer Unusual transaction locations for the customer Intention is not to drain the account, rather to siphon over a long period

34 Card Flipping

35 Meet Dmitri, another runner in Boris gang.

36 Dmitri heads to a nice secluded ATM at around 2 a.m. with a stack of cards.

37 His plan: Use each card once to take $200 - $300. He ll try to stay no longer than 15 minutes. He could get away with $2000 if he s fast enough.

38 Then he s off to the ATM across the street to continue his wave of fraud. Card Flipping is designed to hit many accounts as fast as possible.

39 Card Flipping Indicators Similar activity takes place in quick succession at the same ATM Time of transaction is typically late at night or very early in the morning Unusual transaction locations for the customer

40 Card Chameleon (a.k.a. Shopping Spree)

41 Data breaches are one of the most common ways a gang can gain access to data for thousands of cards.

42 Chameleons are armed with fake cards and sent out to take advantage of the spending habits of vacationers.

43 They target large malls and shopping areas in cities known for high tourism spending.

44 They buy what you d buy on holiday. And then sell the goods on the black market.

45 Chameleon Indicators Unusual transaction locations for the customer Purchases made in vacation areas with no travel related transactions (hotel, airline ticket, restaurant, etc.) Multiple high value purchases occurring in rapid succession Purchases are quickly draining the account

46 Card Skimming

47 A well placed skimming device can get information on hundreds of accounts in a very short time.

48 Fake cards are quickly made

49 and given to runners, whose primary job within the gang is to commit the actual fraudulent acts at the ATMs.

50 Boris is a runner, who works late at night. His job is to quickly get as much money out of an account as possible.

51 At around 11 p.m. he takes $400 from one account.

52 Then he s off to the money mart across the street to buy $900 in travelers checks.

53 A little past midnight he returns to the ATM and takes out another $400.

54 When the funds run out, he deposits an empty envelope so he can take some more.

55 Card Skimming Indicators Time of transaction is typically late at night, very early in the morning, or during a long weekend Unusual transaction volume and value for the customer Unusual transaction locations for the customer

56 Flash Attack

57 The following story is inspired by true events

58 This is Yuri and Alex, senior members in an organized fraud ring.

59 They travel from the west coast to a mid-west city and set up skimming devices at local gas stations.

60 After a day or two, they remove the devices and extract the card data.

61 They create a few cards and test them, ensuring the data is good.

62 Then they head back to the west coast, where they create a couple hundred counterfeit cards, complete with PINs.

63 With the help of other gang members known as handlers, the cards get passed out to money mules.

64 The mules are located in cities throughout the country, and are given very strict instructions.

65 1. Conduct the transactions beginning at exactly 5:00 a.m. Saturday morning. 2. Withdraw $300 on each card. 3. Stay no longer than 5 minutes

66 This well-choreographed attack nets the gang over $100K in just five minutes.

67 Despite the effort required to coordinate such an attack, the pay out can be substantial. This type of debit card fraud is called a flash attack.

68 Why all at once? Lots of cash in short period of time Very hard to stop

69 Common Points of Purchase (CPP)

70 What is a CPP? CPP stands for Common Point of Purchase a.k.a. Common Point of Compromise (CPC) Common Point of Purchase Compromise

71 The Concept is Simple Skimming device placed at a terminal grabs card details for a short period of time (hours, days, or weeks) When cloned and used fraudulently, the card history is available for review by FI By comparing the history of two or more cards, the location and time of the skimming device can be determined The location and times of the actual frauds have nothing to do with CPP determination Use that information to cancel other cards before more fraud can take place

72 Fraudulent Debit Card Use Common Location Time

73 Debit cards with known fraudulent transactions Skimmed Terminal Skimmer placed on terminal Skimmer removed from terminal Time Debit cards skimmed but not yet used fraudulently

74 There are some pitfalls 2 incidents of debit card fraud might look similar but not be related at all - so CPP detection will not work. If a CPP is found, you will find a range of dates and times during which the device was compromised - but you might not get the full range of actual compromise. What to do if cards were used at the same location weeks apart? It s possible that the device was present for a long time, but also possible that the cards happened to be used at the same place. With more cases of fraud mapping to the same common point, the likelihood of compromise rises dramatically.

75 Does it have to be a single terminal? Not strictly Most commonly, a single device will be compromised with a skimmer, which will collect data for dozens of cards A single location (store, gas station) could also be compromised with multiple skimmers at multiple terminals Sometimes a chain is hit in a particular area, with multiple stores getting compromised (one or more terminal per store) Even possible that an online site that collects debit/credit card numbers is breached

76 Dealing with a CPP

77 1. Once you find a CPP you need to determine if it is reasonably a point of compromise What is the range of dates/times that the transactions took place? a small range more likely indicates a skimmer more transactions mean it is more likely a skimmer Contact the merchant Contact law enforcement

78 2. Cancel Cards You have definite range during which the skimmer was present, so cancel any card used in between Expand the ranges a bit, to account for the skimmer being present for longer than you have data example, on January 1 at a gas station on a busy interstate - likely that it was present for most of the Christmas holidays

79 3. Flag Cards If your transaction monitoring system allows it, expand your range again and flag any cards as high risk This will ensure even moderately suspicious activity generates an alert Flagging is a compromise so that you don t have to cancel cards that you feel are less risky

80 4. Continue to Monitor The compromise could be bigger than you suspect (more related locations, longer time) If new cases come up, investigate whether they are actually related to the existing fraud scheme

81 How to determine CPPs You might simply be told of a known or suspected compromise location News (Michaels arts & crafts stores) Other financial institutions Card processor Law enforcement Merchants

82 A rather amusing (but highly unusual way) to detect a CPP 3600 cards were recently skimmed from gas pumps in 2 locations in CA

83 a gas station attendant received an error message at one of the pumps when he opened the pump he found a circuit board and wires (components of the skimmer) he alerted the police who installed an alarm system in the pump when the skimmers returned to open the pump- it tripped the alarm and the police arrested the duo

84 Verafin / RBC Card Fraud Webinar RBC Fraud Management September 2011

85 Evolution of Capture Shoulder surfing and card capture Rudimentary ATM, Card and PIN capture Doors PIN Pads Separate swipe and camera Gas stations False ATM front Integrated POS (devise swapping) Sophisticated ATM overlay Dummy terminals

86

87

88 Evolution of Spend Before and after midnight Multiple cards per runner Mass runners Slow bleeds and foreign attacks mixture of captures limited card usage white label foreign spends

89 Lock Boxes

90 Criminal Commentary Organized crime Ability to mobilize quickly Constant regression Willingness to exploit weak issuers Cottage industry participants Generations of skimming devices Path of least resistance Adjudication issues

91 Fraud Management Pillars Client Experience Loss Reduction Cost Risk Management

92 Fraud Value Chain Customer Satisfaction Asset Recovery Intelligence Prevention Detection Investigation Prosecution Post Fraud Root Cause Analysis

93 Response: Core Know they will get your cards Detection (must prevent rather than only identify) CPP RTD (several generations) Bypass intermediary detection strategies Supplements Chip roll-out RTD supports a DBS

94 Response: Best Practice Industry Consortium Simple: Project Mike Moderate: CPP detection RTD: opportunity for a broader application of detection strategies at the issuer or consortium level Chip implementation

95 Response: Supplementary Clear first mover advantage in the evolution Opportunity in your market Measurement and regression FDI (green things), PIN shields and jitter technology Surveillance cameras and vestibule monitoring Auto blocking/rtd IFD and analysis Chip roll-out DBS Reimbursement protocols Objectives Contact strategies

96 A Major Factor in Mitigating Card Fraud Losses

97 Card fraud will increase in 2011 attacks will be more sophisticated and globally coordinated. Flash attacks which rely on coordinated, often international, efforts to simultaneously withdraw funds from multiple ATMs, are just the beginning. The banks that are successful at mitigating these attacks and stopping them before they do too much damage are the ones that are able to find the point of compromise very quickly. They can stop it, if they figure out where the point of compromise was. Source: Avivah Litan, VP Gartner Research, 2011

98 Q&A Locate the Q & A box on the bottom right hand corner of the WebEx platform. Type in your question and click send!

99 If you have additional questions for today s expert, please send them to training@acams.org Thank you for joining us today!