In payments, fraud never changes

Now in this new era of online and other new payments, the shape of risk is again changing. The growing acceptance of smartphone payments does, like those first chips, offer new layers of security – but once more what also happens is the risk shifts elsewhere.

"Slow acceptance [of modern security standards] has left some countries vulnerable as criminals attack ‘soft’ targets to perpetrate card fraud.”

The latest Australian fraud statistics released by the Australian Payments Network (APN) confirm chip technology “continues to provide strong protection against counterfeit cards” and “countries that have not upgraded to the more secure card technology continue to be a target for card fraud”.

But as card-present fraud has declined, card-not-present (CNP) fraud in 2016 has increased - from 66.9 cents to 74.7 cents per $A1,000 spent. CNP accounted for 78 per cent of all fraud on Australian cards in 2016.  CNP, as the name suggests, is where a payment is made remotely, often online.

Fraud is thus increasingly migrating online and CNP fraud has now increased for four years in a row, reaching $A418 million for 2016.

Wholeheartedly

The adoption of smart/chip cards has been underpinned by the creation of common technology standards for such payment cards, known as EMV (Europay, MasterCard, Visa).

More than half of all card transactions undertaken in-person globally in the year 2016 used EMV chip technology, up from 35 per cent in 2015. To qualify as an EMV transaction, both the card and the terminal need to be EMV enabled.

Whilst many countries have adopted the EMV standards wholeheartedly, others have been tardier in their acceptance and adoption.

A recent Debit Issuer Card Study from the American debit and ATM network Pulse found US financial institutions both increased issuance of chip debit cards and experienced reduced fraud losses in 2016 and an estimated 80 per cent of US debit cards have been converted to chip cards.

Fraud loss rates on debit cards fell by approximately 28 per cent in 2016, compared with 2015 levels, but nevertheless, there was still an estimated $US900 million in debit card fraud in 2016 and hence, “fraud continues to challenge card issuers”.

So common technology standards like EMV, and a willingness to adopt them, seem to have contained payment card fraud in some countries, but slow acceptance in other countries has left them vulnerable as criminals attack ‘soft’ targets to perpetrate card fraud.

In the Australian market, the conundrum is the successful adoption of chip cards has enabled a wide take up of contactless ‘tap and go’ card payments, which are so popular consumers don’t see a need to switch to smart phone payments – which are incrementally more secure.

Indeed, despite some hysteria about tap’n’go being more vulnerable, the NSW police have actually urged consumers to use the system as it thwarts to use of “ghost terminals” which criminals use to skim card information and create clones.

Challenge

A recent research paper from the Reserve Bank of Australia (RBA) on How Australians Pay revealed while two thirds of all in-person card payments were now contactless, only one in 50 in-person card payments were made with a mobile phone.

Australia is not the only country where the adoption of smartphone payments is proving to be a challenge. Research published in August 2017 by Visa revealed in Canada over 70 per cent of purchases are made electronically using credit card, debit card and mobile payments.

But only 12 per cent of Canadian smartcard owners have used their phones to make at least one payment.

One hypothesis is the low level of smartphone payments in Australia is because of the success of contactless cards in this country. Hence consumers just do not see any extra value in making a smartphone payment over a contactless card payment.

Offshore, the transport network in London appears to be providing a substantial uplift for smartphone payments.

By July 2017, one in 10 contactless journeys on London’s buses and tubes are now being paid for using a smartphone app. Since they were first accepted in 2012 and by 2017, 40 per cent of all journeys were made using contactless payments.

Transport for London states 31 million journeys have been made by commuters using their smartphones during the year to July 2017. This acceptance is widely believed to be having a galvanising effect on the update of contactless payments both across other parts of the UK and in generating new acceptance opportunities.

Since November 2016 contactless credit and debit cards have been accepted in all 23,000 of London’s black cabs and at Christmas 2016 drinkers in one London pub could beat the queue at the bar by using a self-service beer pump, with built-in contactless payments capabilities.

The launch in August 2017 of an app by Beijing’s public transport company Yikatong allowed most Android smartphone users to pay for their journeys by tapping their smartphones, rather than their contactless transport cards onto the fare acceptance terminals.

This however does not apply to Apple iPhone users as Apple does not grant access to third party apps such as Yikatong’s, or indeed to other popular Chinese payment systems apps, such as Alipay and WeChatPay. Apple’s Android based competitors in China, such as Samsung, Huawei and Xiaomi do.

Apple Pay was launched in China in early 2016, but so far only has less than 1 per cent of China’s market, which is dominated by Alipay and WeChatPay, who use – the actually quite old - QR codes on smartphones to effect payments.

The key

In Australia, Transport NSW launched a trial in August 2017 allowing commuters and tourists to use their MasterCard payment cards and their smartphones to pay for ferry journeys on the Manly to Circular Quay route.

It is hoped the trial will demonstrate contactless ticketing will improve the public transport experience for both residents and visitors.

Card fraud can be contained and the adoption of EMV was the CSF which helped to overcome the challenge. But history tells us security in itself is never the “killer app”. But in many markets, transport is. Why have two cards when one will buy your coffee and the train ticket? So why have a card at all if your phone can do it all?

Steve Worthington is a Professor at Swinburne Business School