By Ray Birch
PRINCETON JUNCTION, N.J.—Card not present (CNP) fraud has yet to become a major issue, but that could change in the next year or two depending on how crooks attack the payment channel and merchants deploy new defenses, says one expert.
Going against what several analysts have stated this year—that CNP fraud is growing at a very rapid pace today—Randy Vanderhoof, director of the U.S. Payments Forum, said that CNP fraud growth remains flat, not yet becoming a major issue among online retailers nor a huge concern for consumers.
“What will happen in the next two years will be a significant shift in the tactics by ecommerce merchants and fraudsters,” said Vanderhoof, who thinks the current situation could easily change. “So whoever does the best job of maximizing their positions—the merchants or the crooks—will impact what consumers ultimately feel from CNP fraud.”
Vanderhoof explained that what is occurring today is that online purchasing is taking off, easily outpacing annual CNP fraud growth.
“When you look at the fraud figures, they are not keeping up with growth in overall ecommerce sales,” explained Vanderhoof. “The conclusion is that although fraud is going up, it’s going up at a lesser rate than what overall ecommerce sales are increasing. So CNP fraud has not reached the point where fraud is becoming overwhelming for online merchants because they are able to absorb the increased fraud costs with greater online sales.”
E-Commerce Growth
Vanderhoof cited Aite Group data that shows CNP fraud grew 27% from 2012-2016.
“That is an average of 5.4% growth each year over the last five years, while e-commerce sales have averaged over 15% growth per year over that same period,” said Vanderhoof.
But no one really knows how those figures might change during 2017 and 2018, Vanderhoof noted.
“Aite projections show a significant jump in ecommerce sales over the next two years, moving to 17%-18% annual growth,” he added.
As other analysts have stated, Vanderhoof emphasized that as ecommerce sales rise so will CNP fraud. But what will impact the crime’s growth is how quickly issuers convert the rest of their card base to EMV and merchants change out remaining mag stripe terminals to chip.
“Right now fraudsters still have many POS terminals they can exploit with their cache of stolen data from all of the data breaches,” said Vanderhoof, noting that merchant POS terminal conversions stand at about 50% today.
Vanderhoof said two things will naturally occur in the next two years—crooks will migrate at a greater pace to CNP as merchants convert remaining terminals, and once online merchants can no longer cover rising CNP fraud with rising e-commerce sales, they will begin to invest in stronger fraud deterrent solutions.
“I think we are right an inflection point, in 2017 and 2018, where card not present fraud is starting to reach the point where it can’t be sustained by online merchants, and more merchants are securing their physical stores, which is pushing crooks online,” said Vanderhoof.
Strong Online Security Years Away
Vanderhoof said that when online merchants deploy new, stronger defenses, it will take about three or four years to truly secure the online channel, which will then send crooks down another avenue.
Vanderhoof pointed out there is a fundamental difference between in-store and online fraud for issuers—issuers are not liable for e-commerce fraud losses.
“They can charge back the losses to merchants,” he said. “Still, issuers do have a problem serving their customers and members who don’t want to have their cards compromised and reissued. So there is a customer service issue to address in this for issuers.”