STAMFORD, Conn.—Fraud on Apple Pay transactions—which some are pegging as high as 6% today—may climb even higher as the new payments solution becomes more widely accepted.
That is the opinion of payments and security expert Steve Mott, principal of BetterBuyDesign, who is concerned that Apple Pay fraud may rise in dollar volume and number when Apple Pay becomes more widely accepted at big box retailers. He thinks much of the fraud occurring now on the new payments solution is coming from crooks testing and probing, more so than for pure monetary gain.
Thieves Waiting On Big Box Retailers
“There are not a lot of merchant locations at which you can use Apple Pay right now. Thieves like the electronics companies and gift card sellers to show up, but right now on Apple Pay we are seeing the grocery stores, etc.,” said Mott, who is aware that five of the first wave issuers to enroll in Apple Pay have experienced fraud rates of more than 600 basis points. Mag-stripe plastic fraud averages 6 basis points.
Fraudsters have been typing stolen credit card numbers into Apple Pay and making purchases with their iPhones. A previous CUToday.info report revealed that FIs in their rush to enroll in Apple Pay have been overlooking standard security protocols, giving fraudsters an advantage by not using a second authentication factor—such as an e-mail or a text message—to confirm that individuals enrolling in Apple Pay are who they say they are. The fraudster simply obtains stolen credit card data, enrolls in the new service and then is good to tap and pay.
Tokenization Is Good, If...
Apple Pay employs tokenization, a process that replaces the real 16-digit payment card number used to complete transactions with a substitute number, or “token.” If tokenized data is stolen, transaction analytics can detect subsequent use and prevent a fraudulent payment and the tokenized number cannot be used at any other retailer.
Mott sees tokenization reducing a great deal of card fraud, and rendering much of the current stolen card data useless, “as long as the legitimate account holder is actually getting the token. The biggest vulnerability now with Apple Pay is being able to vet that the card account being presented for the token is a legitimate account and in the hands of a legitimate account holder.”
Some FIs are already moving to improve their Apple Pay security protocols, some requiring users to call them to activate Apple Pay, to ensure that their identities haven’t been stolen.
Plethora Of Fraudulent iTunes Accounts
Mott noted that Apple can assist in the verification process, letting FIs know if the account applying for Apple Pay has been in iTunes long and how actively it has been used, but is not sure how useful that information is.
“iTunes has 800 million accounts, maybe 500 million active,” said Mott. “I have been told by security experts that tens of millions of these are fraudulent accounts, or accounts that have been compromised.”
Experts have shared, too, concern that Apple, new to payments, may need to improve their rules for detecting fraudulent transactions on the front side, as fraudulent transactions are slipping by that seasoned payments companies would not miss.
Mott explained that iTunes fraud has been high, in number but not in dollars, due to the typically small price of the transactions. “So I don’t think, until now, it’s been worth anyone’s time and attention, including Apple’s.”