E-Commerce Fraud: Important Terms and Definitions

Gateway

Payment gateways process credit card payments and other electronic payments for organizations, including e-commerce and brick-and-mortar merchants, transferring key transactional data between payment portals and the front-end processor or bank.

The payment gateway process is incredibly complex — it includes securing payment data according to PCI DSS standards, sending transaction data to the payment processor and processing the payment — yet it generally takes just seconds to complete.

While banks often serve as payment gateways, payment service providers — like PayPal and Square — can also fill this role. The right payment gateway can help assure customers a website is trustworthy and can provide a seamless purchasing experience; choosing the wrong service can result in a decrease in sales and a loss of customer confidence.

High-Risk Industry

High-risk industries are those that are particularly vulnerable to online credit fraud and chargebacks, like merchants doing business in verticals such as gaming, adult entertainment, online gambling and travel. Because of this vulnerability, many credit card processors believe businesses in these industries are too risky to work with, leaving the businesses at the mercy of a high-risk credit card processor's less-than-desirable terms and conditions. They may find themselves stripped of even this agreement if the merchant can’t control their chargeback ratios.

Every merchant will be evaluated by different standards, but merchants with these characteristics may be labeled as high-risk:

• They’re a new merchant with little credit card processing history.
• They sell products or services to countries with a high incidence of fraud.
• Their average transaction value is more than $500.
• The merchant operates in an industry with high chargeback ratios.

Honeypot

A honeypot is a tempting set of data or an attractive computer system that lures fraudsters and counteracts their attempts to hack into or otherwise compromise an information system. Similar to a police sting operation, a honeypot acts as bait by appearing to be a legitimate part of a website; however, it’s actually being monitored by information technology professionals. Watching and recording this activity gives fraud prevention specialists insights into new modes of attack by fraudsters while also testing the security of network infrastructure.

There are two kinds of honeypots:

• Production honeypots are designed to look real; they’re also intended to keep a hacker busy while the system administrators ensure there are no other vulnerabilities in working production systems.
• Research honeypots let professionals analyze hacker activity in an effort to shore up a system’s defenses. Uniquely identifying information that’s “stolen” from a honeypot may also be used to track the stolen data and identify hackers.

Identity Theft

Identity theft happens when fraudsters gather enough critical pieces of personal data about an individual (such as name, driver’s license number, date of birth and address) and pose as that person to open new accounts and make purchases. This may also be referred to as “true name identity theft.” A criminal can also use stolen information to hijack a consumer’s existing account (called “account takeover”).

The number of identity theft victims in the United States totaled 15.4 billion in 2016 (2 million more than in 2015) and bore a financial cost of $16 billion.

IP Address

Each device connected to the internet has an Internet Protocol (IP) address, which is a numerical label that serves to both identify the device and provide its location. There are two types of IP addresses:

• Static The user configures this by editing a device’s network settings.
• Dynamic The device is assigned a new IP address each time it starts.

Merchants can use IP addresses to flag potentially fraudulent orders, like multiple orders shipped to different physical addresses but placed from the same IP address.

Machine Learning

Some computer systems have the ability to “learn,” or make progressive improvements on a task based on algorithms and human input. This machine learning is frequently used with fraud software, allowing fraud prevention programs to make fast transactional decisions while minimizing risk exposure.

As machine learning systems find fraud patterns in purchase data, and as they assimilate new data, they can make increasingly accurate predictions and become quite effective at flagging fraud. Yet they can’t work alone. These machines still rely on current data and analysts’ insights to make wellinformed decisions.

Malware

An abbreviation for “malicious software,” malware is designed to damage computers, servers and even networks through computer viruses, ransomware, spyware and more. Installed malware on a victim’s computer can even capture the user’s keystrokes as they enter user names, passwords and emails. Fraudsters then use that data to access the accounts and use the funds to make fraudulent purchases.

McAfee Labs reported a record of 63.4 million new malware samples in fourth-quarter 2017 — that’s eight malware samples per second. Experts warn that malware is using new tools and schemes — like PowerShell, cryptocurrency mining and ransomware — to target vulnerable e-commerce businesses.

Manpower Direct Costs

This refers to the cost of the personnel who work directly on a particular job or are involved with the production of certain goods. For example, the salary paid a landscaper who mows lawns is a direct manpower cost.

Manpower Indirect Costs

Indirect manpower costs refer to the expense of employees who don’t produce goods or services themselves but may improve the efficiency of the production (like security guards or managers) or offer production support. In our example above, a salary for a mechanic who services the lawnmowers would be considered an indirect cost.

Merchant Account

A merchant account is a special bank account that a merchant establishes with an acquiring bank that lets a merchant accept electronic payment card transactions and receive transaction funds. Businesses can select from a variety of merchant acquiring banks and often make their decision based on transaction costs. Merchants labeled high-risk may pay significantly more in fees and penalties.

More than 70% of Americans have at least one credit card. And 83% of businesses saw an increase in sales after they began accepting credit cards.

Merchant Account Provider

Partnering with a merchant account provider (sometimes called a “merchant acquiring bank”) lets businesses accept credit and debit cards as forms of payment. While many merchants work with banks or financial institutions, other merchants may opt to work with providers like Square, PayPal or QuickBooks to process credit card transactions.

To find the provider that’s right for them, merchants should compare the services, fees and extras each provider offers. Businesses in high-risk categories will find themselves with fewer options.

Merchant Chargeback Insurance Provider

There are a number of online fraud prevention companies that offer a 100% guarantee that the merchant won’t be held responsible for the costs of fraudulent transactions, if the provider approves a transaction that turns out to be fraudulent and results in a chargeback.

A good chargeback insurance provider will always provide a final decision on whether to approve a transaction and will guarantee every transaction. But merchants must also understand that guaranteeing transactions isn’t enough.

Sure, merchants want to be confident that their provider will reimburse them for any costs incurred from a fraudulent chargeback. But merchants also need to know their vendor is thoroughly reviewing every suspicious transaction to determine its validity — not just playing it safe by declining every questionable transaction to avoid paying chargeback fees. In the end, it’s about finding a vendor that will optimize approvals while minimizing chargebacks.

Multichannel Merchant

Multichannel merchants focus on getting their products into the hands of customers, wherever they may be. Over the years, multichannel selling has expanded from brick-and-mortar stores, phone sales and catalogs to now include e-commerce sales made via apps, mobile devices, social media sites and online marketplaces.

Retailers selling in at least two channels enjoyed approximately twice the revenue of those who sold through only one. And merchants who sold on two, rather than one, online marketplaces averaged 190% more in sales revenue.

Near-Field Communication (NFC) Payments

Sometimes known as “contactless payments, NFC payments occur when two devices “talk” when they’re near each other and complete a transaction. Apple Pay, Android Pay and Samsung Pay are some of the most common NFC payment platforms.

While many smartphones have this technology built-in, merchants must purchase an NFC-enabled payments reader to accept contactless payments.

Because NFC mobile payments are dynamically encrypted, they’re considered a safe way to process transactions. Customers think so, too: The number of worldwide NFC payment users has skyrocketed from 5 million in 2012 to a projected 166 million in 2018.

Omnichannel e-Commerce

Omnichannel merchants are looking to do more than just sell on every channel available to them. Instead, they want to create seamless shopping experiences, regardless of whether a customer is shopping on the Web, via an app or in a brick-and-mortar location. So omnichannel e-commerce focuses on fusing online and offline channels into a singular shopping experience with a consistent look and feel.

For example, 50% of customers want to be able to order a product via an app and pick it up in a brick-and-mortar store — and omnichannel e-commerce can deliver on that. And customers who can get this experience are more likely to be more loyal: Omnichannel businesses retain an average of 89% of customers, compared with 33% of businesses with multichannel strategies.

Online Scam

While the Internet has made it easier to complete daily tasks, like shopping, banking and booking vacations, it’s also made it easier for fraudsters to carry out their cybercrimes. Some of the most common online scams include phishing, disaster relief scams and lottery winner scams. Unsuspecting customers are asked for —and often release — personal data that’s then used to make fraudulent purchases.

Although 90% of U.S. individuals are vulnerable to online scams, 71% are more cautious than they used to be about shopping online.

Payment Fraud

Payment fraud refers to any fraudulent transaction a criminal executes that results in stealing a victim’s money, property or sensitive data. While traditional fraud prevention controls used to be enough to prevent payment fraud, fraudsters now engage in subtle behaviors to trick unsuspecting customers to release personal information.

PCI Compliance

With 86% of websites at risk of being hacked or compromised, merchants can’t take a chance with sensitive customer data getting into the hands of cybercriminals. That’s why every merchant handling payment cards must follow the 12 control objectives established by the Payment Card Industry (PCI) Security Standards Council. These objectives include security measures like:

• Installing and maintaining firewalls to protect cardholder data
• Encrypting cardholder data transmissions
• Regularly testing security systems and processes

A merchant’s transaction volume, card-handling method and security breach history determine how often and what kind of security audits and scans are required to establish compliance. Many merchants may be eligible to conduct a self-assessment, while larger merchants or those experiencing previous breaches will need to have an independent Qualified Security Assessor perform the audit.

Although compliance with PCI Data Security Standard has increased 167% since 2012, 80% of organizations are still noncompliant. And exposing customer data isn’t the only risk associated with noncompliance. Merchants can face substantial financial penalties, including hefty fees from the acquiring bank, costly audits and investigations, and the risk of merchant accountsbeing terminated.

PCI DSS

The Payment Card Industry Data Security Standards (PCI DSS) were established in 2004 in response to increased data theft: More than 80% of data stolen in breaches is payment card data, and there were almost 42,068 data security incidents in 2017.

PCI DSS compliance focuses exclusively on implementing standards for keeping credit card data secure as it makes its way from a merchant to the credit card processor. Every merchant handling payment cards must follow the 12 PCI-established control objectives that dictate the encryption and transmission of credit card data.

The major credit card companies (Visa, MasterCard, Discover, American Express and JCB) formed an independent body in 2006, called the PCI Security Standards Council, to manage the ongoing evolution of the standards and to highlight ways merchants can improve payment security.

Pharming

A common scam by fraudsters is “pharming” attacks, which are similar in nature to “phishing” attacks, with one important difference: Phishing attacks require victims to click on a link to take them to the fraudulent website, whereas pharming attacks automatically install malicious code on a computer and misdirect users to fraudulent websites. Because this code requires neither consent nor knowledge to execute, many victims don’t even realize they’ve been targeted.

Pharming attacks are increasing, in part because fraudsters are looking for new ways to collect sensitive personal data from Internet users who are learning how to avoid phishing attacks. In 2017, a pharming attack hit more than 50 financial institutions and customers in the United States, Europe and Asia-Pacific. Before it was stopped, the attack infected more than 3,000 computers in three days.

Phishing

A form of social engineering and identity theft, phishing scams try to trick individuals into revealing personal information. Fraudsters typically contact victims by text, email or phone, posing as an authority figure or a seemingly legitimate company to get the victim’s confidential data.

Phishers may also install malicious software on computers, infect computers with viruses or even steal personal information off of computers.

Nearly 1.5 million new phishing sites are created monthly, and nearly 76% of businesses reported being a victim of a phishing attack in the last year. The average cost for a mid-size company? $1.6 million.

Point-to-Point Encryption (P2PE)

The PCI Security Standards Council established P2PE standards improve the security of credit card transactions. During the P2PE process, transactional data is securely encrypted at the merchant’s point-of-sale entry and continues until the final credit card processing point.

Many systems use public key encryption, symmetric encryption keys or hashing to disguise sensitive data as it progresses through the transaction life cycle. This layer of protection is used in addition to SSL encryption.

Merchants who use a P2PE-validated solution aren’t held responsible for any data loss, fees or penalties that may result from fraud.

Purchase Amount Filter

Fraud filters make it easier for e-commerce merchants to identify and respond to potentially fraudulent transactions. One of the most common is a purchase amount filter, which lets e-commerce merchants set upper and lower limits for transaction amounts. Any purchase that falls outside the range can be flagged and held for further review, processed as usual but trigger a report, or automatically declined. Because most merchants know their typical transaction size, setting the filter will notify them when unusual transactions occur.

Fraud filters can be extremely effective when used properly. But if a merchant layers multiple filters incorrectly, the filters may not work as intended, with some rules being overruled by others and decreasing the efficacy of the system.

Ransomware

Ransomware is malware that limits users from fully using their infected system until a ransom is paid. While traditional ransomware simply locks a screen or the user’s files, new crypto-ransomware encrypts files on the compromised system and provides a decryption key only after the victim pays the ransom. Users may inadvertently download ransomware when visiting compromised websites or by opening infected emails. The fraudster may request payment in cryptocurrency — although they sometimes ask for gift cards — but receiving payment is no guarantee the victim will receive the decryption key or have their files released.

In each quarter of 2016, fraudsters sent 500 million emails carrying ransomware downloaders that found their way onto 13.4 million computers. While not every payload successfully launched, it’s clear that fraudsters continue to use ransomware as a quick payday against their victims.

Risk Management

Merchants engage in risk management processes to identify, evaluate, analyze and prevent exposure to the risks that threaten capital and earnings. These risks come in many forms, including weatherrelated risks, liability judgments, employee theft and credit card fraud.

E-commerce merchants have become increasingly focused on securing their digital assets, including a customer’s personally identifiable information, and have implemented risk management programs that help them:

• Improve transaction approval rates
• Reduce false declines
• Decrease chargeback ratios and fraud-related chargeback costs
• Shorten response time

Skimming

Skimming is the act of using hard-to-spot electronic devices or card readers at point-of-sale systems to capture and copy electronically transmitted account information from a valid credit or debit card. The fraudster then clones that data on a counterfeit card to make in-store purchases, uses the card information to place fraudulent online transactions or sells the data on the deep web.

In 2016, one man was arrested in California for placing skimmers in eight Wells Fargo ATMs. He captured data from almost 4,900 cards, created counterfeit cards and then stole nearly $500,000. Global losses from skimming topped $2 billion in 2013 and continue to grow.

Smart Card

A driver’s license-sized card that contains embedded circuitry is often referred to as a smart, or chip, card. They can be contact, contactless or both and are used for a variety of purposes, like identification, authentication and data storage.

Smart cards increase a card-present transaction’s security and convenience and are resistant to compromise from data hacks and fraud. These tamperproof cards use cryptograms to secure sensitive financial data (like today’s EMV-compliant credit cards); they can also carry personal health information, serve as keys, and store loyalty card information.

While smart cards aren’t currently used for e-commerce transactions, consumers in the future might have personal card readers that let them conduct secure CNP transactions at their desktop or over their mobile devices.

Social Engineering

As one of the biggest security threats facing businesses today, social engineering tricks individuals into violating traditional security practices and divulging information or performing an action that compromises security. Fraudsters pose as authority figures to gain approved access to confidential data through nontechnical methods like phishing, pharming and pretexting.

Social engineering is used in more than 66% of all attacks by hackers. Phishing is the most common method of attack: Of the 294 billion emails sent daily, nearly 90% is spam and viruses. In 2013, Target fell victim to social engineering when fraudsters launched a phishing scam against an HVAC subcontractor for the company. The hackers obtained Target network credentials and stole 40 million credit and debit cards from the store’s point-of-sale systems.

Tokenization

Payment services like Apple and Android use tokenization to protect sensitive data, swapping out the personal information with randomly generated data. As a result, a customer’s actual credit card data is never used or accessed.

There are three benefits to using tokenization:

• The process is frictionless for and nearly invisible to customers.
• This technology helps protect against the theft of credit card information during the transaction process.
• It helps merchants comply with industry security standards like PCI DSS.

Tokenization is currently believed to be one of the best solutions currently available that can secure credit card transactions without significantly altering the cardholder experience.

Tor

Tor, which stands for The Onion Router, is free software that facilitates anonymous communication. By directing internet traffic through an overlay network of more than 7,000 relays, Tor makes it difficult to trace internet activity back to a user.

In 2012, there were just 500,000 daily Tor users; that number grew to more than 4 million just a year later.

The U.S. Navy created Tor’s original technology with the intention of protecting internet users from corporations’ — not the government’s — prying eyes. While there are some innocent users, the Tor network helps run the dark web, where many legal and illegal transactions take place.

Velocity Filters

Velocity filters monitor specific data elements (like email address, phone number and billing/ shipping addresses) and limits the number of transactions that a website can process in a certain time frame (e.g., an hour, a day) using this data.

Why might a merchant want to limit the number of transactions? When a fraudster gets their hands on credit card numbers from the dark web, they might start rapidly testing those numbers on a merchant’s site — looking to see which cards work. If a transaction goes through, the fraudsters often try to max out the card with more (and bigger) purchases.

The effective use of velocity filters relies on a merchant understanding their good customers and knowing how large and how frequent their purchases usually are.

Verified by Visa

Verified by Visa helps ensure the legitimate cardholder is the one making online purchases by working behind the scenes to analyze a customer’s purchase and compare it against usual payment behavior. If customers are using a new device, Verified by Visa may require a second authentication step — either a password or a code sent to the customer’s mobile phone — before the purchase is processed.

This extra layer of security, called 3-D Secure, is the same technology used in MasterCard SecureCode and American Express SafeKey. While the technology helps bolster customer confidence and reduce a merchant’s lost sales, it can’t protect against data breaches and isn’t 100% foolproof.