Seth Ruden, Sr. Fraud Consultant, Payment Risk Solutions for ACI Worldwide, is a Certified Fraud Examiner and Certified Anti-Money Laundering Specialist and has been working with banks in the detection and mitigation of financial crimes since 2004, in the compliance department of one of the largest global banks. Since then, he has worked with Law Enforcement, Regulators, Executives and Analysts in consulting positions beyond the United States, extending to financial services organizations in Asia, the Middle East and North and South America.

Banking/Finance/Insurance / Identity Management

Return of the Lost and Stolen: Authenticating Wearables

April 24, 2018

Seth Ruden Sr.

A couple years ago, I penned a blog post to commend the Canadians on what made their culture so resilient to fraud that it developed the lowest fraud rates in the Northern Hemisphere. This time, I would like to bring awareness back to Canada about a potential threat as it relates to the increasingly popular “Tap” payment channel. As smartphones and wearable devices continue their exponential growth in Canada and globally – it’s expected to be worth $34 billion by 2020 – Canadians will need to be wary of this convenient card-based (or alternative NFC wearable device) service.

‘Tap’ payment allows Canadians to casually pay for smaller transactions using their devices without attempting a more involved and, yes, ultimately more secure Chip and PIN transaction. However, a fraud type we had almost exhausted in recent years, known as “Lost and Stolen,” could become a resurgent threat. Lost and Stolen had been considered marginalized as a fraud type by a menacing brother fraud concept: Counterfeit. The fraud on counterfeited cards, which is exposed at merchants through skimming events, became the most significant threat experienced by most consumers and was the prevailing problem that Canada had largely pushed beyond the border.

As wearable payment devices and friction-free (sans PIN) authentication options continue to proliferate in the Great White North, however, Lost and Stolen will become an increasing prevalent fraud typology affecting issuers.

Perhaps it’s Canada’s own success at bringing debit card fraud to such a low rate that has resulted in consumers’ over-weighted sense of security, convenience and a habituation with their primary consumer payment device, the humble EMV Chip and its PIN companion. However, the initial path that brought Canada here was the dedication to deploying EMV’s cryptographic technology with significant enforcement, which mandated a PIN with the transaction. Relaxing the effective authentication controls for the Tap product means that transactions below a threshold amount, typically less than $200, does not require a PIN, and the card or wearable NFC device itself is enough to authorize a transaction at a merchant’s point of sale. The residual here is that it’s not the size of fraudulent transactions, it’s the frequency of them, and residual counterfeit cases are now a mere fraction of Lost and Stolen counts.

Cards and wearable payment technologies are frequently, and all too casually, left accessible to those who seek to abuse them. Payment devices must be guarded just as much as a physical wallet that contains debit and credit cards. When consumers leave payment devices in unlocked parked cars or on open desks at work without sufficient physical security, it creates an opening for opportunistic fraudsters, where simple car prowlers in the neighborhood can become entry-level fraudsters.

Again, there is a ceiling on the amounts that reduce risk, but the inconvenience of having one’s card lost, filing a fraud case, and replacing the card can be a stressful event that reduces confidence in electronic payments and, more importantly, trust in their providers. In the larger picture, the behavior we are seeking to reduce and bring awareness to is easy to remedy: focus consumer behavior on continuing to treat plastic cards and NFC devices like the payment products they are and not as purely attractive accessories. Create programs to bring awareness to secure them, increase authentication requirements to two factors in every transaction, or consider significantly lowering the amount threshold for PIN requirements – perhaps even aligning this standard with PSD2’s €50-per-transaction threshold across the pond.

Part of Canada’s notable achievement in reducing card fraud and creating a culture of awareness was an altruistic commitment to protecting its citizens and financial ecosystem, which is truly admirable. This year, for fraud awareness month, I implore all stakeholders in Canadian payments to take steps to continue eradicating all fraud types, including those we once thought were behind us.

I’ll be presenting on this topic and many more like it at the 2018 ACI Exchange Conference in Denver… hope to see you in May!

Locations that were once considered safe havens such as schools, places of worship and healthcare institutions are no longer immune to acts of violence, and that includes healthcare, such as hospitals, emergency rooms, and facilities that provide healthcare outside of a hospital environment.