CNP fraud in brief
Retailers will lose $130 billion in digital CNP fraud between 2018 and 2023*.
Card-not-present fraud is one of the most spread types of fraud in the e-commerce industry.
It occurs online or over the phone when a fraudster makes a transaction with a credit card credentials while not being the owner of a physical card.
As transactions happen without the presence of the card, they are called “card-not-present”.
How do they steal card credentials?
The methods of card credentials theft are not new, and one can say they are effortless.
Usually, credit card credentials are stolen electronically, via the Internet, and most commonly using phishing, skimming, and hacking schemes.
Phishing schemes work through emails, with fake website links, alerts, and urgent alerts.
Hacking requires special tools to obtain customer card information.
It usually occurs through a direct fraud attack on the computer.
Fraudsters who use hacking schemes later on sell card credentials via the darknet.
Skimming also requires tech tools that have direct contact with a credit card. Skimming schemes are used in public places, in ATMs, and card readers on gas stations, mini shops, etc.
The most significant pain of this type of fraud is that cardholders, in most cases, do not even suspect that they are subjected because they still own their physical credit card and have no idea that the credentials can be used by someone else.
How do they stay unnoticed?
Once they’ve obtained credit card data, they try to make everything possible to stay invisible as long as they can and use them in many more payments.
The most popular way is to use card credentials for recurring but small payments of $10-45.
Usually, card owners are not stressed about such small amounts, they are unrecognized and easily masked as something day-to-day.
One more option is to use stolen card credentials for another fraud scheme: bonus (or gift) abuse.
About this type of fraud, we will tell you later.
Another type of digital goods that are regularly bought with CNP is cryptocurrency.
The chances to expose these kinds of purchases are less than 50%.
What are the consequences of CNP fraud?
For customers, it is always about the loss of personal data and money, credit charges, stress.
One of the most dramatic impacts is customer stress and loss of trust in card security.
When it comes to merchants, their risks and costs are hazardous and it all starts with chargebacks increase, chargeback fees, frequent transaction disputes, and a decrease in customer satisfaction, customer lifetime value, brand damage, and revenue loss.
How to detect CNP fraud?
There are visible signs that can tell you about the presence of CNP fraud:
- Larger orders than usually occurring within the user’s credit card history.
- Urgent and many orders within a small amount of time.
- Unusual shipping addresses.
- Recurring small payments.
- One card used for orders with different shipping addresses. Or several cards used for one shipping address.
- Orders made with one card but with several IP addresses, browsers, devices, screen resolutions, etc.
- Fake other account details, like phone numbers, emails, etc.
- Several cases of customer information change.
How to prevent CNP fraud?
Stolen card credentials, of course, is not the primary purpose of a cybercriminal. There are always other goals, like in an account takeover.
- reputation damage,
- bank account takeover,
- credential sales,
- employee emails compromise,
- identity thefts,
- phishing campaigns,
- loyalty programs exploiting.
Covery is a simple combination of tools allowing you to prevent any card-not-present fraud schemes.
Card ID
Card ID generation technology is one of our unique products that helps to spot previously seen credit cards without storing their PAN numbers.
Our secure PCI DSS level 1 storage will make this happen.
Unique Card ID allows to:
- get the reputation of cards on the private, industry, or global scale (inside Trustchain),
- spot the correlation between card users, devices, accounts, identifiers,
- spot countries of card usage with 100% efficiency.
Device Fingerprinting
Device Intelligence technology designed by Covery that collects device data during the user journey at any life cycle point.
Device Fingerprinting detects device emulations of any kind.
Device screening
Combination of Device Fingerprinting with AI risk assessment tool that gives a reputation of the device, its geolocation, and fraud trigger with reason:
- Proxy
- Device emulation
- Browser usage: Tor +
- Installed plugins: AdBlock +
- Not valid country
- and many others
Trustchain
A global knowledge database that stores 300M reputation records of various user identifiers without linking them to each other to protect PII from improper usage according to the GDPR policies.
While using Trustchain business can cut down the number of bots and fraudsters up to 40% having just reputation records of 12 user identifiers:
Email, Card ID, Phone, IP, Email domain, System account ID, Device fingerprint, Device ID, Entity ID, Person ID, IBAN, SWIFT.
Trustchain will detect any email or phone number that was changed in the account and say whether it is good.
Customizable Machine Learning
Supervised Machine Learning that gives unlimited capabilities for creating custom ML models with no development resources.
Machine Learning models quickly notice any inconsistencies in customer behavior and adapt to new schemes.
IP screening
Combines AI risk assessment tool with Trustchain, and shows IP reputation with a specific reason and connected devices.
We’ve already analyzed 5 billion user actions, prevented 80 million bot attacks attempt, and 250 million risky activities.
Covery team has 5+ years of experience in fraud prevention and risk assessment.
Have questions? Contact us.
*According to Juniper Research.