Online payment fraud approaching rate for stores, study says

48% of online retailers say they their chargebacks for fraudulent purchase transactions is less than 0.1% of sales, matching the card-present chargeback rate experienced in physical stores, the Merchant Risk Council reports in its Fifth Annual Survey.

But criminals continue to pose an increasing challenge for merchants, and one-third of retailers experienced a fraud spike within the past 12 months that increase their fraud rate by 100% or more, the study says.

Guide to E-Commerce Technology

The problem for these merchants is that they fail to take steps to stay ahead of criminals who figured out how to get by merchants’ security measures, says Julie Fergerson, vice president of emerging technologies at security company Debix Inc. and a member of the board of the Merchant Risk Council. “Many retailers are aware of and have deployed new security technology and techniques, but the devil is in the details,” Fergerson says. “Once a month, somebody at a retailer should be looking at overall data and trends, and making sure everything is good,” she says.

For example, one recent trend among criminals is to steal nearly complete information on legitimate credit card accounts, making it difficult to detect a fraudulent transaction until after it’s been completed.

But because criminals will often re-use one particular account attribute, such as an IP address, in multiple fraudulent transactions, retailers can use security software that identifies whenever a single account attribute is appearing frequently in orders. The attribute criminals choose to re-use, however, can change. “But some retailers only configure their system to check for one attribute, when they should check for several,” Fergerson says.

New software and techniques now being developed to enable merchants to simultaneously check for the frequent re-use of account attributes, identify the source location of transactions through geolocation technology, and better compare the addresses tied to potentially fraudulent transactions with authentic addresses in customer databases, Fergerson says.