Digital Transactions Authoritative, insightful and timely information for payments professionals
By John Stewart
@DTPaymentNews
Online merchants are dreading an onslaught of fraud, but what they should really brace for is a much bigger problem: so-called false positives, or honest transactions declined because of overly sensitive fraud detection. For these merchants, the dollars lost to false declines dwarf actual fraud losses, and that somber toll is only going to get worse as e-commerce expands, experts predict.
“It’s a freighted issue. The tide is just going up,” Tom Byrnes, chief marketing officer at Vesta Corp., a Portland, Ore.-based provider of fraud solutions for card-not-present merchants, tells Digital Transactions News.
This is bad news not only because merchants lose revenue unnecessarily on each decline, but also because many of these good customers won’t come back. “People get angry, and that can have residual brand damage,” says Byrnes.
While actual fraud losses amount to about 7% of the total cost of fraud and fraud management in the e-commerce business, dollars lost to false positives total 19%, according to a study released this week by Javelin Strategy & Research with backing by Vesta. Fraud-fighting tools and personnel account for the remaining 74%.
Altogether, costs attributed to chargebacks, false positives, and fraud management are eating up 7.6% of total e-commerce revenue, the study concludes. False positives alone account for 2.8% of that revenue, according to the research, which canvassed 500 e-commerce merchants taking in $1 million or more annually. By contrast, the toll from chargebacks amounts to 0.52%.
The false-decline problem plagues all online sellers, but digital-content merchants are especially vulnerable because of the need to send product out the door to buyers instantaneously. While the study found that 25% of all declines for physical-good sales were false positives, the corresponding number for digital-goods merchants is 34%.
Ironically, as online fraud increases with growing overall sales volume, the very filters merchants use to sniff out fraud are likely to spark yet more false positives. That’s because merchants react by making those filters more sensitive to suspected fraud characteristics and patterns. “Merchants are much more sensitive. They’re tightening their rules, which makes false positives spike,” says Byrnes, referring to what Vesta and Javelin learned. “With digital goods, it’s even worse. We saw [with these merchants] that if there’s any question, just deny the transaction. That was a very prevailing attitude.”
Nor are all that many merchants using advanced fraud-fighting tools that might leave the door open to legitimate customers. While criminals have harvested a rich crop of user credentials from multiple data breaches, 65% of online sellers rely on user names and passwords to authenticate customers, according to the Javelin study. By contrast, fewer use such techniques as two-factor authentication (40%), geolocation (30%), and device reputation (22%).
At the same time, the rollout of chip cards in the U.S. has made in-store fraud more challenging and rendered online stores a more tempting target for fraudsters.
That picture could change with the release this week of a new, more advanced version of 3-D Secure, an online authentication routine originally introduced 15 years ago. The new version, which comes from EMVCo, the standards body controlled by the global card brands, will work in-app as well as within browser-based shopping sessions and eschews the clunky pop-up screens for password entry the older specification required.
But for now, merchants may well have to resign themselves to a more costly environment to control fraud without driving away good customers. “You’ve got to start adding advanced tools, and that’s not only [capital expense], it’s also [operating expense] because you have to hire people to keep the tools tuned,” says Byrnes. “The tools are dynamic, not static.”
