After Years of Retreat, Payments Fraud Comes Roaring Back

For years, the wave of fraud receded like an outgoing tide for companies that accepted electronic payments from consumers and other businesses. But last year, a tidal wave crashed on shore.

Fully 73% of companies reported they had suffered actual or attempted payments fraud in 2015, up 11 percentage points from 2014 and 13 points from 2013, according to the latest annual survey released last month by the Association for Financial Professionals Inc.

As it does every year, the Bethesda, Md.-based AFP surveyed its members on their experience with fraud via checks, cards, wire transfers, automated clearing house transfers, and other payment methods. This year, the January survey yielded 627 responses from members across a wide range of industries and company sizes.

Between 2009 and 2013, the actual and attempted fraud rate had slid from 73% of reporting members to 60%, then ticked up in 2014. The results for 2015, with fraud back at 2009 levels, show that uptick was an ominous sign. “We’ve seen a trend break here,” says Magnus Carlsson, the AFP’s manager for treasury and payments. “I think [our members] are surprised to see such a large increase in one year. That is a big surprise.”

Even the AFP report itself is blunt about the matter. “In last year’s 2015 AFP Payments Fraud and Control Survey Report [documenting 2014], we noted that the downward trend of payments fraud reversed, although by just a few percentage points. The situation has since deteriorated further,” says the report.

Still, while fraud rates took off, actual dollar losses remain muted. A solid majority—72%—of companies that sustained fraud exposure reported no actual losses at all, while another 14% reported actual losses totaling less than $25,000. In contrast to fraud exposure, “actual losses are quite different,” says Carlsson. Similarly, 49% reported no costs to manage, defend against, or clean up after actual or attempted fraud, while another 35% spent less than $25,000.

The study also found fewer organizations reporting an expected impact from the move to EMV chip cards, as indicated by investment in software, hardware, and training, as well as fraud losses after the liability shift. That shift took place in October and placed responsibility for counterfeit card losses on the shoulders of merchants that couldn’t accept EMV cards. In the 2013 survey, just 11% reported they expected “no impact,” but by January, three months after the shift, that number had risen to 35%.

Delays in getting hardware and software certified for EMV, which have frustrated many merchants and have already led to a federal class-action suit, are a separate matter. “Obviously, that’s an issue,” notes Carlsson. “I can understand the frustration.”

While checks remain the payment method most targeted by criminals, it’s fraudulent wire transfers fueled by an explosion in highly sophisticated phishing attacks that have spiraled upward in recent years, according to the report.

In 2009, just 3% of companies that had experienced actual or attempted fraud reported they had been hit by wire fraud. Last year, that rate was 48%, leaving fraudulent wires ahead of fraud on corporate and commercial credit and debit cards (39%). The check-fraud rate, meanwhile, was 71% in 2015, but that’s actually down from the high of 93% in 2010.

Actual and attempted fraud on ACH credits (11%) and debits (25%) remain low and stable relative to the other payment methods surveyed.

The AFP membership comprises corporate finance executives worldwide.

—John Stewart