A New Report Shows How the Growth in E-Commerce Is Fueling a Big Rise in CNP Fraud

Despite the percentage of card-not-present fraud transactions steadily hovering in the 10% to 13% range between the first quarter of 2020 and the same period in 2021, the average ticket size for fraudulent CNP transactions has steadily grown during that time, says a report from fraud-prevention platform provider Vesta Corp.

Globally, the average ticket for a fraudulent CNP transaction rose from $126 during 2020’s first quarter to $134 in the first quarter this year. The high-water mark for CNP fraud came during Q4 2020, when the average ticket size totaled $155, suggesting criminals became more aggressive in CNP fraud despite only 10% of transactions being fraudulent, the report says. The lower percentage of attempted fraud was due to the higher volume of overall CNP transactions during the holiday season, Vesta says.

In between, the average ticket for CNP fraud totaled $139 during Q2 2020, then dipped to $108 during Q3, before rising again during Q4. Although the average ticket for CNP fraud declined during Q1 2021 from Q4 2020, the higher average ticket in Q1 2021 compared to Q1 2020 suggests that CNP may become a more expensive problem for merchants in 2021, despite 11% of total transactions being fraudulent, the report says.

The increase in CNP fraud coincides with the explosive growth in e-commerce sales, Vesta says. In 2020, consumers spent $4.28 trillion dollars globally on online purchases, a more than 27% increase. In the United States, e-commerce sales totaled $861 billion in 2020, a 44% increase, the highest annual growth rate in at least two decades, the report notes. 

In the U.S., where Vesta has a large customer base, the average ticket for a fraudulent CNP transaction rose steadily from Q1 2020, hitting its peak during Q3 2020, despite a modest percentage of attempted CNP fraud. During Q1 2020, the average ticket for fraudulent CNP transaction in the U.S. was $169, while only 3% of transactions were fraudulent. During Q3 2020, the average ticket totaled $189, while the percentage of fraudulent transactions remained steady at 3%. The average ticket receded to $149 during Q4 2020, with 4% of transactions fraudulent, then rose to $179 during Q1 2021, while the percentage of fraudulent remained at 4%. 

In comparison, Mexico, another country where Vesta has a large customer base, had a higher percentage of fraudulent CNP transactions than the U.S., but a lower average ticket size. During Q1 2020, the average ticket for CNP fraud in Mexico was $118, with fraud totaling 36% of transactions. The average ticket for CNP fraud in Mexico peaked during Q4 2020 at $155, as the percentage of fraudulent transactions dropped to 18%. While the size of the average ticket for CNP fraud in Mexico dipped during Q1 2021 to $135, the percentage of fraudulent transactions increased to 24%.

“It’s … important to note that Mexico’s e-commerce market is still quite nascent compared to the U.S., so one would expect to see a higher percentage of fraud attempts until the market matures,” the report says.

To gain a better understanding of how operating systems for mobile devices and computers impact CNP fraud, Vesta analyzed the percentage of fraudulent transactions made on the five primary operating systems used to initiate e-commerce transactions—Android, iOS, Linux, OS X, and Windows. Android has the highest percentage of fraudulent transactions—as high as 26% in the first quarter of 2020—but the lowest average dollar amount, ranging from $45 during Q1 2020 to $63 during Q1 2021, suggesting criminals use it frequently for lower-value transactions, the report says. 

The value of fraudulent transactions is highest on OS X and Windows, which range from $128 and $156, respectively during Q1 2020 to $172 and $105, respectively, during Q1 2021. The higher average tickets for fraudulent CNP transactions initiated through OS X and Windows indicates criminals make their most expensive attacks via desktop systems, the report says.