New Study Documents the Outsize Fraud Exposure from Mobile Payments

Even though merchants accepting mobile payments are in the minority and mobile-payment volume is low, losses from fraud incidents for those merchants are higher than for non-mobile-accepting merchants, according to the fourth annual “LexisNexis True Cost of Fraud” study sponsored by content provider LexisNexis Risk Solutions and conducted by Javelin Strategy & Research.

The study tries to quantify retailers’ acknowledged fraud losses in addition to resulting costs for replacing or redistributing their lost or stolen goods, fraudulent transactions for which the company was held responsible, and any fees or interest they paid to financial institutions as a result of fraud. The study’s data came from 1,030 fraud-control executives surveyed online in May and included representatives from companies of various sizes and industry segments.

Only 6% of responding merchants accept mobile payment, up from 4% last year, the study found.

But the fraud multiplier among mobile merchants spiked this year, increasing to 2.8 from 2.0 in 2011 and 2.4 in 2010. This year, mobile-accepting merchants paid $2.83 per dollar lost, a 40% increase from 2011, when they paid $2 in total expenses for every $1 lost to fraudulent transactions.

In comparison, the multiplier for all merchants increased to $2.70 in costs for each $1 of fraud, up from $2.30 in 2011. The study attributed the overall increase to factors such as lost and stolen merchandise.

So-called friendly fraud may be emerging as a key fraud type in the mobile channel, accounting for 26% of fraud versus 20% for non-mobile merchants. Mobile merchants reported “identity theft” or unauthorized transactions accounted for 24% versus 19% for non-mobile; fraudulent requests for returns/refunds at 21% for mobile versus 20% for non-mobile; and 28% for lost or stolen merchandise versus 35% for non-mobile.

Researchers believe the increases show criminals are shifting more attention to merchants that use a broader array of sales interaction methods. Because mobile payments are still in an early stage and volume is low, the study measures the impact of fraud on mobile-accepting merchants based on their overall fraud pattern once they start accepting mobile payments, says Jim Van Dyke, president and founder of Pleasanton, Calif.-based Javelin.

“The research was very conclusive in finding that once you become a merchant who accepts payments by mobile, whether or not you have a lot of payments that actually go through mobile, you become a merchant who has a higher fraud rate,” Van Dyke says. “It’s not because of the volume of mobile payments.”

By seeking to get more revenue by opening new channels and payment methods, merchants open themselves to more fraud, Van Dyke says. “That is really because of the complexity factor,” he says. “You’re now managing more ways people can buy from you and so doing things like verifying identity gets to be just that much more complex.”

The diversity of mobile devices and operating systems, plus the variety of methods used for m-commerce and m-payments (browsers, apps, text messaging, and near-field communications), pose challenges for the industry, the study found. Most merchants that accept mobile payments do so through browsers, with mobile applications the second most popular acceptance method.

Another factor contributing to the higher risk of fraud is that while merchants consider the new revenues and customers that can be generated by mobile, they don’t necessarily consider the possible increase in fraud, says Jim Rice, director of market planning for LexisNexis.

The study found that while 37% of merchants expect some or significant impact on their business strategy as a result of mobile commerce and payments, only 2% said they were concerned about mobile security.

“In mobile, there are a lot of retailers looking at it as a great way to drive sales, to reach their customers, but they’re not necessarily thinking about what fraud strategy do I need to have in place before I launch into mobile,” Rice says.

Sixty-one percent of responding merchants viewed mobile payments via mobile apps as the least risky method, followed by the mobile Web browser (52%), bill to mobile phone (37%), mobile contactless purchases (28%), and text (22%).

Despite the increase in the multiplier for mobile-accepting merchants, last year they prevented almost 2.5 times as many fraudulent transactions as were successfully completed at their respective companies. Non-mobile-accepting merchants prevented less than 10% more fraudulent transactions than were completed, according to the study. That suggests mobile-accepting merchants are more sophisticated at fraud mitigation, even if more criminals still eventually succeed with them, researchers say.

Mobile-accepting merchants also are more likely to see fraud as an issue of revenue and customer retention, the study found. Although mobile merchants are more likely to take a fatalistic attitude towards fraud (63% agree that fraud is inevitable versus 55% of non-mobile-accepting merchants), mobile-accepting merchants are more likely to believe lower fraud rates will increase customer loyalty (55% versus 42%) and to agree that reducing fraud will help increase sales (66% versus 52%).