Corporate Treasurers Report a Rise in Attempted Wire-Transfer Fraud; Favor Chip-and-PIN

A near-doubling of attempted wire-transfer fraud and strong corporate support for the chip-and-PIN variety of EMV card payments are among the highlights of the latest payments-fraud study from the Association for Financial Professionals.

The recently released study by the Bethesda, Md.-based AFP, an association of corporate treasury managers and finance executives, is one of the most comprehensive annual looks at payments fraud. The January survey garnered 741 responses and covered the year 2014. Some 62% of the responding companies said they were targets of attempted or actual payment fraud last year, up from 60% in 2013 but well off the 73% peak in 2009.

Checks remain fraudsters’ favorite vehicle for payment theft, with 77% of targeted companies reporting they were victims of check fraud. But 27% of organizations hit with attempted or actual fraud said their companies experienced wire-transfer fraud last year, up from 14% in 2013.

The survey didn’t go deeply into the reasons fraudsters choose their particular methods, but criminals “are asking for wire because wire is fast,” Magnus Carlsson, the AFP’s manager for treasury and payments, tells Digital Transactions News.

Wire-transfer fraud often is preceded by so-called phishing emails, many purportedly from a company’s chief executive or the chief financial officer, that look legitimate and attempt to get a lower-level employee to transfer money out of the company. The quality of these spoofed messages is getting better, making them look more authentic, according to Carlsson. Many such emails ask for more than just payment information as part of fraudsters’ efforts to build profiles on targeted people and companies.

“They’re looking for profiles … it’s much broader than finding out the payment-related information such as bank-account numbers,” says Carlsson.

While the general media have focused considerable attention on consumer payment-card fraud since Target Corp.’s huge data breach in late 2013, criminals are devoting less attention to commercial and corporate credit and debit cards. Thirty-four percent of the AFP’s respondents said they experienced attempted or actual card fraud in 2014, down from 43% in 2013.

Less than a third of corporations hit by attempted payment fraud actually sustained a financial loss last year. Some 70% of targeted organizations “did not incur actual losses from the attempt,” the AFP’s report says. Eighteen percent realized a financial loss of less than $25,000 while 4% of reporting organizations sustained losses in excess of $250,000. Larger companies with a greater number of payment accounts were more likely to have experienced losses.

Checks accounted for 45% of losses, with corporate cards next at 25%, wire transfers at 20%, and automated clearing house debits at 7%. Some 2% of losses came through corporate debit cards and 1% from ACH credits.

Meanwhile, an overwhelming majority of the AFP’s respondents, 92%, believe EMV chip cards will be effective in reducing point-of-sale fraud. And 61% believe that the chip-and-PIN variety of EMV, in which a chip card holder is asked to enter a PIN, would be the most effective authentication method for mitigating credit and debit card fraud.

PIN-based chip payments are a hot issue in the card industry. Many credit card issuers favor so-called chip-and-signature authentication because U.S. credit card holders today do not enter PINs with their traditional magnetic-stripe cards, though issuers tend to support chip-and-PIN for debit cards. But retailer trade groups are saying that the coming U.S. conversion to EMV is the right time to add PIN authentication to all cards.

Only 7% of the AFP’s survey respondents favor chip-and-signature as the most effective choice for preventing fraud and providing for a better customer experience, though 13% will take any form of EMV and 12% favor “chip-and-choice,” in which the merchant can choose between chip or signature authentication. The AFP itself favors chip-and-PIN because of its expected fraud-reduction capabilities, says Carlsson. He believes reduced fraud will be worth the expenditure, through he acknowledges the chip-and-signature supporters’ arguments. “It takes more investment by banks to get the chip-and-PIN functionality, we understand that,” he says.

The fraud study, the AFP’s 11th such survey, was sponsored by JPMorgan Chase & Co. The AFP plans to issue security guidelines for payments managers in mid-April, Carlsson says.