Online Merchants Are Beating Fraud, But the Gains Are Costly, CyberSource Study Reveals

So far, online merchants are winning the battle against fraud, but the gains are coming at a high cost, according to the latest annual fraud study from CyberSource Corp., set for release next week with results for 2015. The progress also comes as card-not-present merchants prepare for an expected onslaught of fraud with the arrival of EMV at the physical point of sale.

Overall, U.S. and Canadian e-commerce merchants are losing 0.7% of revenue to fraud, down a tick from 0.8% in 2012. The reduction in losses is more dramatic with overseas orders, where the fraud rate has plummeted from 1.6% to 0.9%, according to the study, which surveyed 307 merchants accounting for $137 billion in revenue.

While merchants are still mounting and fine-tuning mobile-commerce operations, they are apparently beating fraud even here. The fraud rate for the mobile channel was 0.5% last year, down from 0.9% in 2013 and 1.4% in 2012. This is even better than the performance of Web stores viewed in isolation, where the fraud rate is 0.8%. Some 62% of e-commerce merchants track their fraud losses by channel, CyberSource says.

The weapons these merchants are deploying are far from cutting-edge. The two most popular validation services are address verification and the card-verification number, each cited by 86% of respondents. Methods coming on strong are payor authentication via 3-D Secure, with 23% using it and 20% planning to, and two-factor phone authentication (13% and 15%). However, with increasing sales in the mobile channel, more merchants are adopting IP geolocation tracking (51% using and 13% planning to) and device fingerprinting (32% and 17%).

The success against fraud, though, is coming at a high cost. Twenty-nine percent of all orders are being subjected to manual review, up from 27% in 2013. The majority, 83%, of merchants conduct these reviews, but the proportion of orders sent to review is highest (41%) among the smallest merchants, those with $5 million or less in annual revenue.

This process, which involves setting aside suspicious transactions for expert checking, slows down the transaction flow and adds substantial cost. For 46% of the respondents, manual review is the biggest part of their fraud-management budget, while 68% expect their budget to either remain flat or decrease this year, according to the report. At the same time, merchants are likely doing too much manual review. Merchants reported accepting 82% of orders after the review, an indication that “more orders are being reviewed than is strictly necessary,” says the report.

Other costs involve so-called false positives, as more good orders are likely being rejected, the study indicates. Order-rejection rates overall were up in 2015, to 2.8%, from 2.3% in 2013. CyberSource says most merchants surveyed estimate that up to 10% of these rejected orders are false positives, or good orders that simply looked fishy. “False positives result in immediate lost sales,” CyberSource says in its report. “They can also impact customer loyalty, retention, and sales in the future.”

CyberSource, which was acquired by Visa Inc. in 2010, conducted its survey in October and November. The canvass involved both clients and non-clients of the company, which specializes in fraud-management tools for e-commerce merchants.