‘Historically Very Secure,’ PIN Debit Loses Some of Its Luster As Net Fraud Losses Rise

By John Stewart
@DTPaymentNews

Debit card transactions with PIN authentication have historically been seen as the most secure form of payment available, but lately some experts have had cause to wonder. In fact, while credit card fraud losses are declining, losses on PIN debit transactions for payment and at ATMs are rising quickly, according to the results of a survey of card issuers released this week by First Annapolis Consulting, Annapolis, Md.

The consulting firm’s research, in which it surveyed seven credit card issuers and eight issuers of debit cards (some institutions issue both), indicates net fraud losses as a fraction of total dollar volume rose to 7.3 basis points on average in the first quarter for PIN debit, compared to 5.9 basis points for all of 2015. The highest reported fraud rate was 21.2 basis points, up from 15.9 last year. (A basis point is one one-hundredth of a percentage point).

Signature-debit net losses also went up, though not as sharply, coming in at 7.6 basis points on average for the first quarter versus 6.9 points for 2015. The highest reported loss rate in the quarter hit 15.3 points, up from 12.1 last year.

The sharp rise in PIN debit fraud in particular startled the First Annapolis researchers, who have been conducting the study since 2012. “One thing that jumped out at me was the range of losses on the debit side,” Casey Merolla, a senior manager at First Annapolis who worked on the study, tells Digital Transactions News. “Some are up in the teens and twenties [in basis points], which is very high.” She was particularly startled by the PIN-debit loss rate. “It was the overall losses we saw on the PIN and ATM side, which has historically been very secure,” she says. “Even the 5.9 points [average for 2015] was pretty high, but 7.3 points [for the first-quarter average] is really high.”

Meanwhile, credit card fraud losses dipped from an average last year of 13.8 basis points of volume to 12.4 for the first quarter. The highest reported rate slid from 20.2 to 18.7 points.

Merolla sees the nationwide movement to the EMV chip card standard as one cause for both the rise in debit fraud losses and the drop in credit card losses. Starting Oct. 1, 2015, U.S. issuers could transfer liability for counterfeit card fraud to merchants that aren’t equipped to accept chip cards. That has contributed to the lower actual net loss rate for issuers on credit card transactions, Merolla says, pointing to the fact that the gross credit card fraud reported by the issuers in the study—the fraud rate before recoveries—rose from 21.2 basis points last year to 24.5 points in the first quarter.

At the same time, issuers have been slower to convert debit cards to EMV, and an important liability-shift date for EMV at U.S. ATMs arrived only days ago. By the end of the second quarter, the surveyed issuers had switched 88% of their active credit cards to EMV, but just 43% of their active debit cards.

A dramatic rise in ATM skimming is also contributing to the rise in debit fraud, Merolla says. Fraudsters use skimmers to collect PINs as unsuspecting cardholders enter them at ATMs. She also conjectures that the increasing popularity of PINless debit processing at many EFT networks may be fueling some of the increase in debit-fraud losses. With PINless debit, transactions under an established ticket ceiling may be processed on PIN-transaction rails but without a PIN. “I suspect PINless debit is driving this,” she says. “It’s a hypothesis. The banks don’t have a lot of detail.”

While PINless debit has been around for years for certain bill-pay applications, only recently have networks expanded it to other types of transactions. “Probably in the last 12 to 18 months it has really started to take off,” Merolla says.

As for the types of fraud losses the researchers found, counterfeit cards at the point of sale accounted for about half of the toll. Card-not-present (CNP) fraud was responsible for 40%, and other types of fraud, including lost-and-stolen cards, drove the remaining 10%.

Merolla says the CNP share has been fairly steady over the course of the survey series, but that will soon change. “Certainly as a percentage of the total, we expect it to increase,” she says, as the move to EMV drives more fraudsters to the less-protected online market while reducing counterfeit losses at the point of sale.