Debit Card Issuers Struggle With Higher Fraud on Both Signature and PIN Transactions

By Jim Daly
@DTPaymentNews

Partly because of a big increase in skimming, debit card fraud rates jumped in 2015 on both signature and PIN-based point-of-sale transactions, according to the 2016 Debit Issuer Study commissioned by Discover Financial Services’ Pulse electronic funds transfer network.

The overall fraud-loss rate on PIN POS transactions jumped to 0.8 cents per transaction in 2015, approximately a three-fold increase from 0.3 cents in 2014, according to the study’s findings released Tuesday. On non-PIN POS transactions, most of which are signature-authenticated, the fraud rate increased from 2.2 cents per transaction to 2.6 cents. Expressed another way, fraud losses per active debit card jumped to $5 last year from $3.50 in 2014, according to Oliver Wyman, the New York City-based consulting and research firm that Pulse commissioned to do the study.

Seventy-two banks, both large and small, as well as credit unions participated in Pulse’s 11th yearly survey of the debit market. The financial institutions collectively issue 153 million debit cards generating 48% of U.S. debit transactions, and operate 77,000 ATMs.

Higher losses came at a time when the sources of debit card fraud are shifting. Mass debit breaches accounted for only 33% of 2015’s losses, down from 57% in 2014. But skimming almost tripled to account for 20% of total losses in 2015, up from 7% the year before.

Tony Hayes, an Oliver Wyman partner in Boston who co-led the study, says financial-institution executives have their suspicions about why skimming losses boomed, but there’s no definitive answer. “I’m not sure that any FI knows for sure,” he tells Digital Transactions News.

One theory is that criminals using skimmers that capture magnetic-stripe card data are working harder because their window is closing as more-secure EMV chip cards displace the old mag-stripe cards. “The ability to skim is going to be less and less,” says Hayes.

Nor is there a single answer as to why overall fraud increased. One culprit could be that the proliferation of debit card transaction types—from the old PIN versus signature dichotomy to seven iterations within single- and dual-message transaction types—is confounding issuers’ risk-control systems, causing them to flag fewer suspect transactions, according to Hayes.

In addition, some issuers have eased up on debit authorization declines to avoid angering legitimate cardholders, Hayes says. Consumers usually can whip out another credit card if the first one is declined during an in-store purchase, but they carry fewer debit cards, he notes. “Some FIs found if you decline a [debit] transaction for suspected fraud and you made a mistake…then the good customers are irritated and there’s a pretty real risk they’ll close their accounts,” says Hayes.

The study found that 15% of 2015’s fraud losses came from “other,” which issuers typically define as Internet and other forms of card-not-present fraud, up from 11% in 2014. And lost-and-stolen card fraud accounted for 17% of losses versus 12% in 2014.

New payments technology eventually should reduce fraud rates, according to Jim Lerdal, vice president of fraud operations at Pulse. “Issuers expect that broader adoption of chip cards, and the tokenization of transaction data that is tied to mobile payments, will help to mitigate against losses resulting from debit card fraud in the future,” Lerdal said in a statement.

Regarding EMV, the study found that 45% of debit card issuers had begun issuing chip cards by 2015’s fourth quarter, much lower than the 90% last year’s study had predicted. A third of U.S. debit cards were chip-enabled at the end of 2015, but the study predicts that 76% of cards will have a chip by the end of this year. Only 4% of debit transactions last year involved a chip debit card read by an EMV terminal.

The average debit card user makes 22.1 transactions per month, but not many of them are linked to mobile payments, even though two-thirds of issuers had cards eligible to be loaded into the major mobile wallets. Apple Inc.’s Apple Pay dominates, with 3.5% of eligible debit cards loaded compared with 0.2% each for Samsung Pay and Android Pay. Cardholders, however, used the latter two services more in January 2016—1.8 and 1.7 times per enrolled card for Samsung Pay and Android Pay, respectively, compared with 0.7 transactions for Apple Pay.

In all, Pulse says users of the “Pays” generated about 8 million transactions that month. But 46% of issuers expect 25% or more of debit transactions will migrate to the mobile channel over the next five years.

In another finding, the study says the average blended interchange rate for issuers exempt from the interchange controls imposed by the Dodd-Frank Act’s Durbin Amendment—those with fewer than $10 billion in assets—was 39 cents in 2015, down from 40 cents in 2014. According to Hayes, this decline “was the result of lower rates delivered by both single-message and dual-message networks.” (In dual messaging, the clearing and settlement message comes after authorization and is common in signature debit, whereas PIN debit traditionally used a single-message format for both functions.) The blended rate for regulated issuers was 24 cents last year.