When It Comes to Online Security, It’s All About the Money

Data Insecurity
Part 6
The electronic payments industry's continued prowess in holding fraud in check despite the mounting scourges afflicting online transacting is all the more remarkable when you consider that the banking industry, whose fundamental business is risk management, is largely a no-show in this channel. Merchants and their security providers have managed to hold electronic crooks at bay along the front lines of the Internet security wars. But they still aren't getting the help they really need?which is better economics. To be sure, Internet fraud is still a growing threat. The sophistication of electronic attacks is relentless and scary, what with new Trojan Horse viruses surfacing that are capable of automatically learning when they are being detected and shifting how they compromise credentials in order to evade further monitoring. And the proliferation of Internet-based business scams is aided in no small way by the ability of thieves to recruit their “mules”–needed for transshipping goods procured with stolen credentials–from the nation's naïve and lovelorn, who offer assistance in return for promises of a quick buck or a hot date. So it's hats off to all those who, according to CyberSource's annual surveys on online fraud, have been able to keep the lid on fraud losses to just over 1% of sales volume. Yes, absolute dollars of fraud have been rising, along with transaction volume. But at a fraud rate of 1.4% in 2006, against an estimated $215 billion in sales, the industry deserves a big pat on the back. Or, at least parts of the industry do. Big Internet merchants, such as Amazon and eBay, have refined online risk management techniques to an art. They report fraud and net chargeback rates in the neighborhood of 20-40 basis points of sales volume?a performance that rivals or beats that of most face-to-face retailers. Yet, because the card companies decreed at the outset of electronic commerce that merchants are responsible for card-not-present fraud, these successes come at enormous costs to e-retailers. Ebay's PayPal processing unit, for example, has a staff of more than 2,000 laboring around the clock to stay ahead of the fraudsters. Some researchers estimate that $3 billion to $5 billion will be spent this year by retailers just to prevent fraud, including manually reviewing questionable transactions, blocking good orders to avoid bad ones, and the like. On top of that, online merchants incur the 1.4% losses to both true fraud and the so-called friendly fraud of repudiated transactions. Let's see?that's $3 billion more. Then there's the interchange/processor fee kicker. Card issuers, who bear relatively little of the heavy lifting in terms of security in this channel, get roughly 2% in interchange from the larger merchants. That's about 80% of the full merchant discount rate. Add in 15% for processor/acquirer fees, and 5% for the networks, and you've got an average purchase costing 2.5% of the ticket price. Another $6 billion or so hit to the merchants. Higher processing fees and markups from independent sales organizations for smaller e-retailers add another $3 billion to $4 billion to the tab. Here's how. Smaller merchants, without the resources and negotiating power of the big guys, typically incur both much higher rates of fraud and chargebacks. Some eat their chargebacks to stay under Visa and MasterCard ceilings, and to avoid fees that can range up to $125?far more than the purchase itself. But there's more. One high-growth, profitable, and nearly chargeback-free Internet merchant in the Northeast recently asked his ISO why card costs were rising so fast?even faster than volume growth. It turns out his ISO was reporting 40% transaction downgrades, which charged out at 4% instead of the standard 2.4%. When the merchant asked for proof of the downgrade incidents, and threatened to go to a processor directly, the ISO quickly lowered the downgrade rate to 3.2%, and promised to work on the incidents. Add all these costs up, and you've got about $18 billion, or more than 8% of the total dollar volume?just to get paid with signature cards! That compares to a typical operating margin of 10% for larger e-retailers, and half that for smaller ones. Or, to look at it another way, a large online merchant has the potential to nearly double his margin if he can figure out how to get paid with something more cost- and risk-effective than credit and signature-debit cards. . The card companies have addressed this enormous burden with largely unproductive measures. The 3D-secure protocol saves a bit of interchange and returns the risk of using signature cards to the issuers (where it logically should be), but even Visa forecasts it will address no more than 10% of transactions when fully manifested in the next few years. Meanwhile, zero-liability programs give a blank check to consumers to continue to repudiate just about any online transaction they care to?a cost borne by the merchants. On top of that, compliance with the Payment Card Industry data-security standard will remove one of the key tools online merchants use to fight fraud?a directory of card numbers onsite. So it's no wonder the eCommerce marketplace is so interested in alternative payments that require registration of known customers and guarantee payments. Unfortunately, most of the providers of these new payment types propose to do their transactions at 1.5% to 2% of the ticket price. They figure, with some justification, that reducing the losses and relative costs of risk prevention in the back office is incentive enough for merchants to adopt their products. But online merchants are not so sure. One leading online travel Web site executive said recently, “We acknowledge that there will be efficiencies in the back room with some of the alternatives,” he said. “But I need something substantial in the way of savings upfront in order to get a place in my IT queue. Otherwise, we'll never get started down that road.” As always, data security comes down to economic value. When, oh when, will the industry figure that one out? —Steve Mott