Stakeholders by Susan Burns, George R. S. Weir, Department of Computer and Information Sciences, University of Strathclyde and Associates, Glasgow G1 1XH, UK
Although cardholders are usually the focus of concern in matters of card fraud, there
are other stakeholders in the establishment, use and maintenance of smartcards. These
stakeholders are (1) cardholders; (2) merchants; (3) Acquirers; and each of these has
roles, responsibilities and risks in operation of the card system.
Research indicates that we can all do more to defeat criminals, particularly where
basic security measures are involved. Statistics, such as the following [8], are particularly
alarming and highlight the need for cardholders to be aware of the risk and impact
if they fail to protect their PIN number and card details:
• 25% of all UK residents have disclosed their PIN to someone else, exposing them
to heightened risk of fraud and potentially making them liable for any card fraud
losses they may suffer;
• 27% of Britons use the same PIN for all their cards and the average adult has four
cards each;
• 44% of people still allow their cards out of their sight (in restaurants and bars for
example) when settling a bill;
• 51% of online shoppers do not fully appreciate that the start of a website address
changes from ‘http’ to ‘https’ when they enter a website made secure for purchasing.
The key recommendation for cardholders is that they should be security conscious
and take all practical precautions when undertaking a card payment. Cardholder
complacency is still a large factor in card fraud levels. While card issuers are unlikely
to acknowledge vulnerabilities, in order to avoid adverse reputational impacts, increased
cardholder awareness of the risks and impacts associated with known vulnerabilities
in the Chip and PIN system, will ensure that they become less complacent.
The large variety of card terminals makes it difficult for a cardholder to identify
one that has been tampered with, but there are other ways they can notice fraudulent
actions, for example by being familiar with merchant best practices. This would allow
them to raise alarms with other staff members if suspicious behaviour is observed,
e.g., swiping a card prior to inserting it into a card terminal or watching a PIN
being entered. Cardholders should also check their credit card and current account
statements to identify any illicit transactions. One measure to limit exposure for a
debit card linked to a current account is to establish a second account containing a
smaller balance for use in card transactions.
Stakeholders by Susan Burns, George R. S. Weir, Department of Computer and Information Sciences, University of Strathclyde and Associates, Glasgow. The agreements which merchants have with their acquirers spell out the terms under
which they can accept card payments. The terminals supplied by the acquirers determine
floor limits and undertake the Chip and PIN authorisation process. Vulnerabilities
exist when fraudsters have access to terminals and so merchants should seek
to address and improve staff awareness of process vulnerabilities that could lead to
card fraud through training. Staff should be trained in card transaction processes and
be empowered to request additional authorisation via a Code 10 call where they deem
necessary and know how to do this without putting themselves at risk.
Stakeholders by Susan Burns, George R. S. Weir, Department of Computer and Information Sciences, University of Strathclyde and Associates, Glasgow. Merchants must also be alert to the fact that they are a prime target for fraudsters.
Smartcard Scam: Stakeholders – University of Strathclyde and Associates. They have a responsibility to be vigilant and monitor transactions and any suspicious
staff activities. References should be checked when hiring new staff. Systems holding
customer and transaction data must be adequately protected. Any concerns raised
by customers about staff undertaking card transactions should be investigated. Card
present merchants have various ways of reading and processing card details e.g. staff
inserts card, cardholder inserts card or card is swiped and this can make it difficult for
cardholders to know what would constitute a suspicious action by a member of staff.
Acquirer guidelines should be followed to minimise the risk of chargeback for
both card present and CNP transactions. The planned rollout of ‘contactless’ cards in
the UK towards the end of 2007 may introduce further concerns for merchants as only
one in three low value transactions would be flagged for verification by PIN. For a
CNP merchant there are specific challenges as Chip and PIN is not currently an option
for this type of transaction and it is an area where card fraud has risen significantly.
The Address Verification System (AVS) allows retailers to verify the billing address
supplied with that associated with the cardholder and Card Security Code (CSC)
allows retailers to cross check a special security code held on the back of the card.
Card schemes are also introducing positive identification measures such as Verified
by Visa and MasterCard Secure Code to help merchants. Merchants should protect
themselves against chargeback’s by introducing these measures for on-line transactions.
By 30th June 2007, all CNP merchants must have introduced this measure or at
least have a plan in place to do so. Chargeback of disputed transactions is likely for
any non-compliant merchants.
Smartcard Scam: Stakeholders – University of Strathclyde and Associates. The acquirer or merchant acquirer is the bank retained by the retailer to process
payment card transactions on their behalf. Acquirers are responsible for paying the
merchant for the transactions they process. They do this on receipt of card transaction
details from retailers by passing them to the card issuer for authorisation and processing.
Acquirers are also responsible for obtaining transaction authorisation prior to the
delivery of goods and/or services.
The responsibility for maintenance and upgrades to card terminals also lies with
acquirers who risk who must provide clear instructions and guidelines to merchants in
order to minimise instances of card fraud and chargeback. Acquirers are increasingly
using fraud detection software to detect patterns that could be due to fraudulent activity.
This can be helpful in identifying and investigating unusual patterns of transactions.
