Retail Payments Risk Forum

About

---

Disclaimer

Comment Standards

Subscribe by E-mail

Subscribe by RSS

All Atlanta Fed RSS

Take On Payments

January 22, 2019

---

Why Are Millennials So Risk-Averse?

Although millennials have been known to be the most charitable age group compared to earlier generations, they are, ironically, holding their money very close when it comes to taking financial risks. According to a recent study from the Federal Reserve, millennials are less well off than previous generations of young adults. They tend to have higher levels of student debt, lower incomes, and fewer assets to their name. In addition, millennials have grown up watching various financial crises in the United States and around the world, including the bursting of the housing bubble, the dot-com collapse, and the Great Recession. The last crisis was unfortunately around the time this generation began entering the workforce. Dealing with these financial obstacles has negatively impacted their attitude towards financial risk-taking, including investing and even opening up a new credit card. A 2017 survey, for example, found that millennials are more afraid of credit card debt than of dying or war.

Source: credible.com, "Survey: Millennials Fear Credit Card Debt  More Than Threat of War and Dying"

Millennials’ tend to see credit cards—mistakenly—only as one more way to take on additional debt. But are they doing themselves a disservice by not taking advantage of an opportunity to quickly build up or improve their credit? Doing so could better enable them to qualify for a loan to purchase a home or start a new business. Furthermore, using credit cards wisely could actually help millennials save money in the long run through rewards and cash-back programs. And when it comes to investments, millennials are opting out of long-term investments like mutual funds, preferring instead to spend their money on immediate experiences, such as traveling and going to concerts, where they can see the "return on their investment" instantly.

The misconceptions and overall distrust in the financial system from this generation speak to a need for more millennial-focused financial education tools and advisers, especially those who understand the struggles of this generation as they navigate through mounds of student debt. Tools and advice that are more dedicated to millennials’ specific needs—whether it’s through a millennial-focused financial management gaming app or a generation Y robo adviser—would go a long way toward helping millennials increase their financial literacy and begin to trust the financial system. The Federal Reserve has many financial education tools. For example, the Atlanta Fed offers financial tips, updated monthly, in the Atlanta Fed’s digital magazine Economy Matters. And check out these resources from the St. Louis Fed:

• Credit Bureaus: The Record Keepers (Page One Economics)
• Online Course for Consumers (Credit Cred)
• Credit Card Statement (Personal Finance 101 Financial Forms Explained
• Credit Report (Personal Finance 101 Financial Forms Explained)
• Build Credit and Control Debt (Building Wealth: A Beginner’s Guide to Securing Your Financial Future)

With some financial education, this generation might gain greater confidence and take more risks with their money so they could build more wealth.

By Catherine Thaliath, project management expert in the Retail Payments Risk Forum at the Atlanta Fed

 

January 22, 2019 in credit cards , debit cards | Permalink | Comments ( 0)

January 14, 2019

---

Hiding in Plain Sight

Over the holidays when our family is all together, we always try to watch A Christmas Story. There are so many memorable moments in the movie, from the triple-dog-dare-you, tongue-frozen-to-the-flagpole scene to the leg lamp breakage. When the story revolves around Ralphie and the Little Orphan Annie secret decoder ring, it triggers my childhood memories of having a similar decoder ring that came with a pair of P.F. Flyers sneakers (think pre-Nike and Adidas). This year, our movie-watching led to a storytelling session of techniques worthy of any spy movie for passing secret notes. Many of the examples were like the decoder ring—they used some sort of secret alphanumeric table as a key to solve the cryptic message. In other words, we were talking about a rudimentary form of encryption, which, in today's technology, renders data useless to those without a key, whether they're bad guys or good guys.

But our conversation didn't stop there. I told a childhood story of dipping a toothpick in lemon juice and writing a message on paper. After the juice dried, the message became invisible, and I would then write an innocuous—and visible—message on the paper with pen or pencil. The recipient would carefully hold the paper over a flame to slowly reveal the hidden message. (Kids, try this only under adult supervision!) Little did I know I was using a technique called steganography—hiding a message within another message—that people also use today to protect information online.

Various forms of the technique date back to Greek civilization when untrusted messengers had to convey sensitive or classified information, or a message was at risk of being intercepted. (There is an entertaining and educational video on steganography by Richard Buckland, a professor at the University of New South Wales in Australia.) Today, technology has created a new technique in the form of digital steganography, which is the practice of hiding an image, audio, or data file within another image, audio, or data file.

A recent article in infoRisk Today highlighted the darker side of steganography, with its use by the criminal element. That article prompted me to conduct more research on the technique as a payments risk. From a cybersecurity standpoint, the greatest risk to consumers appears to be when the criminal hides a malware file within an image, audio, or other data file that, when opened, will load malware onto the device for future eavesdropping or control. Such an event could lead to the compromise of PII (or personally identifiable information), online credentials, or other sensitive information on the device without the owner's knowledge. In an August 2017 release, Kaspersky Lab warned about the difficulty for existing data protection processes to detect embedded malicious code.

Account takeover fraud is a major criminal activity that generally begins with the compromise of an individual's legitimate banking log-in credentials. A criminal who obtains this information can execute payment transaction fraud and, ultimately, synthetic identity fraud (see last week's post). While there are valid uses for steganography as an alternative to encryption, the criminal element will continue to develop uses of digital steganography to further their criminal operations and, as the infoRisk article notes, this usage is becoming more sophisticated and harder to detect.

By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed

January 14, 2019 in crime , cybercrime , cybersecurity , data security , malware | Permalink | Comments ( 0)

January 7, 2019

---

A New You: Synthetic Identity Fraud

With the start of the new year, you may have resolved to make a change in your life. Maybe you've even gone so far as to pledge to become a "new you." But someone may have already claimed that "new you," stealing your credentials and using them to create a new identity. Identity theft is a growing problem, resulting in millions of dollars in damage around the world. And now there is a modern twist to this old and costly problem: synthetic identity fraud. Panelists at a forum convened by the Government Accountability Office (GAO) define this problem as a "crime in which perpetrators combine real and/or fictitious information, such as Social Security numbers and names, to create identities with which they may defraud financial institutions, government agencies, or individuals." (Read forum highlights on the GAO website.) According to the U.S. Federal Trade Commission, synthetic identity fraud is the "fastest growing and hardest to detect" form of identity theft.

This graphic from the GAO illustrates how this type of identity fraud differs from what we have traditionally defined as identity theft.

As this image shows, in traditional identity fraud, the criminal pretends to be another (real) person and uses his or her accounts. In synthetic identity fraud, the criminal establishes a new identity using a person's real details (such as social security number), combining this information with fictitious information to create a new credit record.

The challenge for the payments industry is determining whether an identity is planted or legitimate. For example, parents with excellent credit histories sometimes add their children to their existing credit accounts to give their children the benefit of their positive financial behavior. This action allows the children to kick-start their own credit records. Similarly, a criminal could plant a synthetic identity in an existing credit account and from there build a credit history for this identity. (In many cases, the criminal works for years on building a strong credit history for that false identity before "cashing out" and inflicting financial damages on a large scale.)

So what can consumers do to protect themselves? Here are some simple ways to make it harder for a thief to steal your personal information:

• Shred documents containing personal information.
• Do not provide your social security number to businesses unless you absolutely have to.
• Use tools that monitor credit and identity usage.
• Freeze your credit account as well as that of any of your minor children.
• Check your accounts regularly to ensure that all transactions are legitimate and report any suspicious activity immediately.

Staying informed about synthetic identity fraud tactics and taking these steps to protect yourself can help you get one step closer to (preventing) "a new you."

By Catherine Thaliath, project management expert in the Retail Payments Risk Forum at the Atlanta Fed

January 7, 2019 in authentication , consumer fraud , consumer protection , data security , fraud , identity theft | Permalink | Comments ( 0)

December 17, 2018

---

Card Fraud Values Often above Average

Recent data from the Federal Reserve Payments Study remind me of my first experience with payments fraud as a 20-something college grad freshly arrived in Boston. I left my wallet in a conference room, and someone lifted my credit card. I still remember the metaphorical punch to the stomach when the telephone operator at the card company asked, "Did you spend $850 at Filene's Basement?" $850! That was more than twice my rent, and far more than I could conceive of spending at Boston's bargain hunters' paradise in a year, let alone on a one-night spree.

Decades later, the first thing I do to check my card and bank statements is to scan the amounts and pay attention to anything in the three digits. For noticing high-value card fraud, this is a pretty good habit.

That's because, on average, fraudulent card payments are for greater dollar values than nonfraudulent card payments. In 2016, the average value of a fraudulent credit card payment was $128, almost 50 percent more than $88 for a nonfraudulent credit card payment. For debit cards, the relationship was more pronounced: $75 for the average fraudulent payment, about twice the $38 average nonfraudulent payment, according to the Federal Reserve Payments Study.

Even to the noncriminal mind, this relationship makes sense: get as much value from the card before the theft or other unauthorized use is discovered. For a legitimate user, budgetary constraints (like mine way back when) and other considerations can come into play.

Interestingly, this relationship does not hold for remote payments. In 2016, the average dollar values of remote debit card payments, fraudulent and nonfraudulent, were the same: $68. And the average value of a nonfraudulent remote credit card payment, $151, exceeded that of a fraudulent remote credit card payment, $130. Why the switcheroo?

A couple of possibilities: Remote card payments include online bill payments, which often are associated with a verified street address and are of high value. So that could be pushing the non-fraudulent remote payments toward a high value relative to the fraudulent remote payments. Another factor could be that fraud detection methods used by ecommerce sites look for values that could be outliers, so perpetrators avoid making purchases that would trigger detection—and thus average values for remote fraud are closer to average values for remote purchases generally. But this is speculation. What do you think?

The relationships described here are depicted in figures 21 and 28 of the recent report of the Federal Reserve Payments Study, Changes in the U.S. Payments Fraud Landscape from 2012 to 2016. You can explore other relationships among average values of payments, and more, on the payments study web page.

By Claire Greene, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed

December 17, 2018 in cards , cybercrime , cybersecurity , data security , debit cards , mobile banking , mobile payments , payments study | Permalink | Comments ( 0)