Take On Payments, a blog sponsored by the Retail Payments Risk Forum of the Federal Reserve Bank of Atlanta, is intended to foster dialogue on emerging risks in retail payment systems and enhance collaborative efforts to improve risk detection and mitigation. We encourage your active participation in Take on Payments and look forward to collaborating with you.
Federal Reserve Web Sites
Other Bank Regulatory Sites
January 30, 2012
Is the United States payments industry following in the footsteps of the Netherlands?
The Forum recently took a dive into card fraud data from the many countries (not the United States, of course) that have tossed out their old magnetic-stripe cards and adopted the EMV standard. You can read the paper—it's available on our website—but here's a quick recap.
What we found in the data is a recurring pattern of fraud losses. For instance, the data show that chip-and-PIN has been highly successful in the domestic card-present environment in reducing counterfeit and lost or stolen card fraud. This chart depicts the United Kingdom's positive domestic card-present experience.
On the other hand, fraud on non-chip-and-PIN transactions—most notably in the card-not-present and cross-border environments—has actually increased. Ultimately, the net results to date on EMV chip-and-PIN's impact on total card fraud losses in these countries have been marginal. As an example, this next table shows Canada's growing card-not-present fraud loss trend.
The working paper uses the Netherlands experience as a case study because of the country's similarities to the United States. Much like the United States, the Netherlands was experiencing low rates of payment card fraud, so this country did not migrate to the EMV standard when all the rest of Europe was adopting it. Eventually, fraud loss rates in the Netherlands climbed, ultimately propelling the Netherlands banking industry into implementing chip-and-PIN.
Like the Netherlands, the United States is now seeing a growth of card fraud loss rates on both credit and debit cards. As we've blogged several times, the costs for an EMV implementation here in the United States have so far outweighed the fraud loss reduction benefits of chip-embedded cards, according to some industry stakeholders. But given the parallels between the United States and the Netherlands, it is reasonable to expect card fraud losses to continue to grow here as long as the industry relies on mag-stripe technology.
Clearly, there is a need for industry coordination for an EMV implementation to effectively reduce payment card fraud. Based on the fraud trends experienced by countries adopting EMV chip-and-PIN, implementing the EMV standard in the United States for only certain types of card products or without solutions for mitigating card-not-present fraud could lead to only a marginal reduction in total fraud losses as fraudsters seek to exploit the lowest hanging fruit.
It should be noted that while the card industry in each of the countries investigated in the working paper adopted PIN authentication, this method is only one of several options. The working paper focused on PIN authentication because of the abundance of card fraud and transaction data reported by these countries' payments industries.
For more details on the successes and failures that a number of countries have experienced in moving to EMV technology, read the paper on our website.
By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed
January 23, 2012
PIN authentication versus signature authentication
In the United States, surveys from several organizations help us determine approximate total fraud losses by different payment instruments. For example, the American Bankers Association's 2011 Deposit Account Fraud Survey Report estimates that 2010 industry fraud losses totaled $893 million for checks and $955 million for debit cards. The Nilson Report puts 2010 payment card fraud losses at $3.56 billion. And a 2011 PaymentsSource report estimates that bank card issuers experienced fraud losses of $1.16 billion in 2010.
Some of these industry surveys actually fail to illustrate the complete risk landscape—we must also consider trends in the underlying usage of various payment mechanisms. To better assess risks to financial institutions from various payment types, it is useful to compare fraud losses on a per-unit basis. By doing this for credit card, signature debit, and PIN debit transactions, the effectiveness of PIN authentication in preventing payment card fraud becomes clear (see the chart).
Credit card loss rates are the largest among payment cards and growing
According to PaymentsSource's bank card profitability studies, financial institutions' credit card-related fraud losses grew each year between 2006 and 2008, rising from $1 billion to $1.11 billion. After an aberration in 2009, when credit card fraud losses fell by 14 percent, fraud losses grew again in 2010, by 22 percent. The Nilson Report data showed a similar trend in both the number and dollar value of credit card transactions during this time period.
The Nilson Report data provide the basis for determining per-unit credit card loss estimates for financial institutions. On a per-transaction basis, annual credit card-related fraud losses reached their highest level in 2010, at 7.5 cents per transaction. This figure represents an almost 9 percent increase from the 2006 figure, which was 6.9 cents. Credit card fraud losses on a dollar-volume basis increased by nearly 27 percent during this same time period, from 6.7 basis points (or 0.067 percent) in 2006 to 8.5 basis points in 2010.
Debit card fraud loss rates vary by authentication method
Likewise, financial institutions have seen debit card fraud losses rise steadily since 2004. According to this PULSE Debit Issuer Study, fraud losses from purchase transactions (excluding losses from ATM fraud) were about $201 million in 2004. Looking at PULSE study data in conjunction with data from The Nilson Report shows that debit card fraud losses from point-of-sale transactions peaked at $880 million in 2010.
However, a large disparity exists between debit card fraud based on the authentication method employed. For example, signature debit transactions accounted for an estimated $804 million—91 percent—of the total debit card fraud in 2010.
The increase in fraud losses should come as no surprise given the rapid growth in debit card transactions over the past six years. According to The Nilson Report, debit transactions grew by more than 122 percent, or 14.3 percent on an annualized basis, between 2004 and 2010. Data from PULSE studies show that in 2010, financial institutions experienced a 2.7-cent fraud loss for every signature debit transaction, and a 0.5-cent loss for every PIN debit transaction. This translates to 7.5 basis points for signature transactions and 1.3 basis points for PIN transactions on a per-dollar volume basis. These figures are up from the 2006 numbers of 1.9 cents (or 4.8 basis points) and 0.3 cents (or 0.8 basis points), respectively.
Comparing signature and PIN transactions
Based on per-unit fraud losses of credit and debit cards, financial institutions have significantly more exposure to fraud losses from card payments with signature authentication than from those with PIN authentication. Yet PIN authentication is not accepted for credit transactions, and it accounted for only 32 percent of debit card purchase transactions in 2010. Although the fraud rates for both signature and PIN transactions have increased over time, signature transactions still exhibit significantly higher loss rates, especially when comparing the transactions on a per-dollar volume basis. The large disparity in per-transaction fraud losses between credit card and signature debit transactions stems from credit card transactions having an average ticket size of nearly 2.5 times that of signature debit transactions. Ultimately, PIN debit offers an additional and superior layer of authentication not offered on credit and signature debit transactions.
Admittedly, the limited number of merchants in the face-to-face environment who have the capability to accept PIN-based transactions, combined with the lack of PIN-based acceptance in the card-not-present environment, limits the use of PIN transactions. But given the ongoing displacement of cash and checks by payment cards and other forms of electronic payments, the continued adoption of PIN debit transactions and the potential introduction of PIN authentication for credit card transactions could go a long way toward reducing growing payment card fraud. However, given recent EMV-related statements that Visa and the Merchant Advisory Group have issued, it remains unclear whether or not PIN authentication will become the standard in the United States.
By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed
January 17, 2012
How risky? The elements of an effective payments risk management program
Financial institutions manage a range of businesses with distinct risk management needs. Banks of all sizes that offer payment services to retail and commercial clients must appropriately identify and manage the myriad dimensions of risk entailed. The Retail Payments Risk Forum recently spoke with Tony DaSilva, a senior bank examiner at the Federal Reserve Bank of Atlanta. The conversation, captured in a podcast and highlighted in this post, covered the elements of a successful payments risk management program. Formerly a banker, DaSilva is able to take the perspective both of the supervisor and of the supervised institution when it comes to understanding the challenges of managing retail payments risk.
He said that in financial institutions today, "payments risk management is sometimes informal or decentralized." Without a comprehensive risk assessment, said DaSilva, these institutions have a heightened vulnerability to risks they do not understand. As a result, they may incur losses, lawsuits, or even regulatory formal actions.
Often, the scope and rigor of the bank's risk management program is not commensurate with the bank's risk profile. He added that the loose oversight combines with a variety of other factors to undercut a bank's risk management capabilities. A major driver in adding new payment services may be anxiety for fee income in an environment where many sources of payments revenue have been pressured.
Other factors include incomplete due diligence or inadequate "know-your-customer" (KYC) programs, or the institution may have insufficient payment expertise, senior leadership involvement, or employee and management training. DaSilva has seen institutions that do not perform adequate risk assessments or due diligence when deploying new payment products or services, for example, or when engaging in third-party service-provider relationships.
Implementing a strong risk management program
DaSilva explained that there are multiple types of risk in the payments business that institutions must consider. These types include "credit risk, compliance risk, transaction risk, fraud risk, and legal and reputational risk." Responding to all these requires establishing a risk management program with the following elements:
- Planning. Having clear, defined objectives, a well-developed business strategy, clear risk payments parameters, and a role within the financial institution's strategic plan.
- Risk identification and assessment. Senior management knowledge and understanding of their institution's risks is critical. The risk assessment should be incorporated into the bank's overall risk management process, which will vary by institution.
- Mitigation. Establish policies and procedures to mitigate identified risks. These policies should consist of clearly defined responsibilities and strong internal controls over transactions. Mitigation is also achieved through a good risk-based audit program, and well-designed contracts and agreements.
- Measurement and monitoring. Periodic reporting should enable the board and senior management to determine that payments activities remain within the bank's established risk parameters.
The role of bank leadership in risk management
DaSilva repeatedly emphasized that it is critical for bank board and senior management to be actively involved with and knowledgeable about their institution's payments risk management. For an institution to be able to gauge senior management knowledge, he suggested it begin by exploring whether management "understands the inherent product risks, the compliance requirements, the ability to monitor, the operations management and operational risks, [as well as] their reputational [and] legal risk."
DaSilva encouraged leveraging subject matter experts and ensuring that the retail payments strategy matches the bank's overall strategy and competencies. The best policy may be to limit product offerings to those for which management and employees have a full understanding of the accompanying risks. Despite the pressure to develop new sources of revenue, financial institutions should carefully evaluate the risks of any new payment product before adding it to their portfolio.
To end on a positive note, DaSilva has seen some institutions improving in all the right areas. They are assessing and mitigating risk across multiple payment channels, products, and delivery systems, including ACH, remote deposit capture, card products, and wire transfer. And for icing on the risk management cake, some do annual reviews of client accounts that include exposure from all payment, deposit, and loan products.
By Jennifer C. Windh, a payments risk analyst in the Retail Payments Risk Forum at the Atlanta Fed
TrackBack URL for this entry:
Listed below are links to blogs that reference How risky? The elements of an effective payments risk management program:
January 9, 2012
Is what you see what you get? Proposed pricing disclosures for electronic remittances
In previous posts, we've talked about the state of regulatory reform for remittance payments. Other posts have looked at the evolving landscape for money transmitters—or remittance transfer providers (RTP), as the new Consumer Financial Protection Bureau (CFPB) refers to them.
This week's post speaks directly to a proposed consumer protection requirement that RTPs in the United States may have to comply with when they send electronic remittances to recipients in foreign countries. Specifically, the proposed rule would require RTPs to disclose clear and complete information about cross-border money transfer services, including all fees, the exchange rate, and the amount of currency the recipient will actually receive once the fees and exchange rate have been applied.
This sounds reasonable. Under the new rule, consumers would be able to determine the total price, and therefore would know the net proceeds available to the recipient. The rule would also establish error resolution rights for remittance senders, defining standards for the resolution process and procedures for cancelling transactions and refunding fees.
However, variables outside the RTP's control can complicate remittance transfer pricing. Many RTPs have reported that the new requirements threaten to drive consumers to less formal and sometimes illicit money transmitters.
Below, we summarize some of the issues that the CFPB must consider as it crafts the final rule provisions. At issue is whether the agency will effectively achieve its mission of improving transparency for consumers without also bringing about the unintended consequences of onerous regulatory compliance costs for RTPs or undesired process formality for unbanked and possibly less sophisticated consumers.
Why would remittance costs vary?
The following table shows how pricing can change depending on how RTPs combine the fees and foreign exchange costs.
Many commenters on the proposed rule contend that RTPs cannot always control the transaction from start to finish, so compliance with such a requirement could become very complicated. They argue that the sending RTP may not know the exact amount of taxes, fees, and other charges that intermediary firms and governments impose. The lack of such information would also complicate the error resolution process. Nearly all commenters suggested that the rule be modified to allow RTPs to estimate costs based on information available at the time of the transaction.
Disclosures may not be enough to do the job
The CFPB aptly notes that disclosures may be insufficient in the battle for improving transparency and customer awareness. Consumers often rely on shortcuts and opt for convenience when making decisions; they often do not make the most advantageous financial choices. Additionally, many consumers need some extra help to understand disclosures, however well-designed and articulated. The CFPB also therefore recommends augmenting disclosure practices with customer education and outreach campaigns.
There is yet another issue to consider. As we've noted in previous posts, technology is helping create new business models for money transmitters and opening new channels for delivering remittance services. As a result, RTPs will need to modify their disclosure practices for multiple channels as remittance transfers continue to evolve into new innovative products and services. As the new regulator for ensuring that nonbank RTPs are ensuring adequate consumer protections, the CFPB must also assume an adaptive posture in the highly dynamic remittance service market.
By Cynthia Merritt, assistant director of the Retail Payments Risk Forum
- Looking for Partners in Safer Payments
- The Range of Un-Friendly Fraud
- Payments Webinar October 10: Cash in the 21st Century
- "Insuring" Ransomware Will Continue to Flourish
- Designing Disclosures to Be Read
- Is There a Generation Gap in Cash Use?
- What the Most Convenient Food Tells Us about Payments
- Is Friction in Payments Always Bad?
- Why Should You Care about PSD2?
- At the Intersection of FinTech and Financial Inclusion
- October 2019
- September 2019
- August 2019
- July 2019
- June 2019
- May 2019
- April 2019
- March 2019
- February 2019
- January 2019
- account takeovers
- ATM fraud
- bank supervision
- banking regulations
- banks and banking
- card networks
- check fraud
- consumer fraud
- consumer protection
- credit cards
- cross-border wires
- data security
- debit cards
- emerging payments
- financial services
- financial technology
- identity theft
- law enforcement
- mobile banking
- mobile money transfer
- mobile network operator (MNO)
- mobile payments
- money laundering
- money services business (MSB)
- online banking fraud
- online retail
- Payment Services Directive
- payments fraud
- payments innovation
- payments risk
- payments study
- payments systems
- phone fraud
- remotely created checks
- risk management
- Section 1073
- skills gap
- social networks
- third-party service provider
- trusted service manager
- Unfair and Deceptive Acts and Practices (UDAP)
- wire transfer fraud
- workforce development
- workplace fraud