According to The Times, internet fraud is growing so fast that the EC fears for the future of the electronic commerce industry. In Germany, Die Welt questions whether the European dot.com slump can be blamed on consumer fears about security. Meanwhile, in Madrid, El Pais reports that European consumers are being ripped off to the tune of £400m a year.
From all corners of Europe comes the cry for tighter security measures to instill consumer confidence and stimulate e-commerce. Let's get one thing straight - credit card fraud is not out of control. Visa USA announced record low fraud losses in 1999, partly attributable to the fact that almost all transactions in the US are now authorised online: that is, when you use your credit card to pay for something in a US store, the retailers' point-of-sale (POS) terminal connects to a bank computer to check the card is OK. This is very effective in blocking bad cards. In Europe, high telecommunications charges have historically led to a situation where many transactions are not authorised online. Nor is card fraud anywhere near the top of the banking industry's agenda.
Chargeoffs (when banks write off credit card debt) run at about 10 times chargebacks (when banks charge fraudulent transactions back to merchants) and are therefore far more worrisome. Internet credit card fraud is in a different category. It is considered one type of Card Not Present (CNP) fraud. Most of it is related to "adult sites" (a euphemism for pornography).
According to Europay, if you remove the portion of fraud committed on adult sites, then internet fraud just about equals the amount of overall fraud at 0.1% of all transactions by value. Nevertheless, the European Commission is pushing a raft of counter-measures, including better police training, the establishment of an experts group on fraud prevention, and closer co-operation between credit card companies and the retail sector. But it's still too easy to get hold of someone's card details and use them over the internet or to make a bogus card.
So what should be done, and who should do it? The banking sector has the power to solve the problem, but not the incentive. The payment industry's first attempt, the Secure Electronic Transaction protocol (SET), failed miserably. It was just too complicated and too costly to roll out. Neither are European banks rushing for its successor, called 3D SET, not surprisingly, in that it transfers some of the fraud liability from retailers to banks.
The situation might improve this summer when Visa changes its rules so that merchants using 3D SET to authenticate consumers - by accepting payment from bank-issued "server side wallets" - will not be liable for fraudulent transactions. Server side wallet is a secure software on a bank's computer that consumers can access from any PC, Wap phone, or TV set by typing in a user name and password. The wallet then sends the customer's card number and other details such as shipping address to the merchant. A number of alternative solutions also exist.
Pseduo number systems create a unique 16-digit card number for each transaction which the online merchant processes in the usual way, and the consumer's real card number is never revealed. The arrival of pre-paid plastic cards shows promise. One example is Splash Plastic, launched last month and aimed at the seven million British teenagers that want to buy online but don't have credit cards or bank accounts. The card is credited with cash at one of the thousands of PayPoint terminals in retail stores. Stopping teens from buying things they shouldn't (eg, pornography or guns) may be a problem, which is why Splash Plastic is careful to vet online merchants.
What would really benefit consumers and merchants would be a switch from magnetic stripe "dumb" cards that use signatures at the point of sale to computer chip smart cards with a PIN. French banks, which have used smart cards for years, suffer a fraction the fraud of British banks. If consumers became accustomed to putting their smart cards into their PCs when they wanted to buy something, the CNP fraud problem would be reduced at a stroke.
So why don't they? So far, the case for banks converting to smart cards has been weak, since their losses to fraud have been less than the cost of the new cards, terminals and so on. But now that the transition to smart cards is accelerating, perhaps the opportunity to use them in new ways will provide real incentives to change.
