uncover mobile fraud before it's too late

eBook

NOWHERE TO HIDEUNCOVER MOBILE FRAUDBEFORE IT’S TOO LATE

eBookNOWHERE TO HIDE: UNCOVER MOBILE FRAUD BEFORE IT’S TOO LATE

2

http://info.kount.com/request-a-demo

Nearly 10 Billion Mobile Devices and Growing ...............................................................................................................................................................................................................3

Mobile Commerce Is Growing Fast ..................................................................................................................................................................................................................................4

Mobile Fraud Is Growing Fast, Too ....................................................................................................................................................................................................................................5

Five Types of Mobile Transactions ...................................................................................................................................................................................................................................6

Mobile at Point-of-Sale/Mobile as Point-of-Sale ...............................................................................................................................................................................................7

Mobile Payment Platform/Direct Carrier Billing ..................................................................................................................................................................................................8

Closed-Loop / Open-Loop Mobile Payment (Wallets) .......................................................................................................................................................................................9

Is Mobile Riskier than Conventional eCommerce? .....................................................................................................................................................................................................10

Lost and Stolen Mobile Devices Are Dangerous ................................................................................................................................................................................................11

Easy Account Takeover or New Account Creation .............................................................................................................................................................................................12

Apple Pay More Likely to Be Fraudulent? ...........................................................................................................................................................................................................13

Pre-paid Mobile Devices Are Cheap Fraud Weapons .......................................................................................................................................................................................14

Click ‘n’ Collect Outpaces Capabilities of Fraud Systems ...............................................................................................................................................................................15

10 Key Capabilities for Preventing Mobile Fraud. .......................................................................................................................................................................................................16

Know If Mobile Device Is Being Used / Identify Type of Mobile Device Being Used.....................................................................................................................................17

Pinpoint “Real” Location of Mobile Device / Determine if Device Is a Pre-paid Device .............................................................................................................................18

Know if Phone Number Is a Forwarded Number / Associate Other Transactions with the Device .........................................................................................................19

Determine if Card-Present or Card-Not-Present / Know if Financial Information Has Been Compromised .......................................................................................20

Develop Your Own Fraud Prevention Solution? / Conduct Mobile “Fraud Audits” Every 12-18 Months ...............................................................................................21

Best-In-Class Solution for Mobile Transactions. ........................................................................................................................................................................................................22

Kount Mobile SDK for Best Mobile Fraud Detection. ..................................................................................................................................................................................................23

About Kount ........................................................................................................................................................................................................................................................................24

After years of promise, mobile commerce is taking off, bringing new opportunities as well as new risks. This eBook examines what you should know about mobile payments and fraud.


3


There are 7.7 billion mobile

devices and 1.7 billion smart

phones in use today1

There are more

mobile phones on

the planet than

there are

televisions2

More

people own

a mobile phone

than own a

toothbrush2

More mobile

subscribers than

human beings at

the end of 20143

Nearly 10 Billion Mobile Devices and Growing


4


Mobile Commerce Is Growing Fast Critical mass. As the number of mobile devices grows, mobile eCommerce, or mCommerce as it is becoming to be known, is growing rapidly as well. Mobile transactions are projected to reach nearly three quarters of a trillion dollars worldwide in 2017.

As with all new technologies, this opportunity brings new risks, especially in the area of fraud. How will this affect merchants seeking to maximize revenues in the mobile channel, while holding down the cost of fraud prevention and fraud itself?

$700B

$600B

$500B

$400B

$300B

$200B

$100B

0

$52.9BILLION

$101.1BILLION

$163.1BILLION

$235.4BILLION

$325.2BILLION

$431.1BILLION

$563.4BILLION

$721.4BILLION

2010 2011 2012 2013 2014 2015* 2016* 2017*

Mobile Transactions Worldwide4 2011 - 2017

*projected


5


Mobile Fraud Is Growing Fast, Too Merchants beware. As merchants race to accept mobile transactions, fraudsters have moved aggressively to exploit the vulnerabilities of those who have not fully mastered the techniques and technologies necessary to successfully fight mobile channel fraud.

LexisNexis reports5 a 33% increase in fraud among merchants in 2014. While it’s difficult to quantify the precise contribution of mobile fraud to this increase, the fact that the mobile channel is growing so much faster than other channels certainly indicates it’s playing a significant role.

What’s more, LexisNexis has developed a Fraud Multiplier to calculate the hidden costs associated with each dollar of credit card fraud. They found that these hidden costs were 27% higher for mobile transactions than for conventional online transactions.

$3.50

$3.00

$2.50

$2.00

$1.00

$1.50

0Mobile Online

$3.34

$2.62

The Hidden Costs of Fraud 2014

MOBILE: $3.34 in hidden costs for every dollar of fraud

ONLINE: $2.62 in hidden costs for every dollar of fraud


6


Five Types of Mobile Transactions What is a mobile transaction? Before we examine fraud in the mobile channel, it’s important to know the different mobile transaction types, as each has unique vulnerabilities.

Mobile at the Point-of-Sale1Mobile as the Point-of-Sale2Mobile Payment Platforms3Direct Carrier Billing4Closed/Open-Loop Mobile Payments5


7


Mobile at Point-of-SaleNear Field Communication (NFC) for contactless payment systems. A special reader at point-of-sale—typically at retail checkout—uses short radio waves to transfer financial transaction data from a smartphone and some types of credit cards. In the near future, NFC will also be able to process transactions from wearable mobile devices.

Mobile asPoint-of-SaleAny mobile device as a cash register. An app on a smartphone or tablet processes card information captured via a swipe using a card reader accessory that plugs into the audio jack or manually through a user interface. While technically a mobile process (not a mobile payment), these mobile-as-point-of-sale solutions have universal interoperability and widespread distribution.


8


Mobile Payment PlatformOne account speeds checkout. A customer’s gift cards, credit cards, debit cards, etc. are stored as an account with the mobile payment platform provider, for example, PayPal or Amazon. No matter which website a customer is buying from, he or she simply enters login credentials for his or her payment account (as long as the merchant accepts that platform). No need to enter credit card number, CVV code, billing address, shipping address, etc. for each new eCommerce website.

Direct Carrier BillingThe granddaddy of mobile payment types. With direct carrier billing, merchants are paid by the wireless provider, who adds the charges to the wireless account holder’s monthly bill. Originally used before the advent of smartphones to fund ringtone purchases, it’s often used for digital goods like mobile apps and in-game purchases. Direct carrier billing is also popular in emerging markets where users are less likely to have bank accounts or credit cards.


9


Closed-Loop / Open-Loop Mobile Payment (Wallets)Single merchant vs. multiple merchants. Closed-loop mobile payments refer to single merchant wallets. The customer funds an account with the merchant and draws upon it using his or her mobile device. Closed-loop mobile wallets enable merchants to track purchases, plus offer value-add services like rewards or loyalty programs, making it a powerful marketing tool.

Open-loop mobile wallets, like Google Wallet or Apple Pay, store information from multiple credit cards that can be used by the customer at multiple merchants (provided those merchants accept mobile wallet payments). Most mobile wallets use a barcode or QR-code model, though some rely on technology such as Near Field Communication (NFC).

Closed-Loop Open-Loop


10


Is Mobile Riskier than Conventional eCommerce?For merchants, the short answer is “yes.” In the third annual Mobile Payments and Fraud: 2015 Report6, more than 43% of merchants say that they think mobile is far riskier or somewhat riskier than conventional eCommerce. Compare that to fewer than 5% that think it is less risky.

Risks associated with mobile.

More than 7 out of 10 merchants believe mobile transactions require special fraud prevention practices. And they’re right:

• Standalone technologies like Device ID and Geo-Location are often not as effective for preventing fraud in mobile transactions

• Checkout processes streamlined for mobile can bypass traditional fraud prevention routines, making fraud more likely

Lost and Stolen Mobile Devices Are Dangerous 1Easier Account Takeover or New Account Creation2Apple Pay More Likely to Be Fraudulent?3Pre-paid Mobile DevicesAre Cheap Fraud Weapons4Click ‘n’ Collect Outpaces Capabilities of Fraud Systems5

43.9%Mobile More Risky

51.4%Mobile Just As Risky

4.7%Mobile Less Risky


11


Lost and Stolen Mobile Devices Are DangerousNearly 5 million U.S. smartphones7 went missing in 2013. Of that number, 3.1 million were stolen outright (nearly double the number of thefts from 2012) while another 1.4 million smartphones were lost. What’s worse, a lost/stolen device can quickly become a fraud weapon because data that was supposed to be “private” can easily hacked by fraudsters. For example:

• 34% of users take no measures to prevent unauthorized access in the event of theft or loss7

• 36% set a 4-digit screen lock, but 62% simply use 1 of 10 common and easily hacked codes (e.g., 1-2-3-4)7

• Numerous bloggers have demonstrated iPhone thumbprint security is vulnerable (just Google “hack iPhone thumbprint”)

• Easy to steal and sell

• Easy to extract personal and financial information

• Use hacked data to alter passwords and accounts, blocking legitimate owner

• Easy to wipe clean and establish a “synthetic ID”


12


Easy Account Takeover or New Account CreationFraud for sale. Fraudsters have online marketplaces (see Black Market pricing at right) that allow them to exploit mobile vulnerabilities. For example, once a fraudster has acquired a lost/stolen device, common fraud scenarios include:

1. Use rightful owner’s stolen identity to take over owner’s accounts, create and exploit new accounts in rightful owners’ name, add fraudulent credit cards to rightful owner’s mobile wallet, etc.

2. Use phone numbers, email accounts and other verification data on the device to provide legitimate-looking authorization information for stolen credit cards that have been acquired via Black Market.

2. Wipe device clean and use for synthetic ID. Merchants with only simple standalone fraud prevention technologies or with streamlined mobile checkout are highly vulnerable.

Actual screen capture from fraudster online marketplace


13


Apple Pay More Likely to Be Fraudulent?Drop Labs blog8 reports fraud rates as high as 6% (normal rate is less than 1%). Why? First, it’s easy to buy stolen credit card numbers and load them into Apple Pay (no physical credit card is needed). Second, banks are using less-than-bulletproof techniques to verify that the actual credit card owner is the person using the credit card loaded into Apple Pay. Bottom line? Fraudsters can use Apple Pay over and over and over to conduct mobile fraud. How big is the problem? It’s only the biggest launch of a payment system ever:

• 75 million iPhone 6+/6’s with Apple Pay sold in Q4 of 20149

• 21 million iPads sold in Q4, 2014, also with Apple Pay9

• Millions and millions of iPhone 5’s will soon be enabled with Apple Pay

GizmodoJanuary 26, 2015

“According to Drop Labs, people are buying credit card

numbers online, then loading those same numbers into

Apple Pay, in essence making themselves a handy fake

credit card, without going to the trouble of making a

physical fake. And it’s not a small problem: Drop Labs

claims that for some issuers, fraud levels are as high

as 6% (meaning $6 of every $100 spent is fraudulent).

That’s bad even when compared to regular credit cards,

whose fraud rate averages out at under 1%.”


14


Pre-paid Mobile Devices Are Cheap Fraud WeaponsFraudster version of the Saturday Night Special. Cheap, disposable and deadly. That’s what a pre-paid mobile device is in the hands of a fraudster. It can be used to exploit all the vulnerabilities of merchants who lack best-in-class mobile fraud protection. And then painlessly thrown away when its usefulness is done.


15


Click ‘n’ Collect Outpaces Capabilities of Fraud SystemsGone before you know what hit you. Many merchants are offering their customers the convenience of buying online and then picking up in-store in just minutes.

But if the retailer does NOT have best-in-class mobile fraud tools in place, Click ‘n’ Collect can be an open invitation for theft. A fraudster sitting in the parking lot can use any of the techniques discussed previously to complete a fraudulent mobile transaction, then stroll in to pick the merchandise and be gone before a merchant can react.

CASE STUDY

Micro Center, a national retailer of computers and electronics, was hit by a Click ‘n’ Collect scam...

A fraudster was using stolen credit cards to order via mobile/online, then pick up in-store (steal) high-end Apple products, MacBook Pro notebooks, and iPads. Her first targets were Micro Center stores in Kansas City and Chicago. Through astute

detective work, Skip Meyers, Director of Loss Prevention at Micro Center, tracked down her identity, which lead him to her Facebook page. There, she bragged about “ripping off” stores with bogus credit cards and brazenly revealed her upcoming fraud targets.

With the targeted Micro Center stores on alert, the suspect was arrested when she attempted to repeat the scam in Ohio. A search of her vehicle recovered stolen items from Micro Center, Home Depot, Target, and others...leading to prosecution and conviction.


16


10 Key Capabilities for Preventing Mobile Fraud

1. Know if a mobile device is being used for transaction

2. Identify what type of mobile device is being used

3. Pinpoint the “real” location of the mobile device

4. Determine if the device is a pre-paid device

5. Know if the phone number being used is a forwarded number

6. Associate other transactions with the device

7. Determine if it is a card-present or a card-not-present transaction

8. Ascertain if the financial information being used has been compromised

9. Evaluate if your organization has expertise, resources, time, and money to develop its own fraud solution

10. Conduct “fraud audits” that include evaluation of mobile fraud prevention every 12-18 months


17


Know If Mobile Device Is Being UsedMobile app or mobile browser? Best-in-class fraud solutions like Kount determine if a mobile device is being used, which can help you better assess the risk of fraud. It also provides clues about the customer/fraudster that can be helpful, including if person is using a mobile app or mobile browser, the device location, and more.

Identify Type of Mobile Device Being UsedReview or not? Different mobile devices have different fraud and purchase profiles. For example, iPads generally have higher average ticket sales than Android smartphones. Best-in-class solutions such as Kount are able to identify the type of mobile device involved in the transaction, so you can make informed decisions about which transactions should get reviewed.

?


18


Pinpoint “Real” Location of Mobile DeviceChinatown or China? Mobile devices often use proxy IP addresses or connect through carrier network IPs. This can distort the actual location of the device. If you lack the ability to gather actual location data, fraudsters have another opportunity to mask their activity. Kount technologies like Proxy Piercer™ help reveal the actual device location so you can fight fraud better.

Determine if Device Is a Pre-paid DeviceGreater fraud risk? In general, pre-paid devices are used by fraudsters at a higher rate than other mobile devices. Knowing whether a transaction originates from a pre-paid device can be important in fraud mitigation. Best-in-class solutions like Kount alert you when a device is pre-paid so you can better assess the risk of fraud and what steps to take.


19


Know if Phone Number Is a Forwarded NumberActual cardholder? In account takeover schemes, fraudsters will forward a customer’s phone calls to their (fraudster’s) phone. If a merchant or bank tries to call to validate a transaction, the fraudster can take the call and (fraudulently) approve the transaction. Kount technology alerts you if a phone number is a forwarded number so you can take steps to thwart this scheme.

Associate Other Transactions with the DeviceA shady past? This capability is often called “order linking” and can reveal if a mobile device involved in a transaction has been associated with prior fraudulent behavior. Kount Persona technology employs order linking plus other capabilities that help not only stop repeat offenders (device was used fraudulently in past), but provide greater protection against first time fraud, too.


20


Determine if Card-Present or Card-Not-Present Mobile POS transaction? Mobile POS systems can give fraudsters opportunities to grab credit/debit card information. This can be very risky even when a credit card is physically present. Best-in-class solutions like Kount identify whether or not the card is present, providing indicators for the transaction that help you to root out fraud.

Know if Financial Information Has Been CompromisedAn even shadier past? While select best-in-class solutions like Kount offer this capability as a standard feature, many fraud prevention solutions do not. Kount Persona technology not only links the device to past transactions, but also alerts you if the card and other attributes involved in the transaction are associated with past fraud activity so you can stop losses and prevent chargebacks.

or


21


Develop Your Own Fraud Prevention Solution? Best way to spend your time and money? Developing an in-house fraud solution is time-consuming, costly, and can distract from your primary e-commerce mission. And once it’s built, maintenance can be even more demanding. Now add the additional complexities involved in mobile fraud prevention. That’s why most merchants find a fraud prevention solution like Kount to be easier, faster, and less expensive...delivering better ROI in both the short-term and long-term.

Conduct Mobile “Fraud Audits” Every 12-18 MonthsKeeping up with fraudsters? Fraud and payments change too quickly to merely default to what you’ve been doing the past year or two. It’s simply not enough to protect you and your customers going forward. That’s why every online retailer should conduct regular audits of both their payment and fraud systems. And best-in-class solutions like Kount provide the data and reporting you need to make audits easier to conduct.


22


Best-in-Class Solution for Mobile TransactionsKount is a leader in mobile fraud prevention. Long before mobile transactions reached the levels they have today, Kount predicted the coming mobile wave and invested in developing best-in-class mobile fraud detection technology to integrate into our comprehensive platform. The result is a single solution capable of beating fraud and boosting sales, no matter where attacks come from.

• Real-Time Mobile Device Detection

• Rules Engine Mobile Device Capability

• Additional Real-time Data Elements in Risk Inquiry Call

• Two-Factor Authentication through SMS or Voice PIN

• Third Party Services

• Mobile Reporting and Search

Because Kount’s mobile fraud detection capabilities are tightly integrated into our overall solution, you need only one system for fraud prevention. On the other hand, standalone mobile fraud prevention products may force you to operate two different systems in parallel, leading to inefficiencies, missed detection opportunities, and additional work.

£€

$

ProxyPiercer™

Geolocation

Cross-Merchant

Linking

AffiliateFraud Signals

REAL-TIMEANALYTICS

Multi-LayerDevice

Fingerprinting™

Persona™

Technology

Mobile DeviceSignals

DynamicMonitoring

TransactionVelocity

ShoppingCart Data

KOUNTArtificial

Intelligence

KOUNTWorkflow Efficiency

KOUNTAuto

Review

KOUNTTransactionScreening

CONSUMER CLIENT› Ecommerce› Mobile› Retailer› Digital Goods› Games

› Payments› Logins› Free Trials

› New Accounts› Phone Orders› Mail Orders

TRANSACTIONS INCLUDE:

BANK


23


Open App

Shop

Add to Cart

Checkout

OrderConfirm

Kount Mobile SDK for Best Mobile Fraud Detection5th generation technology for your mobile application. A key contributor to our best-in-class solution is the Kount Mobile SDK. Our continuing development over the past five years enables allows merchants to natively embed Kount’s superior fraud prevention capabilities in their mobile application. This helps merchants accepting mobile transactions not only beat fraud, but boost sales, too:

Greater fraud protection:

• Superior device identification

• Multiple points for detecting anomalous behavior/transactions

• Greater operational efficiencies

Improved customer mobile experience:

• Faster checkout / smoother process

• No added steps / zero impact for users

• Zero friction during mobile transactions

• 300 millisecond response• Zero impact for users

• No friction at checkout • Real-time fraud detection

Kount Mobile SDK


24


About Kount

Boost Sales, Beat Fraud. Merchants using Kount can accept more orders from more people in more places than ever before. Kount’s proprietary technology provides maximum protection for some of the world’s best-known brands. We help online businesses boost sales by reducing fraud and allowing them to accept more orders. Our all-in-one, SaaS platform is designed for companies operating in card-not-present and mobile environments, simplifying fraud detection and dramatically improving bottom-line profitability. We bring together your people, our people, and AI/Machine Learning to not just win the battle against fraud...but control the game.

In just 30 minutes we’ll show you how Kount provides best-in-class mobile fraud prevention that is integrated into a comprehensive fraud prevention platform that makes fighting fraud easy and affordable.

SCHEDULE A LIVE DEMO

RECENT AWARDS

SOURCES: 1 http://dazeinfo.com/2014/04/29/7-7-billion-mobile-devices-among-7-1-billion-world-population-end-2014/ and http://www.emarketer.com/Article/Smartphone-Users-Worldwide-Will-Total-175-Billion-2014/1010536 2 http://blog.hubspot.com/blog/tabid/6307/bid/24082/9-Amazing-Mobile-Marketing-Statistics-Every-Marketer-Should-Know.aspx 3 http://www.techtimes.com/articles/17431/20141008/mobile-devices-now-outnumber-humans-report.htm 4 http://www.statista.com/statistics/226530/mobile-payment-transaction-volume-forecast/ 5 http://www.lexisnexis.com/risk/insights/true-cost-fraud.aspx 6 info.kount.com/mobile-payments-reports-2015 7 http://www.consumerreports.org/cro/news/2014/04/smart-phone-thefts-rose-to-3-1-million-last-year/index.htm 8 http://www.droplabs.co/?p=1204 and http://gizmodo.com/turns-out-apple-pay-cant-solve-credit-card-fraud-1681932420 9 http://www.ubergizmo.com/2015/01/apple-74-5-million-iphones-21-4-million-ipads-sold-in-q1/

Skip MyersDirector of Loss Prevention, Micro Center

“We have experienced a measurable increase

in on-line sales and decrease in fraudulent

on-line transactions.”
