Rippleshot Blog

Gas station skimmers have been a heated topic across the fraud management ecosystem for years. Since the EMV chip card compliance deadline isn’t until October 2020  — roughly five years after the liability shift was implemented for merchants — this gap has left gas stations in the fraud spotlight.

Just last week, heading into the July 4th holiday, the U.S. Secret Service once again released warnings reminding consumers about the dangers of credit card fraud that can stem from gas station skimmers. In recent years, skimmers have been a rapidly-growing problem due to tech advancements that’s allowed them to be designed slimmer than a credit card — and cheaper to produce. With fraudsters’ ability to insert them seamlessly into machines with less obtrusive methods, this has led to an uptick in concerns from issuers in how to proactively confront this expensive problem.

Financial institutions are continuing down their digitization transformation by investing in innovative technology. The problem? This opens the floodgates for more touch points for hackers to breach. Another problem? Those fraudsters are more sophisticated than ever. Banks are using new tools to fight fraud— machine learning, automation, cloud technology, etc. —  but so are the fraudsters.

It's a bit of a Catch 22 that exists within the card fraud ecosystem.

At the end of April, US Payments Forum released its "Spring 2017 Market Watch Snapshot." The Forum is a cross-industry body created to address issues that require broad cooperation across the payments industry, including the introduction of EMV chip technology and other payment technologies in the U.S. Their report's top three topics of focus included merchant EMV chip adoption, clarifying CNP fraud status, and increasing focus on transit payments.

Here's a peek into US Payment Forum's recently released key insights on the subjects.

Home Depot is still feeling the effects of the fallout from its 2014 data breach. As a reminder, the breach affected more than 50 million cardholders who used payment cards on its self-checkout terminals in U.S. and Canadian stores between April and September 2014. The cyber thief posed as a vendor, using the vendor's username and password to access both payment card data and customer email addresses.

The U.S. Payments Forum announced in its 2017 Winter Market Snapshot that there has been steady progress in the U.S. migration to chip payments, with 9 out of 10 Americans commonly using chip cards at the approximately one-third of U.S. merchant locations enabled to accept chip payments. "Steady progress" is one way to look at it. Another way is that the deadline for POS terminals to become EMV compliant was October 1, 2015 — well over a year ago — and the findings tell us only one-third of merchant locations have made the switch so far.

So what's slowing them down and how can it be fixed? Let's take a look.

This article was first published in Let's Talk Payments on January 5th.

The year 2016 saw the aftermath of EMV implementation impacting financial institutions, merchants and consumers across the US. Though many expected to see a number of positive benefits from EMV, those benefits didn’t include a reduction in the number of merchant compromises or fraudulent activity.

As 2017 kicks off, we’ve taken a look back at the key trends in the fraud and data breach space over the past year – what we learned and what’s to come in 2017.

It’s safe to say that 2016 has been a year of heightened turmoil for the payments and security industry. With the aftermath of EMV implementation, a sharp rise in data breaches, and unprecedented fraud losses by issuers, we know that this year has kept you busy. The good news is, we’re here to help. In order to save you time, we have compiled a list of key statistics that paint the bigger picture of the industry as a whole. Follow the Rippleshot Team as we take you through the Top 11 Stats of 2016.

No surprise here. Pulse Network’s 2016 Debit Issuer Study cites an across the board increase in fraud losses for all types of financial institutions from 2014 to 2015. But where’s it all coming from? How will mobile payments impact the debit market? And what sort of growth is expected over the coming years? We cover it all ahead:

“Those who cannot remember the past are condemned to repeat it”.

This quote couldn’t hold more true when it comes to the EMV liability shift in America. Cybersecurity experts are perplexed regarding the future, scrambling to find clues in order to predict the who, what, when, and why of the EMV roll-out. What they don’t know is that the answers may actually lie within the past, or across the Atlantic Ocean. Most Americans are quick to forget that we were actually one of the latest to adopt the EMV standard, following suit after Africa, the Middle East, Asia, Latin America, and almost all of Europe. So when it comes to painting a picture of the aftermath that will result from widespread adoption of EMV protocols, why don’t we examine our international counterparts more closely? Join us as we discuss European history surrounding EMV adoption, fraud trends that will carry over to America, and the implications of widespread EMV implementation in our latest infographic: The Evolution of European Card Fraud.

Chip-card hacking has most likely been around longer than you think. Commonly known as the EMV standard, which represents the card network consortium of Europay, Mastercard, and Visa, the chip-based card technology has been widely adopted in virtually every global market (except for the U.S. until recently). EMV was born in 1994, when the three international payment systems sought to develop a global chip specification for payment systems, and the first production version was released in 1996. By embedding a secure chip into a plastic payment card, EMV technology enhances the overall security of debit/credit cards, overshadowing the effectiveness of the traditional magnetic stripe-and-swipe. In addition to replacing the outdated signature with a more secure PIN (personal identification number), the chip card utilizes cryptographic processing to create an ID that is unique to every transaction, as opposed to displaying sensitive account and payment information. However, the common misconception is that EMV is the “be all, end all” of payment security- this couldn’t be further from the truth. Find out how chip-card hacking has evolved from a replacement of internal hardware to sophisticated ATM shimming software as the Rippleshot Team explores the history of chip-card hacking.

By 2019, the global e-commerce market is predicted to be worth US $2.4 Trillion. In short, e-commerce is growing at an unforeseen rate. Unfortunately, it also means that online payment fraud, a notorious companion, will tag along for the ride. In their latest research report, Fraud Trends 2016, WorldPay highlights the key issues at the fore of global risk and fraud prevention, such as perceptions regarding mobile fraud, the use of social media in risk mitigation, and the inability of companies to effectively leverage data.

The United States is often the target of most studies on widespread card fraud, due to its slow crawl to implement EMV technology. And because of this, it would be fair to assume that the United States is the only country uniquely experiencing significant levels of fraud and the ripple effects of skeptical customers and loss of revenue. But, that’s actually not the case. ACI Worldwide and Aite Group’s Global Consumer Card Fraud report sheds light on the issue across twenty nations, and provides a look into what even long-EMV compliant countries like Canada and Mexico are experiencing, decades after the implementation, and how consumers are reacting to it.

The landscape of fraud between 2015 to 2016 is best characterized as uncertain and dynamic. As government institutions such as the CFPB and FFIEC begin to play a bigger role in cybersecurity regulation, it has yet to be seen what data security protocols will be required of financial institutions. Also, pending legislation in Congress surrounding data security has the potential to determine federal standards of information security for merchants. Finally, with back-and-forth lawsuits between retailers, payment card networks, and issuers over disputes regarding EMV compliance and liability shift, nobody is exactly sure who will come out on top.

At Rippleshot, we understand how difficult it can be to juggle so many moving parts and develop actionable insights from them. That’s why we created a timeline for you to get up to speed on recent developments in card fraud and payments security.

Yesterday, news broke that supermarket chain Kroger had filed a lawsuit against Visa due to disagreements over chip and PIN transactions. If this is starting to feel like an echo chamber, it’s because Kroger is far from being the first merchant to sue a card network over the EMV conversion. In March, a small grocery chain and liquor store in Florida filed an antitrust lawsuit against all four card networks and a dozen banks. This was followed by Wal-Mart filing a lawsuit against Visa in May, and Home Depot filing one of their own against Visa and MasterCard in mid-June. What’s the issue behind all of this litigation? Follow along as we break each one down.

A fiery debate has resurfaced between financial institutions, merchants, and consumer groups regarding the Data Security Act of 2015. The bipartisan bill introduced to Congress as H.R. 2205 by Representatives Randy Neugebauer and John Carney on May 1st, 2015 explicitly states two purposes: “to establish strong and uniform national data security and breach notification standards for electronic data” and “to expressly preempt any related State laws in order to provide the Federal Trade commission with authority to enforce such standards for entities covered under this Act.”