A colleague of mine forwarded me an inbound email for an upcoming conference the other day titled "Chip Cards to Result in Massive Online Fraud", asking where I stand on this, as if he didn't know that this was effectively lighting the blue touch paper on a Roman Candle and running for cover. I replied with a three word answer... "PILE OF @SS". A couple of days on, I have decided to condense my thoughts into this post, which encompasses some of the data driven work we did for a report on this very subject last year - "Fixing CNP Fraud". In that report, we debunked the popular held mythology that clamping down on counterfeit card fraud with EMV will result in an explosion of CNP fraud, as was seen in Europe when EMV was implemented a decade or so ago. Here's why we think the whole myth is no longer applicable...
- Different time, different fraud. In 2004 / 2005 Europe, e-commerce was just taking off, presenting a green field opportunity for fraudsters to experiment. The relatively abrupt implementation of EMV forced criminals to move from counterfeit / lost and stolen cards to an area of decreased friction where virtual card credentials were good enough for fraud and where naive and borderless online merchants were easy pickings. Today, online merchants are not only far more knowledgeable of the types of fraud that can be perpetrated, but have access to far more sophisticated fraud detection and prevention tools. Committing CNP fraud is far from contained, but certainly much less of a cakewalk than it was.
- Fraudsters are not unitaskers. Card fraud is a very lucrative business, with carding gangs operating sophisticated global operations. The notion that they have all been so busy with counterfeit card fraud in the US that they have not had the time to pursue other avenues for card fraud like CNP is ludicrous. Card Not Present fraud is already massive and in fact will more than double by 2018 IRRESPECTIVE of EMV coming to the US.
- EMV USA will not happen overnight. Not only are there robust checks and balances already in place for CNP fraud, the payments industry is working hard on further fraud prevention measures designed to holistically sure up both online and offline card payment environments. The rather glacial shift to EMV in the US over the next few years will mean that early diagnostics in the event of shifts in card fraud methods will be relatively quickly detected and countered. The US further benefits from the collective wisdom of pretty much every developed country that has gone through the process of moving from mag stripe to chip.
The scaremongering about EMV shifting fraud to CNP does a great disservice to the strides that the card payments industry has undertaken to deal with card fraud and the old argument that net/net, there is no point in EMV since it just shifts fraud elsewhere is just plain wrong. No one expects fraudsters to give up their day jobs with EMV coming to the US, but I am confident that the US payments industry will not experience anything like "Massive Online Fraud" as a direct consequence.