Card Fraud Losses Reach $28.65 Billion

Please note: Only subscribers can access the charts included with this article.

Purchases of goods and services as well as cash advances and withdrawals (including on-us ATM activity) tied to global brand and domestic-market-only general purpose and private label credit, debit and prepaid cards worldwide amounted to $42.274 trillion in 2019, up 4.2% over 2018.

Gross fraud losses to issuers, merchants and acquirers of card transactions from merchants, as well as acquirers of card transactions from ATMs reached $28.65 billion, up 2.9% from $27.85 billion in 2018. That figure does not include billions of dollars in fraud losses tied to QR code-based and push payments (bank account to bank account transfers).

Dollars lost to fraud rise every year in the U.S. and worldwide. The measure of success against criminals attempting fraud is basis points per every $100 in total volume.

Card-based payment systems worldwide experienced gross fraud losses equal to 6.78¢ for every $100 of total volume in 2019. This was a decline from 6.86¢ per $100 the previous year.

In the United States, losses to fraud of $9.62 billion were up from $9.47 billion in 2018. However, fraud losses in the U.S. were 10.25¢ per $100 in total volume in 2019, down from 10.83¢ the previous year.

The U.S. accounted for 22.19% of total card volume worldwide in 2019 yet 33.57% of gross card fraud losses worldwide. One year before, the U.S. accounted for 23.33% of total card volume and 33.99% of total fraud.

For all other countries outside the U.S., fraud reached $19.03 billion in 2019, which equaled 5.79¢ per $100 in total volume. The prior year it was $18.39 billion and 5.77¢.

Losses to fraud mentioned here do not include expenses that issuers, merchants and acquirers incurred from operations, call centers and the investigation of fraudulent transactions. Those costs were up nearly 10% in 2019 over 2018. Merchants’ operational costs related to fraud fighting include the fact that approximately 15% of card-not-present (CNP) transactions involve costly manual reviews of pending sales, even though 90% of those transactions are approved. About 40% of fraud mitigation costs involve manual review of CNP transactions.

American Express, Diners Club/Discover, JCB, Mastercard, Visa, and UnionPay—the global general purpose brands—generated a combined $34.880 trillion in card volume (purchases and cash combined) in 2019, equal to 82.51% of the worldwide total.

Global brand card losses to fraud reached $25.53 billion in 2019, up 2.7% over $24.86 billion in 2018. Global brand cards accounted for 89.11% of total gross fraud losses worldwide in 2019, down from 89.26% in 2018.

When the Nilson Report conducted its annual survey of global acquirer activity for 2019, it identified 89 general purpose domestic-market-only card brands worldwide. These brands are mostly debit only, some are credit only and a few are both. Credit and debit cards with these brands combined generated $4.524 trillion in total volume in 2019, up 13.1% over 2018. Domestic-only cards experienced gross fraud losses of $0.92 billion, an increase of 13.6% over 2018. They accounted for 3.2% of gross card fraud losses worldwide.

Private label payment cards usable only at retail stores, fuel outlets, airlines, medical and dental businesses and other select locations collectively accounted for $961.92 billion in total volume in 2019, up 6.6% over $902.60 billion the prior year. Fraud losses were $0.65 billion in 2019, up 7.8% from 2018. Private label card fraud accounted for 2.3% of all gross card fraud losses worldwide last year.

Other than the ATM networks (Cirrus, Plus, etc.) connected to the global general purpose card brands, credit and debit card transactions at ATMs generated $1.908 trillion in cash volume in 2019, down 2.0% from 2018. Fraud losses of $1.55 billion were down 1.8% from 2018. This ATM fraud equaled 5.4% of all card fraud losses worldwide.

By 2025, total payment card volume worldwide is projected to be $56.182 trillion, with gross card fraud globally expected to be $35.31 billion. Fraud per every $100 in total volume will have declined to 6.28¢. Losses to fraud in the U.S. are projected to reach $12.51 billion in 2025.

Card issuer fraud losses worldwide last year were $19.59 billion, an increase from $19.21 billion in 2018. Issuers accounted for 68.39% of gross fraud losses worldwide. The other $9.06 billion, which equaled 31.61% of total fraud losses, was a business expense of merchants, merchant acquirers and ATM acquirers.

Issuer losses occur when criminals take over existing card accounts, cards are lost or stolen or counterfeited, new accounts are opened purposely to commit fraud using a mix of valid and/or completely false information (synthetic fraud), cardholders or their family members make purchases that they subsequently dispute (friendly fraud) as well as a few smaller categories.

The ready availability of personally identifiable information (PII) for sale on the dark web supports account takeover and synthetic fraud losses. The value of annual sales of PII

is in the $1-billion range. There were over 250 data breaches in the U.S. alone in 2019. Data breaches, particularly the theft of healthcare records that contain valuable PII, can provide the information needed for an account takeover. Quest Diagnostics, a U.S.-based healthcare company, was hacked in 2019, exposing nearly 12 million card accounts in addition

to PII.

Criminals buy PII to obtain access to a valid credit card account. Once in, they have a new card mailed to a different address. Synthetic fraud, a worsening problem in the U.S., is the work of patient professional criminals. They build up large credit lines, typically at multiple issuers. Knowing the accounts they have opened could look suspicious, they sometimes wait 18 to 24 months before they strike. They might attack all accounts at once or bleed them in a steady stream.

Synthetic fraud looks like bad debt to credit managers. It is not counted in any fraud category. However, 20% of chargeoffs are linked to synthetic identity fraud.

Friendly fraud is another growing problem without an official category to count losses. This fraud, which can involve family, friends or acquaintances with access to a card account number, occurs in every country and grows along with the increase in online buying. Card issuers have dispute rights with friendly fraud but also bear high operational costs.

Losses to counterfeited cards created for use in retail stores or ATMs dropped in 2019. In the U.S., counterfeit card losses often occurred at fuel locations that were not EMV-compliant. Magnetic stripes cheated unattended fuel pumps. When used to make an online payment anywhere in the world, stolen card data is sometimes counted as counterfeit card fraud.

Card-not-present purchase volume, which includes purchases made using mobile devices, equaled 15.4% of all purchase volume worldwide in 2019. However, it was tied to 65.0% of all losses to fraud. CNP fraud losses were up across the globe in 2019 with the growth of online sales.

Merchants overall did a better job fighting fraud in 2019. However, some high-volume, high-margin merchants as well as solely digital merchants remained willing to risk fraud if they got a valid card authorization. Merchants and issuers did catch more fraud attempts in 2019, and the percentage of successful fraudulent transactions fell.

Successful fraud fighting continued to be available to large merchants that were able to buy protection in layers of security. The global card networks found success fighting criminals through machine learning AI models able to analyze massive data sets, which spot fraud from organized crime immediately after it first appears and allows for immediate action. The networks have also gotten better at sharing data with law enforcement, issuers, merchants and acquirers.

Merchants pay for all fraud on CNP transactions except when 3D Secure protocol is involved. However, in 2019, 3D Secure acceptance was only in the 15% range in Europe. In the U.S., it was much lower. As online commerce grows, merchants will pay a steadily increasing percentage of total fraud losses. Tokenizing payments is critical to keeping merchant fraud losses and related operational expenses manageable.

Fraud at ATMs in 2019 continued to come from skimming, PIN compromise, dispenser jackpotting, cash trapping, malware, network packet switching and more. Fraud as a percentage of $100 in total volume declined slightly in 2019 from 2018.

Organized professional criminal gangs became more sophisticated in 2019. These gangs were from North Korea, Brazil, India, Nigeria, the Caribbean and Russian-speaking countries. Their fraudulent activities included injecting malicious code into JavaScript used at certain ecommerce sites to move data to another server, including moving data from a payment platform. The sophistication of organized criminals included reverse engineering the fraud fighting practices top merchants use to keep them out.

Prominent among organized criminal gangs is the Lazarus Group from North Korea, which brings military grade cyber expertise to card fraud. The gang’s aim is to quickly monetize fraud. ATM cashouts involving counterfeit cards was its initial pursuit. More recently, Lazarus adopted a smarter fast-cash model involving compromising payment gateways and switches with man-in-the-middle software to authorize cash withdrawals. As Lazarus steals money from issuers, valid cardholders can concurrently make legitimate transactions. Card issuers are unaware fraud is occurring. An estimated 75% to 80% of all ATM cash-out fraud losses get repatriated to North Korea.

Social engineering attacks aimed at obtaining personally identifiable information (PII) increased in 2019. Having at least some PII helps criminals appear to be legitimate when they use email to conduct fraud. Efforts to gain PII include criminals posing as a bank representative and phoning cardholders—a practice known as “vishing.”

Fraud in 2019 occurred with the help of automated botnets (software) deployed by criminals to test issuers and merchants for vulnerabilities.

This practice is called account enumeration as well as credential stuffing. The botnets are programmed with some valid information, usually the 16-digit primary account number, which the criminals have stolen in a data breach. They are looking for the full data set to facilitate an account takeover or significant attack on a line of credit. The aim is to sell that full data set on the dark web. The software executes millions of attempted purchases to discover missing data elements such as postal codes, card expiration dates and CVV codes.

Criminals typically target smaller merchants for account enumeration. Larger merchants have software that catches those attacks.

Prior issues: 1164, 1142, 1118, 1096, 1068