Contactless payments hit record levels as contactless fraud follows

For the first time, more payment transactions in the UK are made using a contactless card or device instead of chip and pin. This is clearly a boon for retailers, as it becomes even easier to make a transaction, but an uptick in frictionless payments also might mean an increase in contactless fraud.

Lack of barriers helps contactless fraud flourish

According to Worldpay, contactless usage jumped nearly 30% in stores between June 2017 and June 2018, prompting EVP Steve Newton to comment, ‘The rise of contactless is not simply about tap and go; it’s about convenience and reducing the parts of the shopping experience that customers find irritating, like queuing and waiting to pay.’

This is why contactless payments have grown so rapidly in the UK. Retailers, particularly those in the convenience and hospitality sectors - are adopting contactless because it means they carry no liability it reduces friction at every stage of the retail transaction.
Unsurprisingly, as the use of contactless devices rises, so does fraud. Recent figures from UK Finance showed that contactless card fraud overtook cheque fraud in the first half of 2017, hitting GBP 5.6 million. Criminals that can get hold of someone’s card or device can instantly make small purchases, with few security barriers in their path.

Moreover, the nature of a sub-GBP 30 transaction is difficult to spot through traditional anti-fraud measures. By their nature, fraudulent contactless transactions often look like regular payments and may not be declined.

And while there are barriers in place to hinder contactless fraud, bad actors are innovative and smart. In the past, we have seen cases where criminals will strategise their payment patterns, allowing them to spend hundreds of pounds before a bank is made aware of the next business day. While loopholes are being identified and closed by issuers, weak practices have allowed contactless card fraud to flourish.

In even more extreme cases, a card doesn’t need to be stolen. Fraudsters are now using ‘contactless skimming’ machines to read credit card information right out of your pocket, then use a merchant account to make contactless payments. In a 2013 study published by the University of Surrey, a team managed to ‘successfully receive contactless transmission from distances of 18 to 31 inches’ using a skimming device.

Learning behaviour is key

The only way to combat this growing fraud is to better understand the patterns and behaviours of cardholders and the businesses that are stolen from. If we can spot the clues, we can stop the fraud.

On the issuer side, contactless fraud is being fought by learning the spending patterns of individuals. If you can monitor the location and frequency of spending patterns, this type of fraud is not impossible to stop. For example, a cardholder may go to their local supermarket a few times a week, a coffee shop once a day and the local café every lunchtime, each time making a single contactless payment. But, if the cardholder suddenly goes to a supermarket on the other side of town and makes high velocity transactions in a single evening, or makes transactions in five previously unvisited shops in a quick succession, fraud may be happening and the card can be frozen.

Some POS devices may also be configured to allow retailers to transmit ‘line detail’. This can also be an important tool in spotting contactless fraud as it allows the merchant to send details on what the purchase is for. This would be particularly relevant for spotting changes in purchasing behaviour, for example, a known non-smoker suddenly buys a large amount of cigarettes in one afternoon. Owing to this, we expect an increase in this level of POS specificity as contactless fraud becomes more prevalent.

It’s also possible to monitor and intercept contactless fraud from the merchant side. Often, it might be as simple as identifying a single card being tapped at a merchant POS at high velocity, which is perhaps evidence of a merchant working in partnership with a skimming fraudster, using a card emulator to repeatedly accept payments using stolen information.

Beyond that, behavioural analytics can assess the attributes of the merchants accepting card payments, such as merchant category code. This provides insights into the scope of the business activity (retail vs gaming) and allows for the comparison of that business activity to peers in the vicinity to identify out-of-the-ordinary payment activity. Then, when transaction volumes change or a ‘shift in spend behaviour’ is identified or more chargebacks are received, it can be flagged for possible fraudulent activity, allowing the acquiring bank to investigate further.

More contactless fraud on the horizon

There are already discussions amongst issuers and acquirers to increase the contactless limit to GBP 50 and if that happens, it will be even more advantageous for retailers and those in the hospitality industry, but it will likely mean a further uptick in contactless fraud. Simply because it reduces additional barriers for fraudsters to steal even more.

If we do see an increase in the contactless limit, acquirers and issuers will have to monitor even more closely to ensure fraud is spotted and stopped. Fraudsters will never stop being innovative in their pursuits, so we all have to get smarter to ensure that frictionless payments do not lead to more frictionless fraud.

About Simon Rushforth

Simon has over 16 years’ experience in fraud operations and payments. Having worked in all elements of the payment chain, including merchants, acquirers, payments services providers and qualified security assessors – Simon has gained a wealth of knowledge in multi-channel fraud prevention, payments and credit risk, and payment security and compliance. At Featurespace, Simon further strengthens the financial services product team and ensure that the development of our ARIC platform matches our customers’ needs and expectations for fraud prevention in financial services.

About Featurespace

Featurespace is the world-leader in fraud prevention by combining adaptive behavioural analytics and anomaly detection to automatically identify risk and catch new attacks as they happen. The increased accuracy of understanding behaviour strikes the balance between improving fraud and risk detection and operational efficiencies, while also reducing the number of genuine transactions that would be incorrectly declined due to traditional rules by as much as 70%.