SPOT & STOP | CARD FRAUD Presented by: Scott Palmer, APACS Cards & Fraud Control Division

1. SPOT & STOP | CARDFRAUD Presented by: Scott Palmer, APACS Cards & Fraud Control Division

2. APACS, the UK payments association • Umbrella body for the UK payments industry • Provides forum for discussion and decisions on wide range of non-competitive issues relating to money transfer • BACS, CHAPS, Cheque & Credit Clearing • Card Services – Technical, MI and Fraud Control • Fraud Intelligence Bureau – card industry intelligence 01

3. UK plastic card fraud losses by fraud type 1994 - 2004 02

4. Chip and PIN Chip and PIN at point-of-sale 03

5. What is Chip & PIN? • A Secure card payment system to help prevent fraud • When paying by plastic cardholders will identify themselves • by a 4-digit PIN rather than signature • Microchips embedded on cards will do job of the magnetic • stripe only more securely 04

6. UK Chip & PIN Rollout: Headlines • UK rollout started in October 2003 • Forecasts for 2005, 99% debit cards and 90% credit will be chip • and PIN • Top 45 retailers will have chip and PIN terminals by the end of • 2005 05

7. Trial: Key Retailer Learnings • Staff adapted quickly • Staff training vital but does not take long • Privacy is a concern for some customers • PIN bypass used for small proportion of transactions • Transaction times are good • Consider needs of people with disabilities 06

8. What to do if a customer forgets their • PIN • After three attempts a card will become locked. • Be extra vigilant if a locked card is presented. • Follow the four-step security check outlined in this training. • If you are suspicious of the card or the cardholder make a Code 10 call. • Tell the customer to contact their card issuer. 07

9. Liability shift A liability shift came into force on 1 January 2005. After this date any retailer not using a chip and PIN terminal in their store may become liable for the cost of a fraudulent transaction. This Europe-wide liability shift has no impact on the customer but affects retailers who have not upgraded their point-of-sale equipment. They may become liable for card fraud losses for the first time. • A chip and PIN retailer is protected against liability. • A fraudster will target the weakest link. If your store is not chip and PIN complaint and other stores in your area are, the fraudster will target your store! 08

10. Getting help from the experts… • Website: www.chipandpin.co.uk • Information video • Retail report on trial • Customer leaflets • Your acquirer • Vendors (several have websites on chip and PIN) • Trade Associations 09

11. Non-chip and PIN transactions • Extra vigilance should be paid when accepting cards that are not chip and PIN. • Follow a four-step routine every time you handle a card transaction and you could earn £50! 10

12. Check that the first four digits appear above or below the embossed card number On MasterCard and Visa cards, ensure the printed digits appear above or below the embossed card number. 11

13. Flying V and unique MC • All genuine MasterCard and Visa cards contain embossed security symbols. 12

14. Check the card under a UV light If you have a UV light check that the appropriate mark appears: Visa MasterCard 13 Maestro Switch Solo American Express Diners Club

15. Examples of counterfeit cards 14 No printed numbers above or below the embossed card numbers ‘Flying V’ is incorrect ‘MC’ is incorrect

16. Check the number on the card matches the receipt • Check the number on the front of the card matches the number on the till receipt • If it does not, the card is skimmed 15

17. Skimming Skimming occurs when the genuine data from the magnetic stripe on one card is copied without the cardholders knowledge and put on another card 17

18. Skimming devices Skimming devices can vary in appearance and size, but all will have a slot for swiping the card to capture a copy of the information contained on the magnetic stripe. 18

19. Checking the signatures • Compare the signatures • Is the spelling right? • Look for big, messy writing on the signature strip – maybe covering the real signature • Check the signature strip for signs of tampering 16

20. Cheque book & Cheque card • Look for the name on the card, the sort code, card • number and expiry date • Cheque must be within card limit • Do not accept two cheques for one transaction • YOU must write the card number on the reverse of the • cheque – Always the long number in the middle of the • card unless there is a separate card number noted in • bottom left hand corner • All cheque guarantee cards will carry an image of • William Shakespeare 19

21. Cheque book & Cheque card 20 £100 Silver £250 Gold

22. If you must do a manual key entry • If a card fails to swipe or park be extra vigilant. • Follow the PAN Key Entry (PKE) process if your terminal has this facility. • After keying in the card details, use a manual imprinter and fallback voucher to take a copy of the card’s embossed number. Mark Non value, swipe failure and fully complete the fallback voucher with the details of the sale, then ask the cardholder to sign the fallback voucher. Write the terminal receipt number and authorisation code on the signed voucher. • Give the customer copies of both the terminal and imprinted fallback voucher. • You cannot do a manual key entry for a Visa Electron card. Visa Electron cards are for electronic use only. 21

23. What is a Code 10 call? • A Code 10 call lets the operator know that you are suspicious of the card or cardholder • During the call: • hold the card • if the customer can hear you the operator will ask questions you can answer with ‘yes’ or ‘no’ • The banks won’t mind if it turns out to be a false alarm – it is better to be cautious than let a criminal get away with fraud. 22 NOTE: The fact that a transaction is authorised and an authorisation code is provided does not guarantee payment, whether it be a standard authorisation or a Code 10 call. The authorisation simply means that the card has not been reported lost or stolen and that there are sufficient funds available at the time of authorisation.

24. Always ensure that you… • Keep hold of the card – unless you feel threatened • Defuse the situation – don’t give the customer reason to be aggressive • Use excuses like “the banks have asked us to make extra checks” • Never put yourself, your colleagues, customers or property at risk 23

25. Vigilance pays! • If you retain a card and stop a fraud you qualify for at least a £50 reward • There’s no limit to how many times you can claim • Over £19 million was paid out in rewards during 2003 • Return the card (and cheque if applicable) as instructed by your bank or your own operating regulations 24

26. Dealing with the police • If police need to take the card for evidence, you can still claim the £50 reward. You will need: • contact details of the police station and officer • the crime reference number • a receipt from the police officer • Tell your bank what has happened and ask how to organise your reward. 25

27. Preserve any evidence • Cut the bottom left corner off the front of the card • Preserve finger prints on card and sales voucher • Retain any CCTV video evidence and note date and time • Fill in an Incident/Personal Description Form • Follow the directions of your Authorisation Centre 26

28. SPOT & STOP | CARD-NOT-PRESENTFRAUD

29. Contents • Today’s session will focus on: • the extent of the CNP fraud problem in the UK • learning about CNP fraud prevention solutions • considering best practices to minimise CNP fraud • what to do next? 29

30. CNP fraud on UK-issued cards 1998 - 2004 30

31. Introduction to CNP • CNP transactions are where the card and cardholder are not physically present typically: • - telephone order • - Internet • - mail order • - fax • Merchants need to understand the risks associated with CNP transactions • The UK chip and PIN programme is likely to focus fraud to the CNP environment • CNP fraud continues to grow in the UK 31

32. The risks from CNP fraud • CNP merchants cannot: • check the visible security features on a card • confirm the transaction is made by the genuine cardholder • validate cardholders billing addresses for cards issued outside the UK • As the card cannot be sighted, the merchants takes the risk. Therefore merchants are responsible in the event of fraud • Fraudsters committing CNP fraud: • are anonymous • use other false details to commit the fraud • have goods and services delivered/provided to addresses that do not belong to the genuine cardholder 32

33. Fraud from other countries - 2003 33

34. Authorisation does not • guarantee payment • Authorisation only confirms two things: • that there are sufficient funds in the account • that the card number provided has not been reported lost or stolen 34

35. Address Verification Service (AVS) and Card Security Code (CSC) 35

36. AVS and CSC (continued) CSC allows merchants to validate that the card account is legitimate. Card Security Code – MasterCard, Visa and Switch 36 Card Security Code – American Express

37. £100,000 £90,000 £80,000 £70,000 £60,000 TotalFraudLoss £50,000 £40,000 £30,000 £20,000 £10,000 £0 2001/04 2001/05 2001/06 2001/07 2001/08 2001/09 2001/10 2001/11 2001/12 2002/01 2002/02 2002/03 2002/04 2002/05 Month/Year AVS/CSC does work!! AVS/ CSC introduced 37

38. Top tips to help spot and stop the • card-not-present fraudsters • Is the sale too easy? Is the customer disinterested in the price or details of the goods? Are they a new customer? • Are the goods high-value or easily resalable? • Is the sale excessively high in comparison with your usual orders? Is the customer ordering many different items? Do they seem unlike your usual customer? • Is the customer reluctant to give a landline contact phone number – are they only prepared to give a mobile number? 38

39. Questions 40

40. To order your FREE fraud prevention Retail Packs, please visit our website at: www.cardwatch.org.uk For information on chip and PIN please visit website: www.chipandpin.co.uk 41