As the remote payments domain (think in-app and browser-based payment transactions) continues to grow at around 15% a year, that growing number means the size and scale of fraud losses are going to increase. And they have - in both absolute terms and as a percentage of overall transaction volume. That also means rising chargeback rates for many merchants.
Fraud prevention today is about how quickly we can separate good customers from questionable ones and, for those doubtful transactions, use the right set of tools and data sources to optimize speed, costs, and fraud losses.
The payment industry's responses to ongoing payment security concerns are many. We have procedural approaches and technical ones. For example, we are requiring merchants to attest to their compliance with PCI security standards that themselves include procedural requirements.
Knowing who you're dealing with online is critical if you're taking transaction risk. Digital identity is tough. To address that challenge - and it is a challenge - relying parties, those who take on risk, employ two broad categories of technology: active tools that require user interaction and passive network-based approaches.
In this, the first of a two-part podcast series with First Data executives, Ajay Guru, VP of Merchant Fraud Solutions at First Data and George discuss the impact of fraud on the merchant, what the merchant has to do to manage it, and the classes of tools and techniques available to mitigate fraud.
Online trust requires a context-based understanding of who we transact with. Attributes about us are needed to build that trust, but in many transaction contexts we share more than we need to.
Digital identity is a crisp sounding term that belies a complex layer of concepts. There is identity proofing, identify verification, identity assurance. Each addresses one element of the many questions raised by digital identity.
The Internet of Things may be a hot topic but its security isn't hot at all. Up until recently, IoT device manufacturers and buyers haven't cared much about security, a disinterest that's led to over one hundred thousand surveillance cameras being hijacked by Mirai botnet malware. While cameras aren't making or accepting payments (yet) it's easy to imagine automobiles paying for tolls and fuel directly. If it's not my Roku box, maybe it's Alexa or Google Home that makes payments on my behalf over the IoT. The payments industry is working to get out in front of this potential trouble.
The Internet of Things (IoT) will bring us a tsunami of network-enabled devices, for consumer use as well as yet to be imagined industrial and commercial applications. Many of these devices will be payment enabled, many using card payment rails. Securing those billions of IoT devices is going to require techniques deployed by the mobile industry, the card industry, and other sectors. Cryptographic hardware will be part of the solution.
The term identity gets used a lot whenever internet payments and security are discussed. Knowing who we transact with is still the knotty problem. Strong authentication is required. Identity verification is required, too. A means of sharing the fruits of that work among the parties involved, especially those taking on risk, could save everyone a lot of cost and effort. That's the notion behind federated identity and other means of securely sharing identity attributes without undermining privacy.
