“
The rollout of EMV across Latin America has eroded card-present fraud in the region. But the challenge is to prevent criminals from migrating to card-not-present channels. Robin Arnfield reports.
Go deeper with GlobalData
As one of the fastest growing cards market worldwide, Latin America represents an attractive target for fraudsters. According to the CEB Financial Services report, Non-Cash Payment Trends and Volume Projections: Across Latin America (2005-2016), Latin American credit and debit card usage will grow at a compound annual growth rate (CAGR) of 11.2% between 2012 and 2016.
In Brazil, Latin America’s largest card market, the number of credit, debit, and store cards in issue rose by 9% year-on-year to an estimated 737m in 2012, says Brazilian credit card trade association AssociaÁ„o Brasileira das Empresas de Cartıes de CrÈdito e ServiÁos (ABECS). The number of credit, debit and store card transactions rose by 15% to an estimated 9.5bn, and the value of transactions grew 20% to an estimated BRL805bn (USD387.6bn).
Banco de MÈxico, the country’s Central Bank, says that the total number of Mexican credit cards in issue rose by 7% year-on-year to 24.8m in June 2012, while the number of debit cards in issue rose by 23% to 98.1m, including additional cards issued on a credit or debit card account.
Fraud survey
In the third quarter of 2012, ACI Worldwide and Aite Group surveyed 5,223 consumers in 17 countries, including Brazil and Mexico, about their experiences of card fraud. The survey results, which were not broken down into card-present and CNP fraud, were published in the Aite Group report Global Consumers React to Rising Fraud: Beware Back of Wallet.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataOf the 17 countries surveyed, Mexico had the highest fraud rate, with 44% of Mexican respondents saying they had experienced credit, debit or prepaid card fraud in the previous five years. The US came second with 42%, followed by India with 37%. Brazil came seventh, with 33% of Brazilian respondents having experienced card fraud in the previous five years.
The survey found that 37% of Mexican respondents reported having experienced credit card fraud in the previous five years, compared to 30% of Brazilians. A quarter of Mexican respondents had experienced debit card fraud, compared to 17% of Brazilians. A tenth of Mexican respondents reported having experienced prepaid card fraud, compared to 7% of Brazilians.
"One reason for high levels of card fraud in Brazil, Mexico, and the US is the fact that cardholders in those countries use their cards much more frequently than European cardholders," says Aite Group analyst Shirley Inscoe. "This exposes them to a greater risk of fraud. In Germany and Sweden, where cardholders make less frequent card transactions, we found that 13% and 12% of respondents had experienced card fraud."
Risky behaviour
The ACI-Aite survey identified several risky cardholder behaviours. 16% of Mexican respondents and 9% of Brazilian respondents admitted to making a note of their PIN and keeping it with their card, while 22% of Brazilians and 20% of Mexicans carried out online banking or online shopping without security software or on public computers.
"65% of consumers surveyed in Mexico and 42% in Brazil said they never received anti-fraud information from their banks," says Mike Braatz, senior vice president and product line manager, payment fraud, at ACI Worldwide. "There’s still work to be done by Latin American banks in educating cardholders about card fraud risks."
A June-August 2012 survey of Latin American consumers by US fraud prevention specialist EasySolutions found that 38% of respondents don’t check their bank or credit card statements regularly. Respondents in Central America had the highest rate, at 49%, for not checking their statements regularly, with respondents in Mexico and the Southern Cone (Chile and Argentina) having the lowest rate, at 31%.
Skimming
"Skimming has been a major problem in Latin America for some time, especially for debit cards," says David Lott, senior vice president at US consultancy Speer & Associates.
"As in other parts of the world, card fraud is perpetrated in Latin America by highly-organised criminal gangs," says Lott. "A problem that has been seen a little more in Latin America than in some of the more developed countries is the recruitment of an employee of the card issuer to collect cardholder information internally and then sell it."
Lott says that, while some gangs manufacture counterfeit cards which can be embossed and encoded with stolen account information, normally criminals encode the information onto a legitimately-manufactured card that has been lost or stolen. This means the card number embossed on the legitimate card doesn’t match the information encoded on the mag-stripe.
According to Trend Micro TrendLabs’ Annual Security Roundup 2011, the value of a stolen credit card number in the cybercriminal underground in Central America is USD3-USD8, compared to USD 1- USD 3 for a stolen US credit card number.
"In Latin America, we see a lot of card fraud on goods such as electronics equipment and jewellery that can be sold for cash," says Braatz.
Migrating to EMV
Driven by Visa and MasterCard liability shift deadlines, the Latin American cards industry has been migrating to EMV over the last six years.
Edgar Betts, the Smart Card Alliance Latin America’s associate director, says Brazil, Colombia, Mexico, and Venezuela have almost completely migrated their debit and credit cards to EMV. "Due to national regulations or market forces, these countries have led the migration process in the region," he says.
"Around 20 Latin American and Caribbean countries are actively migrating to EMV, including Bolivia, Chile, the Dominican Republic, Ecuador, Guatemala, Panama, Peru, Trinidad & Tobago, and Uruguay," Betts says. "However, more work is needed in Argentina, Paraguay, Central America, and the Caribbean to encourage migration to EMV."
Unlike Europe, which, as part of its EMV migration, replaced signatures with PINs, in many Latin American countries EMV-based credit cards are still used with signatures.
"If a Latin American country requires signatures at the point of sale for mag-stripe credit cards, it will continue to ask for signatures for EMV credit cards," says Betts. "In Latin America, debit cards have been historically PIN-based for point-of-sale transactions, which will continue with EMV debit cards."
Chile is one of the few Latin American countries that will opt for EMV chip-and-PIN for credit cards, Betts notes. "PIN entry is already required for mag-stripe credit cards in Chile," he says. In Brazil, EMV-based credit cards also require PIN entry.
"In most other markets, credit cardholders will be required to sign for EMV credit card transactions, continuing the previously established pattern with mag-stripe credit cards," says Betts.
Brazil: strengths and weaknesses
Card fraud hit record levels in Brazil, Latin America’s largest cards market, in the late 1990s, as the card market began to expand. This pushed Brazilian banks to accelerate their migration to EMV, resulting in a substantial decline in card counterfeiting.
"All Brazil’s ATMs and POS terminals have been migrated to EMV," says Alexandre Nardy Soares, a client partner at cards analytics firm FICO Latin America. "Over 80% of credit and debit cards are already migrated to EMV, and the remainder will be migrated by the end of 2013."
"Brazilian private-label store cards have yet to be fully migrated to EMV, which makes them vulnerable to fraud," notes Eduardo Daghum, chief executive of Brazilian card fraud prevention firm Horus Group.
Brazilian banking industry association FederaÁ„o Brasileira de Bancos (Febraban) says that in 2011 Brazilian banks lost BRL900m (USD429.5m) from MOTO (mail order/telephone order) card fraud and from card-present credit and debit card fraud. Banks lost a further BRL300m from online credit card fraud in 2011, Febraban reports.
According to Serasa Experian, Brazilian criminals have increasingly been turning to ID theft and fraudulent account applications. Brazilian identity fraud cases rose by 6% year-on-year in the first nine months of 2012 to 1.56 million, the credit reference bureau says. "The fraudsters use their victims’ data to obtain cheque books, credit cards and bank loans," says Ricardo Loureiro, Serasa Experian’s president.
Mexico: cross-border fraud
"Mexican POS terminals and credit cards have already been completely migrated to EMV," says Carlos Avila Lopez, a director of US consultancy Bank Solutions Group. "Around 70% of ATMs and debit cards have been migrated to EMV, and this process will be completed in 2013. In 2010, the Mexican government mandated the use of EMV by 2013 for securing card transactions."
"In Mexico, the merchant segments most affected by card fraud are airlines and petrol stations," says Avila Lopez.
Because it lacks a national identity card scheme, Mexico suffers from a major ID fraud problem, says Betts. "There have been several attempts by Mexican governments to issue a national ID card," he says. "It is expected that, under the new government which came into office in December 2012, this may finally occur."
"As a result of its EMV migration, Mexico has seen an increase in cross-border fraud involving counterfeit Mexican cards being used in the US," says Avila Lopez. "This is due to the fact that the US has yet to implement EMV."
According to Mexican consumer rights agency ComisiÛn Nacional para la Defensa de los Usuarios de las Instituciones Financieras/National Commission for the Defence of Financial Services Users (Condusef), 55% of Mexican cloning incidents took place in bars and restaurants, 25% in retail stores, and 20% in hotels and tourist centres in 2011.
Chile accelerates migration
In July 2012, criminals cloned 2,153 cards belonging to residents of the Chilean region of AraucanÌa, resulting in fraud losses totalling CLP540m (USD1.12m). Chilean website Cooperativa.cl quoted Raphael Bergoeing Vela, superintendent of Chilean bank regulator Superintendencia de Bancos e Instituciones Financieras/Superintendency of banks and financial institutions (SBIF) as saying the cloning incident was the worst fraud case in Chilean banking history.
Chilean newspaper El Mercurio reported that 70% of the fraudulent transactions involving the counterfeit cards took place in Chile and the remainder in countries such as Panama, the Dominican Republic and Colombia.
Betts says the AraucanÌa incident had a positive effect in that it shattered the Chilean banking industry’s complacency about card fraud and accelerated the country’s migration to EMV. "The incident affected all Chile’s banks except the one bank that had introduced EMV," he says. "It revealed serious vulnerabilities in the affected banks’ security processes."
"Prior to the AraucanÌa incident, Chilean banks thought that their card systems were safe and that they didn’t need to rush to introduce EMV due to Chile’s small perceived level of card fraud," says Betts. "Subsequently, the banks realised they needed to implement EMV."
Betts says that the bank which had introduced EMV cards and wasn’t affected by the cloning incident, has gained customers. "Cardholders whose cards had been cloned have moved to that bank because they feel it has safer systems than their bank," he says.
Card-present fraud
Betts says the Latin American countries that have migrated to EMV have virtually eliminated their card-present fraud.
"Chip-only EMV cards which don’t require PIN input are effective in eradicating card counterfeiting for card-present fraud," says Betts. "If an EMV card’s mag-stripe is cloned, when the counterfeit card passes through an EMV-enabled POS terminal’s mag-stripe reader, the reader identifies it as an EMV card. The card is rejected because the reader requires that the transaction be conducted through the EMV chip for approval. As mag-stripe-only card readers are hard to find in Latin America, this has caused fraud to migrate to CNP transactions." MasterCard Advisors estimates that 80% of Latin American card readers are EMV-compliant.
Another benefit seen by Latin American countries migrating to EMV is that the approval rates for legitimate domestic and international point-of-sale card transactions have increased, says Betts.
"According to a study carried out for Visa by First Annapolis, the rate of credit and debit card approvals rose from 80% before the introduction of EMV to over 90% in Mexico and Brazil," Betts says. "With mag-stripe cards, a legitimate card transaction may be declined because of the location of the cardholder, for example. With EMV, merchants are better able to authenticate card transactions."
Latin American countries that have yet to migrate to EMV have significantly increased their level of card-present fraud because criminals have targeted them. "Fraudsters migrate from Latin American countries that have already implemented EMV to the weakest link," says Betts. "They also carry out card cloning and fraud in the Latin American countries that have poor enforcement of anti-fraud laws or ineffective anti-fraud laws."
Betts says that efforts are underway to improve anti-fraud legislation in Latin America. "Some countries used to refuse to accept video evidence of people tampering with ATMs and POS terminals, as they said this was insufficient to identify and prosecute perpetrators," he says. "However, video evidence of ATM and POS terminals being tampered can now be admitted in Latin American court cases."
"We’re seeing across the world, including Latin America, a move by governments to introduce regulation to protect consumers against card fraud and to make it easier to prosecute card fraud perpetrators," says Braatz.
"The Brazilian government is holding discussions about introducing legislation that specifically classifies cybercrime as a distinct and punishable offence," says Nardy Soares. "I think this legislation will definitely be introduced."
Card-not-present fraud
"When EMV is rolled out in a market, whether it is EMV-and-signature or EMV chip-and-PIN, fraud migrates from the card-present channel to the CNP environment," says Braatz.
According to a blog posting by CEB TowerGroup analyst Brian Riley, CNP fraud can, in some cases, be 15 times higher than card-present fraud.
"Card cloning is no longer an issue in Brazil, as it now accounts for under 2% of total Brazilian card fraud," says Nardy Soares. "The main problem now is MOTO and online fraud. Criminals no longer need to make counterfeit cards, as they can capture the card information from the mag-stripe, for example when a Brazilian EMV card is used legitimately in a non-EMV-compliant country, and make fraudulent purchases online."
Nardy Soares adds that there have been cases where Brazilian fraudsters have been able to capture card information in transit between POS terminals and retailers’ local servers. "Wi-Fi links between POS terminals and the local servers that connect up to acquirers’ networks may not be encrypted," he says. "So you will get fraudsters taking laptops into Brazilian department stores to hack into Wi-Fi links."
Avila Lopez says Mexico has seen a significant rise in CNP fraud due to the country’s EMV migration. "Currently, 25% of card fraud in Mexico takes place on CNP channels," he says. "A further 15% takes place through theft of information from issuers, acquirers and merchants’ databases, while the remaining 60% occurs as a result of skimming devices being attached to Mexican ATMs and POS terminals."
To prevent data theft, merchants and processors need to comply with the PCI (Payments Card Industry) security standard. "The problem is that there is a lack of PCI compliance among Mexican processors and merchants," says Avila Lopez. "Also, Mexican e-merchants have mostly not implemented the Verified by Visa and MasterCard SecureCode online authentication platforms."
"PCI is not as widely adhered to in Latin America as it is in the US," notes Braatz.
Working with Visa and MasterCard, the Latin American payments card industry is working to address the problem of CNP fraud, Betts says. "The technology they are planning to introduce will use MasterCard SecureCode and Verified by Visa in combination with dynamic authentication, where a one-time passcode is generated for each transaction," he says. "Brazil, Colombia, Mexico, and Venezuela are already using this technology for e-commerce payments."
There are various ways to calculate a one-time passcode for use in e-commerce. "One method involves banks issuing credit and debit cards containing a one-time-passcode calculator," says Betts. Alternatively, a one-time passcode can be issued via SMS to the cardholder’s registered cellphone, or the cardholder could be issued with a chip card reader that generates a one-time passcode.
"The use of Verified by Visa and MasterCard SecureCode with static passwords has already significantly reduced CNP fraud in Latin America," says Betts.
Anti-fraud efforts
"Many of the anti-fraud measures that have proved successful in other regions are starting to be deployed in Latin America," says Lott. "These include providing cardholder and merchant education about fraud risks; improving issuers’ internal database security; conducting secondary verification such as asking for cardholders’ postal codes or entering the last four digits of the number embossed on the card to check it matches the number on the mag-stripe; and running fraud detection software on the issuer’s cardholder database to spot major variations in transaction patterns."
Lott says some larger Latin American issuers are beginning to risk-score each card transaction as part of their authorization process. "If the transaction looks suspicious due to its score, it may be denied," he says.
"Brazilian card processors, banks, retailers have invested a lot of resources to reduce card fraud," says Daghum. "But what is still missing is an internal culture within the enterprise of focusing on fraud prevention. The problem is that Brazilian card issuers are often more interested in other aspects of business, such as credit card lending".
†
“
