Historically, card-not-present (CNP) payments have been effective for mail and telephone orders, but now they are more typically used in e-commerce and m-commerce. David Orme, senior vice-president at Idex Biometrics, looks at the long-standing issue of tackling CNP fraud
CNP transactions are the biggest routes to card fraud, as this form of payment presents a specific challenge to retailers in being able to verify who the actual cardholder is, and consequently being able to authenticate their payment effectively.
Go deeper with GlobalData
The introduction of EMV Chip-and- Pin brought enhanced authentication and cardholder verification for payment cards, which enabled a decline in card-present fraud. As a result, fraudsters have migrated to CNP routes of attack, particularly for e-commerce and m-commerce transactions.
The main online method of authentication consumers must complete, depending on the retailer, is 3-D Secure, which stands for Three-Domain Server. There are three parties involved in the 3-D Secure process:
- The merchant;
- The acquiring bank, and
- The card issuer, such as Visa or Mastercard.
3-D Secure is an additional fraudprevention scheme that the majority of retailers use via their chosen payment service provider.
Shoppers create a password for each payment card, which is used to authenticate an online transaction through any site that requires the 3-D scheme. 3-D Secure is also the only fraud-prevention scheme that offers companies liability cover for transactions verified by the checks.
How well do you really know your competitors?
Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.
Thank you!
Your download email will arrive shortly
Not ready to buy yet? Download a free sample
We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form
By GlobalDataThis provides additional protection to companies using the scheme. However, it is not completely foolproof. Banks and retailers trialled 3DS (Three-Domain Secure), also known as Payer Authentication, for online transactions, which was successful in the UK from 2008 to 2011.
However, the success was short-lived due to lack of adoption by consumers, who looked for ways to bypass the process in favour of convenience, which also created opportunities for fraudsters.
Authentication process
With the introduction of the regulatory technical standards on Strong Customer Authentication by the EU in September next year, under the Second Payment Services Directive, merchants must require two of the following methods of authentication:
- Something you know/knowledge, such as a PIN or password;
- Something you have/possess, such as a
bank-issued card reader, and - Something you are/inherence (biometric).
Many retailers already require the first option; however, the last two factors have proven difficult for merchants to address.
Knowledge covers the most widely used methods of payment authentication, such as PINs and passwords; however, many banks also encourage a secret question, such as:
‘What was your first pet’s name?’
Possession covers proving that you physically have the card on you, with methods such as one-time passwords (OTPs) issued via SMS or inputting your card into a bankissued reader. However, personal card readers to provide OTPs can be expensive for banks to issue, and extremely inconvenient for consumers to repeatedly use.
The secret to balancing security and convenience lies in the use of analytics and fingerprint biometrics via smartphones. Most smartphones on the market now include integrated fingerprint readers, so it makes sense that retailers and banks leverage this ability to make online – and particularly m-commerce – transactions more secure.
However, we face another challenge: biometric data managed through the smartphone provider as opposed to the card owner.
Smart payment cards with fingerprint biometric sensors are in mass production and due to hit the market in 2019, putting security firmly in the hands of the consumer.
The level of technology behind a biometric sensor makes it very straightforward for the user to record a reference fingerprint, which can easily be uploaded to the card by the user at home, at which point the card can be used over existing secure payment infrastructures – including both chip and ID and contactless card readers – as usual.
Once registered, the fingerprint is held only on the card and not on a central bank database, removing the attractive honey pot of biometric fingerprint data for hackers. It also makes it impossible for casual pickpockets to use stolen contactless cards.
Retailers and bankers can benefit from the perfect balance of convenience and security created by connecting biometric fingerprintenabled smart cards and the Near Field Communications ability of the card direct to the smartphone for online transactions.
Further possibilities would be to add digital dynamic CVV number and Primary Account Number (PAN) tokenisation. This would essentially replace the printed CVV number currently on the reverse of all cards with a digital display that presents a new code whenever the holder’s fingerprint is presented on the card, and the PAN with a token. This means both changing numbers are never exposed to the payments ecosystem other than to the card issuer, as is standard practice.
In turn, the traditional payment card as we know it would be transformed to protect against the theft of static card numbers for fraudulent online transactions and physical card theft in the same breath. This would inherently meet the SCA requirements for online transaction authentication, with an OTP covering knowledge and biometrics covering the inherence requirement. However, this would work with any other authentication method to accompany biometrics to go above and beyond the SCA regulation.
This is an opportunity for banks, retailers and customers to embrace the most secure and convenient methods of authentication to tackle CNP fraud once and for all.
