Online
2017 Fraud
North Benchmark
America
Edition Report:
Persistence
Is Critical
CyberSource is
a Visa solution

Table of Contents

2

Introduction

3

Survey Respondents

3

Fraud Management: A Balancing Act

4

Importance of Protecting Against Account Takeover

4

Automated Screening: Relying on the Right Set of Tools

4

Manual Review as Part of Fraud Operations

6

Managing Fraud in Different Channels

7

Accept More Genuine Orders While Guarding Against Fraud

8

Cross-Border Orders—What’s the Fraud Impact?

9

Conclusion

10

How CyberSource Can Help10

About Us

11

Contact CyberSource

122017 North America Online Fraud Benchmark Report© 2017 CyberSource Corporation. All rights reserved.

Introduction
Consumers continue to buy more goods and services
online, increasingly with their mobile devices. Businesses
recognize the imperative to accommodate these customer
trends. Yet to stay competitive and retain customer
loyalty, businesses must offer frictionless eCommerce andmCommerce purchasing experiences, and support the
emergence of new sales channels, such as social channels.
At the same time, businesses must protect themselves
and their customers from the growing threat of online
fraud. Yet most businesses are forced to combat those
attempts while drawing on constricted, unchanging fraud
management budgets and limited resources.
The good news: Our latest survey of U.S. and Canadianbusinesses shows that businesses are having some successin their battle against fraud. For example, the survey results
suggest businesses are succeeding in controlling losses
due to fraud and even reducing the number of orders
going to manual review.

they must also constantly strive to accept more genuineorders so they can improve the customer experience,
maximize revenue, make operations as efficient as
possible, and cut operational costs.
This report highlights key trends and challenges facing
North American businesses and provides some insights
regarding how your peers are addressing fraud. It alsopresents a variety of tools and approaches that can help
your business ramp up fraud management efforts while
increasing revenues and controlling costs.

Survey Respondents
The survey—about online, mobile, and mail order/
telephone order (MOTO) fraud management practices—
was conducted by Confirmit.

Still, businesses cannot ease up on their efforts. As they
continue to improve fraud detection and minimize losses,

Participants:• 466 businesses from the U.S. and Canada• CyberSource customers and non-customers• Representing over 12 percent of the total U.S. andCanadian eCommerce market1
Administered:• September–October 2016

Type of MerchantSize of MerchantType of goods or services soldAnnual online revenue

TravelTravel
services
services

4% 4% 21%21%

32%32%36%36%

OtherOther
services
services

17%17%

52%52%
PhysicalPhysicalgoodsgoods

DigitalDigital
goodsgoods$100M+$100M+ <$5M+
<$5M+

7% 7%

18%18%
14%14%

Subscription
Subscription
services
services$25M–$100M$25M–$100M$5M–$25M$5M–$25M

1© 2017 CyberSource Corporation. All rights reserved.

eMarketer 2016.

2017 North America Online Fraud Benchmark Report3Fraud Management:
A Balancing Act

Importance of Protecting
Against Account Takeover

Fraud management continues to be a balancing act as
businesses constantly adjust their fraud strategies tominimize losses, maximize revenue, and control operationalcosts. This year’s survey suggests that North Americanbusinesses are succeeding in controlling direct fraud loss
(chargebacks plus credits issued due to fraud). Fraud losses
reported by North American businesses have stabilized
over the past few years. In addition, these businesses aremanually reviewing fewer orders than in the past while
rejecting approximately the same percentage of orders.

Account takeover fraud is among the top three types offraud experienced by survey respondents. This typeof fraud occurs when a fraudster exploits a customer’s
personal information, stored with a merchant, to takecontrol of an existing account or establish a new one, andthen uses the account to make unauthorized transactions.

Still, there is important work to do. As the survey
suggests, fraud teams must strive to optimize their fraud
management efforts by:• Becoming even more efficient—in particular, by more
effectively managing the manual review process• Turning away fewer genuine customers• Streamlining fraud management across all channels

Small Fraud Management Budgets
Fraud management teams are often forced to workwith very small budgets. In fact, more than half of thebusinesses surveyed spend less than 1 percent of theirdigital commerce revenue managing fraud. These
results underscore the importance of maximizing
the effectiveness of fraud management tools and theefficiency of operations.

42017 North America Online Fraud Benchmark Report

Among all survey respondents, 44 percent acceptedsome type of recurring or subscription payment. Thosebusinesses derive an average of 28 percent of theirrevenues from recurring payments. Yet only 39 percent
of all survey respondents had tools in place to monitor
account takeover fraud.

Automated Screening: Relying
on the Right Set of Tools
Finding the right tools to automatically screen for fraud is
key to achieve the right balance among minimizing losses,
maximizing revenues, and controlling costs. Businesses canlower their fraud losses by deploying accurate, automateddetection, and avoid unnecessary overhead by saving
manual review for only the most ambiguous orders.
During the automated screening process, a combinationof tools—including validation services, proprietary data,
multi-merchant data, and device tracking—is typicallyapplied to determine the likelihood of fraud.

© 2017 CyberSource Corporation. All rights reserved.

Most-Adopted Fraud Detection Tools
Card Verification Number (CVN)88%

Address Verification Service (AVS)

3%

82%

Postal address validation services

4%

60%

8%

Geographic indicators/maps

54%

6%

Email verification

54%

12%

Phone number verification/reverse lookup

49%

8%

Search engine results

41%

5%

Social networking sites

36%

7%

Payer Authentication (3-D Secure)Paid-for public records services
Credit history check

33%

17%

22%
16%

Validation
services

6%

Percent currently using

6%

Percent planning
new implementation

Two-factor phone authentication (in-app, SMS, email) 12% 11%
Biometric indicators (voice recognition, keylogging) 5% 9%
Customer order history

3%

72%

Negative lists/blacklists (in-house lists)

4%

66%

Positive lists/whitelists

54%

8%

Velocity test

53%

6%

Fraud scoring model—company-specific

51%

12%

Proxy detection

47%

Customer website behavior/pattern analysis

40%

Shared negative lists—shared hotlists
Multi-merchant purchase velocity/identity morphing

27%
23%

Geolocation information (country, city, and so on)
Device fingerprinting© 2017 CyberSource Corporation. All rights reserved.

8%
5%Multi-merchantdata/purchasehistory

11%
9%

56%
36%

Your proprietarydata/customer
history

5%
10%

Purchase device
tracking2017 North America Online Fraud Benchmark Report5The Most Effective Fraud Tools
Survey respondents report that some tools are more effective than others.

58%

Percent of merchants selecting as
one of their three most effective tools

53%
42%

40%

39%
28%

Address
Verification
Service

Card
Verification
NumberDevicefingerprinting

Fraud
scoring
model

Payer
Credit history
Authenticationcheck(3-D Secure)

Identifying the Most Important KPIs
The majority of survey respondents pinpointed
chargeback rate as the most important KPI for
fraud management, followed by various versionsof fraud rates.
1. Chargeback rate (62 percent)*
2. Fraud rate by value (47 percent)*
3. Confirmed fraud rate (35 percent)*
4. Fraud rate—order volume (27 percent)** Percent of respondents who selected this KPI as one of their top three

27%

26%

25%

25%

Email
verification

Customerorder history

Negativelists

Two-factor
phoneauthentication

Manual Review as Part of
Fraud Operations
Manual Review Is Helpful,
But Can Be Costly
Manual review remains prevalent:• Seventy-nine percent of North American businesses
conduct manual reviews.
• On average, these businesses manually review
25 percent of orders.
However, manual review is often a costly aspect of fraud
management operations, frequently constituting a largepart of the fraud management budget.
According to survey results, businesses accepted
89 percent of orders following manual review—anindicator that more orders are being reviewed than might
be necessary. Automated screening can make your fraud
management processes more efficient for most orders
while leaving only the most suspect ones to be reviewed
manually by your team.

62017 North America Online Fraud Benchmark Report© 2017 CyberSource Corporation. All rights reserved.

Manual Review Rates
Percent of orders sent to manual review
47%

28%

25%

10%

Overall<$5M$5M to <$25M

8%$25M to <$100M$100M+

Managing Fraud in Different
Channels
Businesses Track Fraud Across Channels
Of those businesses surveyed, 74 percent track fraud losses
in their web store, and 49 percent in their mobile channel.
Businesses that track fraud by order channel are better
able to implement channel-specific fraud strategies for thechannels they sell through.

91% of businesses use the same
fraud management tools for mobile
and web channels.

mCommerce in the Spotlight

Overall Fraud Loss by Order Channel

mCommerce appears to be on the rise. For the respondents
who track this information, the percentage of revenue
originating from mobile devices—including orders placed
through a mobile-optimized website or a mobile app,
but not including mobile point-of-sale (mPOS) sales—
increased from 25 percent in 2015 to 33 percent in 2017.

Reported average annual fraud loss
(Expressed as percent of annual eCommerce revenue)
0.9%
0.8%

Managing Mobile Fraud
Distinguishing mCommerce from eCommerce, andtracking fraud in each channel separately, is critical toreducing fraud in the mobile channel and minimizing thenumber of good mCommerce transactions you need toreview and reject. In assessing mCommerce transactions,
you can use all of the captured order information—suchas the channel, time of day, customer identity, and item
purchased—as input to establish fraud rules. The more
relevant data there is, the more that can be done todistinguish genuine orders from fraudulent transactions.

© 2017 CyberSource Corporation. All rights reserved.

0.3%

Web store

MobilePhone/mail orderQ: For each channel, what percent of your annual eCommercerevenue do you expect to lose due to payment fraud?

2017 North America Online Fraud Benchmark Report7

Growth and Tracking of the Mobile Channel
61%
Support mobile channel
Support mobile channel
and track fraud*

52%

49%
40%

33%

52%

49%

38%
28%
8%
2012

2013

2015

2016

2017

*Percent of businesses surveyed that indicated they have a mobile channel and track fraud loss rates in that channel

Accept More Genuine Orders
While Guarding Against Fraud
Rejection Rates and False Positives
North American businesses rejected 2.9 percent of U.S./
Canadian orders due to suspicion of fraud, similar to the2016 level of 2.8 percent.

A false positive (customer insult) is created when a fraud
management process rejects a valid customer’s order,
treating it as attempted fraud. False positives result in
immediate lost sales—and they can affect customer loyalty,
retention, and future sales. It is often difficult to track false
positives. Yet 68 percent of survey respondents attempt totrack false positives, and they believe that up to 10 percentof their rejected orders were actually genuine.

Order Rejection Trends by Size of Merchant
Percent of orders rejected
3.7%
2.9%

Overall

3.1%

2.9%

2.5%

<$5M

$5M to <$25M$25M to <$100M$100M+

Annual digital commerce revenue

8

2017 North America Online Fraud Benchmark Report© 2017 CyberSource Corporation. All rights reserved.

Increasing Genuine Order
Acceptance with 3-D Secure
Implementing payer authentication (3-D
Secure) can help you accept more genuineorders but also can lead to shopping cart
abandonment. Still, according to the survey,
49 percent of respondents were concerned
about 3-D Secure creating customer friction,and 18 percent did not implement 3-D
Secure for that reason. Thirty-seven percent ofrespondents specifically were concerned that
3-D Secure could result in cart abandonment
with 13 percent not implementing thetechnology for that reason.

Merchant Challenges with Standard 3-D Secure
37%

28%

17%

Cart
abandonment

Performance/
reliability

17%

Not optimized Limited control
for mobile
over when we canauthenticate

17%

I have noconcerns

The situation might change with the 3-D Secure 2.0 specification released by EMVCo in 2016. This new specification will
better reflect current and future market requirements for digital payments beyond traditional browser-based eCommercetransactions, and support app- and device-based authentication. The technology will also improve the consumer
experience by enabling intelligent, risk-based decisioning and frictionless consumer authentication.

Cross-Border Orders—What’s the Fraud Impact?

Working with a Global Partner
If you are moving into new geographies, consider:

Despite the challenges of managing cross-border fraud,
many North American businesses are successfully managing
their fraud risks when handling these internationaltransactions. However, there remains a significant differencein the order rejection rate between cross-border anddomestic orders: The order rejection rate for cross-border
orders is over twice the rate of domestic orders.

• Working with local fraud management experts
knowledgeable in each market you consider entering• Implementing regionally relevant best practices• Adjusting fraud scoring rules to reflect local markets• 54% of survey respondents accept orders fromoutside North America• 16% of orders accepted are cross-border transactions

eCommerce Fraud Loss Rate

Order Reject Rate

Domestic versus cross-border

Domestic versus cross-border

Percent of domestic
Percent
Percent
ofof
domestic
domesticorders that wereordersorders
that
that
were
were
fraudulent
fraudulent
fraudulent
Percent of crossPercent
Percent
ofof
crosscrossborder orders thatborderborderordersordersthat
thatwere fraudulent
were
were
fraudulent
fraudulent

0.9%

0.9%
0.9%
0.9%

2017

6.8%

Percent of domestic
Percent
Percent
ofof
domestic
domesticorders rejectedorders
dueordersrejected
rejectedduedue
to suspicion oftofraud
tosuspicionsuspicion
ofof
fraud
fraud
Percent of crossPercent
Percent
ofof
crosscrossborder orders borderborderordersorders2.9%
rejected due torejected
rejected
due
due
toto
suspicion of fraud
suspicionsuspicion
ofof
fraud
fraud

6.8%
6.8%

2.9%
2.9%

0.9%
0.9%

2017
2017

© 2017 CyberSource Corporation. All rights reserved.

2017

2017
2017

2017 North America Online Fraud Benchmark Report9Conclusion

How CyberSource Can Help

The North American businesses in our survey are managing
fraud reasonably well. But they can’t afford to let up on
their fraud management efforts. In addition to enhancing
fraud detection and avoiding the losses caused by fraud,
they must work to boost revenue by accepting the
maximum number of good orders. At the same time, theymust also enhance the efficiency of fraud management
so they can keep operational costs under control.

The digital economy continues to evolve, requiring manybusinesses to reassess their fraud management processes.
As customers engage with you across multiple channels,
using a variety of devices, you need a holistic approach to
fraud. CyberSource can help you implement that approach,providing a complete range of fraud management
solutions that enable you to identify fraud faster, moreaccurately, and with less manual intervention. Here aresome of these solutions.

As the survey shows, manual review continues to be one of
the more expensive, time-consuming components of fraud
management. While manual review can provide additional
insight, overreliance on manual review can prove costly.
Implementing tools that enhance the accuracy of
automated fraud screening can help many businesses
overcome the hurdles of manual review. These tools canhelp conserve manual review resources, reserving themanual review process for a smaller number of orders.
Overall, fraud management continues to present serious
challenges for businesses navigating an increasingly
complex and competitive digital economy. However, withthe right tools, your business can effectively address thosechallenges and reduce fraud losses while minimizing
operational costs and improving the customer experience.

102017 North America Online Fraud Benchmark Report

CyberSource Enterprise Fraud Management
CyberSource Enterprise Fraud Management is a multistage fraud management solution that spans accountmonitoring, transaction fraud detection, rules tuning, andpayer authentication. Accept more good orders, streamline
operations, and gain agility. Fine-tune screening
models and strategies—regardless of whether based onrelationships—or stretch across multiple channels, various
devices, or different levels of service.

Decision Manager
Automate and streamline your fraud operations with
CyberSource Decision Manager—the only fraud
management platform that features the World’s Largest
Fraud Detection Radar, which includes insights drawn fromthe more than 68 billion transactions processed by Visa andCyberSource. Take advantage of a flexible rules engine tocustomize rules and models to your specific business acrossall sales channels, including web, mobile, call center, andkiosk channels. Optimize fraud processes by using Real-Time
Fusion Modeling technology that blends multiple advanced
machine-learning methods for accurate scoring.

© 2017 CyberSource Corporation. All rights reserved.

Decision Manager Replay

Loyalty Fraud

CyberSource Decision Manager Replay lets you
confidently quantify the impact of your rule changes inreal time, before activating them in your live production
environment. An industry first, Decision Manager Replay
lets you immediately compare various “what-if” rules
profiles against your own historical data, rather than
waiting months to understand the impact of fraudchanges. Decision Manager Replay produces real-timeinsights into likely changes to the transaction disposition
and fraud rates before you push rules changes live.

CyberSource fraud management can also help you provide
a more secure online environment for loyalty program
customers. Guard against fraud throughout the loyalty
lifecycle, including purchase and redemption of points aswell as account creation, login, and account updates. The
CyberSource loyalty fraud management solution combines
advanced analytical algorithms, customizable rules, datafrom approximately 68 billion transactions, and global
expertise to optimize the accuracy of your fraud screening.
With experience protecting loyalty points and miles asa currency, CyberSource can help you reduce loyalty
program risk.

Rules-Based Payer Authentication
Working with CardinalCommerce, CyberSource RulesBased Payer Authentication provides you with control
over the customer experience along with all the benefitsof traditional 3-D Secure, including the liability shift
and reduction of interchange fees. You decide whento request payer authentication protection so you canguard against fraud and deliver more seamless checkout
experiences for your customers.

Account Takeover Protection
Account takeover fraud is an increasingly prevalent typeof online threat that occurs when a fraudster exploits a
victim’s personal information to take control of an existingaccount or establish a new account. The fraudster thenuses the account to carry out unauthorized transactions.
CyberSource Account Takeover Protection defends
customers and merchants from fraudulent uses of online
accounts. It helps identify high-risk users at accountcreation and login, and monitors for suspicious accountchanges. With Account Takeover Protection, you cankeep your customer accounts safe and protect against
fraudulent card-on-file payments while streamlining accessfor authenticated customers.

© 2017 CyberSource Corporation. All rights reserved.

Managed Risk Services
Complement your in-house skills and resources with theglobal team of CyberSource fraud management experts.
Managed risk analysts who serve clients on six continents
can help you optimize CyberSource Decision Manager
results and scale operations. This global knowledge
network helps identify new fraud trends before they affectyour business. Count on CyberSource to be your trusted
partner as your business expands.

About Us
CyberSource Corporation, a wholly owned
subsidiary of Visa, Inc., is a global payment
management platform. More than 465,000
businesses worldwide use CyberSource andAuthorize.Net brand solutions to process online
payments, streamline fraud management, andsimplify payment security. For more information,please visit www.cybersource.com.

2017 North America Online Fraud Benchmark Report11For more information visit www.cybersource.com/products/fraud_management

CyberSource, a wholly owned subsidiary of Visa, Inc., is the only integrated payment management platform built on secure Visa
infrastructure, with the payment reach and fraud insights of a massive $358 billion global processing network. CyberSource andAuthorize.Net payment management solutions help 465,000 large and small businesses worldwide grow sales, mitigate risk,
and operate with greater agility. For more information, please visit www.cybersource.com

CyberSource is
a Visa solution
122017 North America Online Fraud Benchmark Report© 2017 CyberSource Corporation. All rights reserved.