2021 Global
Fraud ReportReport contents

03

Overview

04

Executive summary

05

Survey firmographics

06

Business impact offraud:
key findings

10

Business impact offraud: in-depth insights
on manual
review & PSD2

15

Range of fraudattacks: key findings

20

Fraud prevention
strategies:
key findings

24

Conclusion

25

About the authors

26

Appendix (questions
asked)

Cybersource

2021 Global Fraud Report2Overview

Cybersource and the Merchant Risk Council (MRC) are pleased
to present the results of the 2021 Global Fraud Report, an
educational report that conveys transparent and unbiased
research. This report is based on a survey of merchants fromaround the globe, who were asked about their eCommerce
fraud experience and mitigation practices.
The survey results provide the merchant community with thelatest industry fraud data, fraud management methods used bytheir peers, and a robust set of performance benchmarks thatmerchants can use to help optimize their business. The research
was conducted between March and April of 2021.
Cybersource would like to thank the participants for taking thetime to complete the online survey, the MRC for its continued
partnership, and B2B International for directing the program andproviding the analysis.

Cybersource

2021 Global Fraud Report3

Executive summary
The key results and findings from this year’s survey are organized into three focus areas within this report, each covering a central question
integral to understanding the state of eCommerce fraud and merchant fraud management.
First, the report examines the business impact of fraud to understand the effects fraud is having on merchant businesses today and how thosevary across regions and size segments. Then the report delves into the range of fraud attacks merchants are experiencing to illuminate the typesof fraud threats merchants are facing and where they are most vulnerable. Finally, the report explores fraud prevention strategies to understandhow merchants are addressing payment fraud at both a strategic and tactical level.
Below, are the key insights from each of these areas:

Business impacts of fraud –what are the effects of fraud?
COVID spurred an increase in fraud attempts and fraud rates by revenue for around three in four
merchants globally, with merchants in APAC, and enterprise and mid-market merchants especially
impacted
Fraud attempts, costs, and other fraud management KPIs have increased, with merchants in APAC &Latin America, and mid-market merchants, in particular, feeling the effects of a turbulent year
Merchants are allocating over a third of their eCommerce fraud management spending to orderreview related costs; most merchants want to reduce their dependency on manual review in the
future (either in part or entirely)

Range of fraud attacks –where are merchants most vulnerable?
The variety of fraud attacks merchants experience has declined (although the volume of attacks
has increased)
Friendly fraud & card testing have surpassed phishing / pharming & identity theft as the mostcommon attacks, globally
Encouragingly, most merchants have a formal approach to combating friendly fraud, with numerous
customer notifications and clearly visible policies widely implemented, alongside several approaches
to verifications and reviews of purchase history

Fraud prevention strategies –how are merchants addressing the issue?
Protecting and improving the customer / shopping experience has become the main strategic
imperative for merchants related to fraud management practices
On a tactical level, merchants are rationalizing their fraud management toolkits, relying moreheavily on just a handful of widely used tools (primarily CVN and email verification)
Many of the most effective tools are not the most widely adopted by merchants, and these tools
aren’t being prioritized by merchants for adoption in the future.

Cybersource

2021 Global Fraud Report4Survey firmographics
The survey was conducted in March & April of 2021. 650 merchants involved in eCommerce fraud management decisions at their companies
participated. The sample includes businesses based in four geographic regions, with broad representation across all size tiers, sales channels, andmerchant categories. The charts below, show the breakdown of merchants across key firmographics at the overall level.

RegionCompany size
(annual eCommerce revenue)
12%

35%
39%

18%

45%

26%

25%

SMB ($50k to <$5mn)
Mid-Market ($5mn to <$50mn)
Enterprise ($50mn+)

North America
EuropeAPAC
LAT AM
Figure 1

Figure 2

Purchase channels supported & tracked for payment fraud
84%

80%

73%

68%
50%

Online store

39%

Mobile commerce

Physical store(s)Channel supported

Fraud tracked

48%

40%

Telephone / mailorder

Figure 3

The share of merchants in the sample who support purchases through mobile commerce and telephone / mail order channels rose significantly
this year, compared to our previous study in 2019 – from 65% to 73% for mobile and from 34% to 48% for telephone / mail order. Both channels
have undoubtedly become more attractive and more important to merchant businesses over the past two years, due to the restrictions on instore commerce caused by COVID-19 and the rising internet penetration and popularity of smartphones, worldwide.

Cybersource

2021 Global Fraud Report5Business impactof fraud:
key findings
The first area of insights illustrates the impact eCommerce fraud has on merchant businesses, how those impacts have changed and evolved since2019, and where merchants have been more successful in thwarting fraud attempts and mitigating their harm to the organization.
In addition to discussing the four overall findings outlined below, in-depth insights are offered on two specific topics relevant for understanding
how fraud is affecting merchant businesses: the current state of manual order review and merchant preparedness and expectations regarding therecent amendment to EU’s Payment Service Providers Directive, known as PSD2.

01

02

03

COVID led to an increase in fraud attacks and fraud rate by revenue for around three-quarters ofmerchants; all fraud management KPIs have increased since 2019.

Spending on fraud management has spiked – increasing five-fold since 2019, as a share ofeCommerce revenue. Mid-market merchants are spending the most of any merchant size segment.

COVID has driven bigger fraud impacts on organizations based outside of North America. Those
based in APAC have been hit hardest, prompting an increased focus on fraud management andincreased spending in this region.

The emergence of COVID-19 and the resulting restrictions on normal, offline commerce over the past two years both catalyzed online sales andcatapulted the importance of eCommerce as a critical sales channel for many merchants, worldwide. It was no surprise, then, to see that 9 out of
10 merchants now consider managing eCommerce fraud “very or extremely important” to their overall business strategy (see Figure 4). Moreover,managing eCommerce fraud has become pertinent to merchants based in the Asia-Pacific (APAC) region; the data shows the biggest increase in
the share of merchants considering this issue highly important to their overall business strategy, from 82% in 2019 to 95% this year.

Cybersource

2021 Global Fraud Report6Importance of ecommerce fraud management tooverall business strategy
Global results - 2019 vs. 2021
Top 2 box
(very &
extremely
important):

85%

89%

44%

44%

41%

45%

APAC results - 2019 vs. 2021

82%

Top 2 box:

36%

52%

43%

9%

16%

2019

2021

2019

Very important+16%(sig. increase)

46%

13%

Extremely important

95%

5%
2021

Somewhat important

Not important
Figure 4

The importance of eCommerce fraud management has been elevated not just by rising eCommerce sales but by a global increase in fraud attempts
and attacks experienced by merchant businesses. In comparison to the days before COVID, around three-quarters of merchants reported
increases in both fraud attempts and fraud rates by revenue (Figure 5).

Proportion of organizations reporting increases in fraud
attempts & fraud rate by revenue
Global results
NET - any increase:Significant increase(25%+ versus pre-COVID)
Moderate increase(11% to <25% versus pre-COVID)

75%

72%

15%

14%

36%

32%

Small increase(up to 10% versus pre-COVID)
24%

26%

About the same compared topre-COVID)
Decrease compared topre-COVID)

21%

23%

4%

5%

COVID impact on
fraud attempts

COVID impact on
fraud rate by revenue
Figure 5

Cybersource

2021 Global Fraud Report

7

COVID spurred an increase in fraud attempts and fraud rates by revenue. This has been especially impactful on merchants based outside North
America, mid-market, and enterprise organizations. These groups boast the biggest online revenues (Figure 6).

Results by key cross breaks
Region:
77%
68%

79%

76%

86%

83%

73%

65%

EuropeNorth
America

LAT AM

APAC

Size:
82%

80%

76%

84%
62%

Enterprise

Mid-Market% registering any increasein fraud attempts

58%

SMB

% registering any increasein fraud rate by revenue
Figure 6

As fraud attempts and fraud rates by revenue have risen, fraud management costs have increased five-fold, on average, compared to pre-COVID,
from an average of 2% of annual eCommerce revenue in 2019 to around 10% this year (Figure 7).

% of annual ecommerce revenue spent to manage payment fraud
Global results
2019

2021

2%

10%

18% of merchants “Don’t know” or“Do not track this metric”

30% of merchants “Don’t know”
or “Do not track this metric”

Note: Trimmed medians shown for all cost estimates.

Cybersource

2021 Global Fraud Report

Figure 78

Businesses in Latin America, Asia, and mid-market merchants are seeing fraud management expenses reduce their annual revenues, compared tocounterparts in other regions and size segments (Figure 8).

% of annual ecommerce revenue spent to manage payment fraud - by key breaks
Region:15%
12%

9% (3x)

(4x)

(12x)

5% (2x)North America

Size:

EuropeLAT AM

APAC

15% (5x)
10% (2x)
5% (5x)Enterprise

Mid-Market

SMB(rate of change increase compared to 2019)
Figure 8

The pattern of increasing fraud attacks, costs, and impacts on merchant organizations becomes clear and unmistakable when one examines the
bevy of additional fraud management metrics and KPIs this study has tracked over the past two years. From more revenue being lost to payment
fraud to more eCommerce orders being rejected and more eCommerce orders leading to chargebacks, every single indicator for assessing
payment fraud impacts has increased since 2019 (see Figure 9).
While these heightened fraud impacts are being felt by merchants worldwide, those in Europe, Asia, and Latin America are the ones being hit
hardest, as are mid-market merchants with yearly eCommerce revenues ranging from $5 million to $50 million. The growing rate of change in fraud
management KPIs at the global level is more directly linked to an increase in these metrics among European, Asian, Latin American, and mid-market
merchants, than any other merchant segments.

Cybersource

2021 Global Fraud Report9Table shows fraud
management KPIs
(Trimmed medians shown
for all KPIs)

By size 2021

By region 2021
2019

2021

North
America

Europe

LAT
AM

APAC

Enterprise

MidMarket

SMB% of eCommerce revenue lost to
payment fraud globally

2.4

3.1

2.6

3.2

3.7

4.0

3.0

3.4

3.0

% of eCommerce revenue lostto payment fraud from domesticorders

2.1

3.0

2.5

2.9

3.9

3.9

3.1

3.4

2.7

Order rejection rate fordomestic orders (%)

2.5

3.0

2.8

2.8

4.0

3.8

3.3

3.7

2.4

Order rejection rate forinternational orders (%)

5.1

5.6

5.0

5.6

6.9

5.7

5.5

6.2

5.1

% of eCommerce orders thatturned out to be fraudulent

2.3

2.6

2.2

2.5

3.5

3.6

2.7

3.0

2.3

% of eCommerce orders that led
to chargebacks

1.3

2.7

2.2

2.6

3.8

3.6

2.9

3.0

2.4
Figure 9

The bottom-line takeaways from the insights and trends discussed above: First, eCommerce payment fraud is on the rise, and as a result, merchants
are seeing heightened impacts on their online sales and revenues. Second, there is heightened pressure to spend more and to do more toeffectively manage and mitigate this growing threat to their business and their customers than they ever have before.

Business impact of fraud:in-depth insights on two key trends manual review & PSD2
This year’s study also uncovered notable findings related to the specific topics of manual order review and the recent rollout of the EU’s
amendment to the Payment Service Providers Directive, known as PSD2.

Deep dive into manual review:
While fewer orders are being manually reviewed in 2021, more orders are being declined, especially in APAC

Most organizations see a place for manual review in their fraud management strategy, but the vast majority want to reduce theirdependency on it

Cybersource

2021 Global Fraud Report10Manually reviewing eCommerce orders remains a basic but essential element of virtually any merchant’s fraud prevention strategy. The datashows that while the proportion of orders being manually reviewed has decreased from about one-quarter to one-fifth of all eCommerce orders,merchants are now declining a slightly larger share of the orders that they review. Merchants rejected 17% of reviewed orders this year, comparedto 12% in 2019 (see Figure 10).

% of orders manually reviewed & subsequently declined
Global results
25%
20%
12% of orders

17% of orders

3%

3%

2019

2021

19% of merchants “Don’t know” or“Do not conduct manual review”

25% of merchants “Don’t know” or“Do not conduct manual review”
Figure 10

Moreover, while the amount of orders being manually screened is consistent at around 20% for all merchants, globally, the study shows
merchants in the APAC region far exceed those in other regions in the share of orders they subsequently reject – a difference that has only
taken hold within the past two years, as the share of reviewed orders rejected by merchants in this region rose by 16%. This paints a stark
contrast to flat or declining rejection rates by merchants in all other regions, and it may even signal insecurity in systematic and automatedrejection decisions by Asia-based merchants, who have been hit harder than most by rising fraud attempts and expenses (as discussed in theprevious section).
In addition, the data reveals a recent divergence in the amount of reviewed orders that are declined across merchant size segments:
Enterprise and mid-market merchants, being larger and relatively more attractive targets for fraudsters, both reject one-fifth of the orders
they review, right on par with their respective rejection rates for 2019. SMB merchants (generating less than $5mn per year), decreased theirshare of rejected orders by 8% over the past two years and now reject around 12%, on average (see Figure 11). The relative lack of sophisticatedfraud measures (including the usage of fewer fraud detection tools) is likely leading to SMB merchants sending a greater proportion of goodorders to manual review.

% of manually reviewed orders that are declined 2021 - by key breaks
23% (+16%)
Region:16%

16%

15% (-7%)

North
America

EuropeLAT AM

20%

APAC

20%

Size:

12%

Enterprise

Mid-Market

(-8%)

SMB

(Parentheses show noteworthy trends compared to 2019: blue text indicates an increase &red text indicates a decline)
Figure 11

Cybersource

2021 Global Fraud Report11At a strategic level, manual order review continues to play a pivotal role in merchants’ fraud management approaches, as evidenced by the
36% of overall eCommerce fraud management spending merchants earmark for review-related costs, globally (Figure 12). This is relatively
consistent with 2019, where 42% of spending was earmarked for review-related costs, globally.

Allocation of ecommerce fraud management spending
Global results

Order review, business andadministrative staff (excl. IT staff)

36%

Internal tools & systems (incl. IT staff)

34%
Third-party tools or services

30%

Figure 12

Data gathered from merchants this year indicates that most expect manual review to continue to play a role in their fraud management
strategies. The majority, though, plan to reduce the amount of time, labor, and money they devote to this process. Over half (53%) expect thatthey will always conduct manual review in some form or fashion, but they want to reduce it, while 18% say they will only review for businessspecific policies. Another 12% report plans to eliminate manual order review entirely. Less than one-fifth (18%) of merchants plan to retain
manual review as a core element of fraud prevention and mitigation for the foreseeable future (Figure 13).

Role of manual review in future fraud strategy plans
Global results

Plan to eliminate it: 12%

Remain a core part of thestrategy: 18%

Will always have it, butwant to reduce it: 53%

Will only review for businessspecific policies*: 18%(*policies include the likes of 1 PS5 per customer, only ship to certain countries, etc.)
Figure 13

Cybersource

2021 Global Fraud Report

12Deep dive into PSD2:
Merchants feel increasingly prepared for the amendment to the EU’s Payment Service Providers Directive. Most expect
PSD2, in particular strong customer authentication (SCA), to increase the overall complexity of managing both payments
and payment fraud.

Turning to the topic of PSD2 and SCA, the data reflects a growing sense of preparedness among merchants, globally. While the proportion ofmerchants who feel at least “somewhat prepared” has remained consistent (around 9 in 10 for both 2019 and 2021), now two-thirds claim they
feel “very or extremely prepared” for this amendment to PSD2 and the requirements for SCA. This is a significant increase on the 50% who said
the same in 2019 (see Figure 15).

Merchant preparedness for PSD2 - global results
Top 2 box (Very & Extremely prepared):

Extremely prepared

Very prepared

50%

66%

11%
22%

39%

Somewhat prepared44%

Not very prepared37%
24%

Not at all prepared8%
I am not familiar enoughto say2019

2021
Figure 15

While more merchants now feel at least very prepared for PSD2 and SCA, the share who expect it to have a major impact on their organization
remained consistent with 2019, ticking up marginally to 56% this year from 53% two years ago. Specifically, more than half (56%) of merchants
expect PSD2 to drive “increased complexity in managing payments,” as well as “increased complexity in managing fraud,” while just under aquarter (23%) think it will “increase complexity in managing compliance.”
However, both merchant preparedness for PSD2 and SCA and expectations that PSD2 and SCA will have a major impact vary across regions
and size segments. Merchants based in Europe, Latin America, and APAC are more likely than North American merchants to both feel preparedand to expect PSD2 to have a big impact on their organization. It should be noted, though, that one in ten merchants in our sample from
North America are unfamiliar with PSD2 – compared to only 1% of merchants outside of North America - likely because these North American
merchants do not operate within the European Union or European Economic Area. Similarly, mid-market and enterprise merchants over-index
on both attitudinal metrics, compared to their SMB counterparts (see Figure 16).

Cybersource

2021 Global Fraud Report13

Results by key cross breaks - 2021

Region:
95%

84%

97%

96%

68%

70%

63%
42%

North
America

EuropeLAT AM

APAC

Size:
96%

93%
63%

84%
62%
42%

Enterprise

Mid-Market% feeling somewhat, very or
extremely prepared

SMB% that expect PSD2 to have amajor impact on their organization

Figure 16

Cybersource

2021 Global Fraud Report14

Range of fraudattacks:
key findings
The next area of insights focuses on the volume and variety of fraud attacks experienced by merchants, how those have changed in recent years,
and what merchants are doing today to try to minimize their vulnerabilities against the most prevalent and pernicious forms of fraud affecting theirorganizations, while also grappling with several additional fraud-related challenges.

01
02

Despite an increase in the volume of fraud attacks, the range of fraud attacks experienced bymerchants declined (i.e., they are being attacked more but by fewer types of attacks).

Friendly fraud, card testing, phishing, and identity theft are now the most prevalent types of attacks
impacting the largest shares of merchants, globally.

Most merchants have a formal approach in place for combating friendly fraud, with customer
notifications and clearly visible policies widely implemented, alongside verifications and reviews ofpurchase history.
The prevalence of account takeover attacks has declined per merchant since 2019, in part due tomerchants’ increased implementation of tools designed to monitor and mitigate this form of fraud.

03

Merchants must grapple with a range of related challenges, beyond detecting and preventing fraud
itself and increased costs of fraud management, each of which presents considerable difficulties formerchants to overcome.

As discussed in the first section, three-quarters of merchants saw an increase in the volume of fraud attacks, since the start of the COVID
pandemic. Over the same period, however, merchants also saw a decrease in the variety of different fraud attacks experienced by theirorganization. In 2019, merchants experienced, on average, four different types of fraud attacks, whereas this year, that average dipped to three.
In short, merchants are now being hit more often by a more limited range of fraud attacks.

Cybersource

2021 Global Fraud Report15

Meanwhile, the most prevalent forms of payment fraud have also shifted significantly since 2019, with friendly fraud – where the customer
requested a chargeback from their bank after receiving a purchased product or service – and card testing surpassing phishing / pharming andidentity theft as the top two most common attacks impacting merchants. Friendly fraud has become particularly problematic for merchants inNorth America and APAC, where reported incidence rates rose by 9% and 16%, respectively, compared to 2019. Figure 17 contains detailed dataon the most common types of fraud attacks.

2019 rank

2021 rank

Global %experiencing (2021)

Friendly fraud

5

1

39%

Card testing

4

2

37%

Phishing / pharming / whaling

1

3

34%

Identity theft

2

4

28%

Coupon / discount / refund abuse

7

5

27%

Loyalty fraud

10

6

27%

Account takeover

3

7

23%

Affiliate fraud

6

8

21%

Triangulation schemes

11

9

20%

Botnets

8

10

19%

Money laundering

12

11

16%

Re-shipping

9

12

15%

= Declining rank

= Increasing rank
Figure 17

There does exist some variation in the most common fraud attacks impacting merchants in different regions and size segments, as indicated by
the respective rankings shown in Figure 18. But, while it is important to take note of these segment-specific differences and nuances, this dataalso underscores the universal prevalence and relevance of friendly fraud, phishing / pharming, and card testing as the three types of payment
fraud that virtually all merchants are most likely to experience, regardless of geographic area or online revenue.

Top fraud attacks
experienced by region

Top fraud attacks
experienced by company size

North America

EuropeLAT AMAPAC

SMB

Mid-Market

Enterprise

1

Card testing

Phishing/ pharming/
whaling

Friendly fraud

Phishing/ pharming/
whaling

Friendly fraud

Friendly fraud

Friendly fraud

2

Friendly fraud

Friendly fraud

Card testing

Friendly fraud

Card testing

Card testing

Card testing3

Phishing/ pharming/
whaling

Account
takeoverCoupon/discount/
refund abuse

Loyalty fraud

Phishing/ pharming/
whaling

Identity theft

Phishing/ pharming/
whaling

4

Identity theft

Loyalty fraud

Phishing/ pharming/
whaling

Identity theftIdentity theft

Phishing/ pharming/
whaling

Loyalty fraud

5

Coupon/discount/
refund abuse

Card testing

Affiliate fraud

Card testing

Coupon/discount/
refund abuse

Coupon/discount/
refund abuse

Coupon/discount/
refund abuse

Coupon/discount/
refund abuse

Figure 18

Cybersource

2021 Global Fraud Report16

Globally, friendly fraud is now the #1 most common type of attack experienced by merchants, who estimate that around 1.2% of their accepted
eCommerce orders eventually turn out to be friendly fraud. Friendly fraud is a greater concern for merchants in Latin America and Asia given
the % of accepted orders that turned out to be friendly fraud (Figure 19).

Region - 2021

Size - 2021

North
America

EuropeLAT AM

APAC

Enterprise

MidMarket

SMB

1.0

1.3

1.6

1.5

1.3

1.4

1.0

% of accepted orders that turned
out to be friendly fraud

Figure 19

How are merchants responding to the rise in friendly fraud attacks on their organizations over the past two years?
80% of merchants globally have a formal approach for combating friendly fraud (although this is true for only 71% of merchants in North
America and 68% of SMB merchants). Among the 4 in 5 merchants who have formal strategies in place, most have opted for a multi-pronged
approach, comprising a range of specific tactics, such as customer notifications, clear payment and return policies, and various verification
measures designed to check and confirm customer identities (Figure 20).

Current approaches used to combat friendly fraud - 2021
Checking customer purchase and order histories

36%

Verifying billing addresses

35%

Requiring Card Verification Values (CVV) codes

35%

Making policies clear on the website

34%

Filing formal disputes with financial institutions

33%

Reviewing & analyzing non-fraud chargebacks and declines

29%

Requiring signature on delivery

28%

Working with providers to prevent or identify fraudulent transactions

27%

Notifying customers before processing their payment

27%

Monitoring & analyzing transaction data for unusual activity

27%Blacklisting customers who file chargebacks

26%

Notifying customers after processing their payment

26%

Notifying customers when orders are processed / delivered

26%

Prioritizing certain types or categories of chargebacks to fight24%

Grouped approaches: % selecting at least one
Notifications & visibility

Cybersource

68%

Verification & identification

61%

Flagging & checking

60%

Enhanced requirements

52%

Filing & fighting

47%2021 Global Fraud Report

Figure 20

17

While friendly fraud is on the rise for merchants, account takeover fraud – i.e., when fraudsters illegally access or manipulate customer accountdata – is on the decline. In 2019, account takeover was the third most common fraud attack, experienced by 37% of merchants. But this year,
account takeover fell to #7 overall, and impacted less than a quarter (23%) of merchants globally (Figure 21).
Part of the decrease in account takeover fraud may be attributed to the adoption of specialized tools to monitor and prevent this form ofattack, as the share of organizations with these tools in place rose significantly. North American merchants and SMBs appear to be lagging
behind merchants in other regions and size segments when implementing these specialized tools (see figure 21).

Global % of organizations with tools to monitor account takeover fraud &% of organizations experiencing account takeover fraud

73%
68%
37%
23%

2019

2021

% With tools in place in 2021 - By key cross breaks

Region:79%

79%

EuropeLAT AM

88%

62%

North
America

APAC

Size:
73%

76%

Enterprise

Mid-Market

66%

SMB

Figure 21

Cybersource

2021 Global Fraud Report18One factor that makes eCommerce fraud management highly difficult and complex for merchants is that they must grapple with a range ofbusiness challenges, beyond just monitoring and preventing payment fraud itself. Figure 22 illustrates the range, the relative incidence, and theseverity of these fraud management challenges. These challenges impact 92% of merchants, globally.

Incidence & severity of fraud management challenges
experienced by merchants in the past 12 months
Keeping up to date on regulations or rule changes
by payment systems / card networks

32%

Identifying / responding to emerging fraud attacks

31%

Changing business models quickly because of COVID-19

30%

Effectively using data to manage fraud

30%

Updating fraud risk models

26%

Expanding into new sales channels

25%
24%

International expansion
Lack of sufficient internal resources23%

Lack of internal expertise

22%

Managing omni-channel fraud

22%

Gaps in fraud tool functionalities

19%

High-incidence and high-severity
High-incidence and low-severity
Low-incidence and high-severity
Low-incidence and low-severity

Figure 22

The average merchant in 2021 has experienced at least three challenges shown above in the past 12 months, and many are struggling toovercome several at once. Enterprises, for instance, are far more likely to face the majority of the challenges listed in Figure 22, compared to
mid-market and SMB merchants: Over a quarter (26%) of enterprise merchants observed five or more of the challenges above in the past year,
versus 12% of mid-market and 9% of SMB merchants.
Each fraud management challenge presents varying degrees of severity and/or difficulty to merchant organizations. While three of the top five
most prevalent challenges are also considered the most severe, there is a second set of highly pernicious problems, indicated by the green
bars in Figure 22, each of which impacts a smaller share of merchants, globally. It is important to acknowledge that these issues may be as
problematic for those merchants that experience them as the more widely felt challenges atop the list.
The results suggest effectively combating eCommerce fraud means reducing the volume of attacks targeting merchant organizations,
understanding and combating multiple different types of fraud attacks as they continue to evolve and emerge, and overcoming a bevy ofadditional fraud-related challenges that hamper and constrain each merchant’s fraud prevention capabilities to varying extents.

Cybersource

2021 Global Fraud Report19Fraud prevention
strategies:
key findings
The final area of this report looks at merchants’ fraud prevention strategies. How are merchants addressing and combating eCommerce payment
fraud, now and in the future?

01

02

03

Despite the increase in attacks and revenue lost, merchants are prioritizing improvements tothe customer/shopping experience as part of their fraud management practices (as opposed
to minimizing fraud-related operational costs, for example).

At a tactical level, merchants are rationalizing their fraud management toolkits, relying moreheavily on just a handful of widely used tools, compared to 2019.

Except for CVN, two-factor phone authentication, and 3DS authentication, many of the mosteffective fraud detection tools (in the view of participants in the survey) are not the mostwidely used, nor are they the most likely to be adopted in the future.

Fundamental to understanding merchants’ fraud prevention strategies is knowing what goals or objectives they prioritize, relative to others, intheir fraud management approaches. In 2019, the data showed merchants were most likely to see reducing fraud and chargebacks as the primarystrategic goal when it came to fraud management.
This year half of merchants are now choosing to prioritize improving their customer experience (CX), compared to 40% who continue to prioritize
their focus on fraud reduction and a mere 11% that are mainly concerned with minimizing costs (see Figure 23).

Cybersource

2021 Global Fraud Report

20

Figure 23 also illustrates a few noteworthy differences in which strategic goals merchants are choosing to de-prioritize, across different regions,size tiers, and industry sectors. As merchants focused more on CX improvement in their fraud management decisions, merchants in Latin America
and at the enterprise level have tended to put less emphasis on fraud and chargeback reduction. European, mid-market, and SMB merchants,
and those focused on selling digital goods and travel & tourism-related products and services, have been more apt to focus less on minimizing
fraud-related operational costs. Merchants in North America and APAC, as well as those selling physical goods in retail sectors, are equally likely tode-emphasize both fraud and cost reduction, as they prioritize improving their customer experience.

% selecting as most important fraud management priority

27%
Improving the customer experience

50%

Reducing fraud and chargebacks

48%

40%

Minimizing fraud-related operational
costs
25%
= Sig. Lower

11%= Sig. Higher
2019

Segments deprioritizing
reducing fraud &chargebacks

2021

Segments deprioritizing
minimizing
operational costs

EuropeN.America
LAT AMEnterprises

APAC
Physicalgoods &
retail

Mid-Market
SMBs
Digital goods
Travel & tourism

Figure 23

This strategic shift in merchants’ fraud management aims to strike a better balance between protecting the assets and operations of the businessand delivering a high-quality shopping and payment experience for customers.
Over the past two years, merchants’ fraud prevention strategies have evolved at the organizational level, and correspondingly, so has the qualityof their fraud management toolkits at the tactical level. Instead of continuing to implement an array of new anti-fraud tools and technologies,
merchants have opted to rationalize fraud prevention solutions. The average number of tools each merchant has in place has dropped by half, from
10 in 2019 to 5 this year.

Cybersource

2021 Global Fraud Report21

2019 Rank*

2021 Rank*

Global %using tool (2021)

CVN (Card verification number)

2

1

54%

Email verification

3

2

43%

Customer order history

1

3

38%

Address verification service (AVS)

4

4

37%

3-D secure authentication

5

5

36%

Telephone number verification / reverse lookup

13

6

31%

Postal address validation services

8

7

27%

Negative lists / blacklists (in-house lists)

6

8

24%

Customer website behavior / pattern analysis

10

9

23%

Positive lists / whitelists

9

10

21%

Order velocity monitoring

19

11

21%

Geographic indicators / maps

17

12

18%

Geo location for country / city, etc.

7

13

18%

Two-factor phone authentication (In-app, SMS, etc.)

11

14

18%

Social networking sites

18

15

18%

Top 15 Fraud detection tools used

*North America & Europe only (for consistent tracking)= Declining rank

= Increasing rank
Figure 24

The most prevalent fraud detection tools are also fairly consistent across regions and size segments, as illustrated in Figure 25. But there are a
few notable differences in the types and numbers of tools most relied on by merchants in each group: For instance, those in Europe and APAC are
more likely than those in North America to have implemented 3DS Authentication (greater adoption in Europe is likely driven by merchants needing
to comply with SCA and PSD2 and in APAC given the higher volume of fraud attacks experienced, as noted earlier in this report). Also, enterprisemerchants understandably rely on a larger array of fraud detection tools than mid-market & SMB merchants, on average.

Top fraud detection tools usedby region

Top fraud detection tools usedby company size

North America

EuropeLAT AMAPAC

SMB

Mid-Market

Enterprise

1

CVN

CVN

Email
verification

3DS auth./
SafeKey

CVN

CVN

CVN

2

Email
verification

3DS auth./
SafeKey

CVN

CVN

Email
verification

3DS auth./
SafeKey

Emailverification

3

Customer order
history

Emailverification

Customer order
history

Emailverification

Customer order
history

Emailverification

AVS

AVS

AVS

AVS

Phone number
verification

AVS

Customer order
history

3DS auth./
SafeKey

Phone number
verification

Customer order
history

Credit history
check

AVS

Postal address
validation

AVS

Customer order
history

4
5

Avg. # of
detection
tools used

Phone number
verification

5

4

6

6

4

4

6
Figure 25

As merchants continue to evaluate and implement new anti-fraud tools in the future, it will behoove many to keep in mind the final two figures inthis section, below, which segment 25 fraud prevention tools, based on how widely used they are and, importantly, how effective merchants saythey are at detecting and preventing fraud. Figure 26 shows current usage and planned adoption rates for tools that merchants consider mosteffective at thwarting fraud, while Figure 27 shows the same statistics for tools that merchants say are less effective, on average.

Cybersource

2021 Global Fraud Report22

% currently using & planning to adopt “more effective” fraud detection tools
Currently use

Widely used & more effective

Plan to adopt in the future
54%

Card verification number (CVN, CID, etc.)
Customer order history

38%

3-D Secure authentication

36%

Negative lists / blacklists

24%

9%

Customer website behavior / pattern analysis

23%

10%

Two-factor phone authentication

21%

17%

6%
22%

15%

Less used & more effective
Credit history

19%

Order velocity monitoring

18%

Positive lists / whitelists

18%

8%

Proxy detection

17%

12%

16%
12%

Fraud scoring model - company specific

15%

10%

Device fingerprinting

15%

12%

Multi-merchant purchasevelocity / identity morphing models

11%

Shared negative lists / shared hotlists

10%

Biometric indicators

10%

13%

Paid-for public records services

9%

9%

9%
13%

Figure 26% currently using & planning to adopt “less effective” fraud detection tools
Currently use

Widely used & less effective

Plan to adopt in the future
16%

43%

Email verification
Address verification service (AVS)37%

Telephone number verification / reverse lookup

14%

31%

Postal address verification services

27%

15%
15%

Less used & less effective
13%

Geographic indicators / maps

18%

Social networking sites

18%

10%

Geolocation - traditional laptop / desktop

18%

10%

Geolocation - mobile device

15%

7%

Search engine results

14%

6%

Figure 27

Figures 26 and 27 should sound a cautionary note to merchants about their future investment decisions in anti-fraud solutions at the tactical level:
The data above show that many of the most effective fraud detection tools are not the most widely used, today, nor are they the most likely to be
adopted by merchants, in the future. To advance their anti-fraud capabilities and achieve the best results at the tactical level, merchants should
consider investing in tools that may not be as widely used as many others, yet are generally seen as more effective, such as credit history checks,
order velocity monitoring, positive / whitelists, proxy detection, device fingerprinting and company-specific fraud-scoring models.

Cybersource

2021 Global Fraud Report23Conclusion
The key results and findings discussed in this report highlight
how critical, complex, and challenging the issue of global
eCommerce payment fraud has become for merchants. The
report illustrates several positive trends and indicatorsthat together send a positive and encouraging signal about
merchants’ collective capabilities to successfully improve andadvance both fraud management strategies and tactics to better
protect their organizations, as well as their customers, fromfraud-related threats and harms, in the future. Cybersourceis committed to supporting merchants’ fraud management
and prevention efforts by continuing to sponsor and publicize
further research and analysis on these important topics, in theyears to come.

Cybersource

2021 Global Fraud Report24About the authors

Cybersource is a global, modular payment management platform built on secure Visa infrastructure with the benefits and insights of a vast
$427 billion global processing network. This solution helps businesses operate with agility and reach their digital commerce goals by enhancing
customer experience, growing revenues and mitigating risk. For acquirer partners, Cybersource provides a technology platform, payments
expertise and support services that help them grow and manage their merchant portfolio to fulfil their brand promise.
For more information, please visit: cybersource.com

As an independent, not-for-profit business association, the Merchant Risk Council’s mission is to facilitate collaboration between eCommerce
payments and risk professionals. Year-round, the MRC provides valuable resources to its members that include proprietary educational content,
webinars, best practices, industry trends, benchmarking reports and whitepapers. In addition, the MRC hosts four annual conferences in the US
and Europe as well as several regional networking events which provide an opportunity for industry professionals to build stronger connections
with industry stakeholders.
For more information, please visit: merchantriskcouncil.org

B2B International is a global, full-service market research firm, specializing in researching B2B markets. We help our clients achieve their businessgoals by making smarter decisions driven by insights.
B2B International is part of a consortium of world-class B2B agencies who came together to form Merkle B2B. Being a Merkle B2B company allows
us to deliver the world’s first end-to-end, fully-integrated B2B solution. Our one promise? To architect the ultimate B2B customer experiences.
For more information, please visit: b2binternational.com

Cybersource

2021 Global Fraud Report25Appendix – questions asked
This section shows the questions asked to survey respondents to gather the data shown throughout this report.
Figure 1: In which country are you located?
Figure 2: Please estimate your organization’s annual eCommerce revenue. By ‘eCommerce’, we mean any channel through which a customer canplace a non-store order. This may be through your website or a mobile device.
Figure 3 – “channel supported”: Which of the following order channels does your organization support?
Figure 3 – “fraud tracked”: For which of the following channels does your organization track payment fraud?
Figure 4: How important is eCommerce fraud management to your organization’s overall business strategy?
Figure 5 & 6:
COVID impact on fraud attempts: To what extent do you believe the COVID pandemic has impacted the volume of fraud attempts
made on your organization?
COVID impact on fraud rate by revenue: How has the COVID pandemic impacted your annual eCommerce revenue lost due topayment fraud globally, i.e., fraud rate by revenue?

Figure 7 & 8: Please indicate the percent of your annual eCommerce revenue your organization spends to manage payment fraud — excluding
actual fraud losses.
Figure 9:% of eCommerce revenue lost to payment fraud globally: Please indicate the percent of your annual eCommerce revenue lost
due to payment fraud globally, i.e., fraud rate by revenue.
% of eCommerce revenue lost to payment fraud from domestic orders: Please indicate the percent of your annual eCommercerevenue lost due to payment fraud on domestic orders.
Order rejection rate for domestic orders: Please indicate your order rejection rate for domestic orders i.e., the percentage ofthese orders rejected due to suspicion of fraud.
Order rejection rate for international orders: Please indicate your order rejection rate for international orders the percentageof these orders rejected due to suspicion of fraud.
% of eCommerce orders that turned out to be fraudulent: Please indicate the percent of accepted annual eCommerce ordersthat turned out to be fraudulent.
% of eCommerce orders that led to chargebacks: Please provide the percent of eCommerce orders for which you have received
chargebacks due to fraud in the past 12 months.

Figure 10:% of orders manually reviewed: Please indicate the percentage of eCommerce orders you manually screen for fraud.
% of orders subsequently declined: Of the eCommerce orders manually reviewed by your organization, please indicate thepercentage you decline (cancel) due to suspicion of fraud.

Figure 11: % of manually reviewed orders that are declined: Of the eCommerce orders manually reviewed by your organization, please indicate thepercentage you decline (cancel) due to suspicion of fraud
Figure 12: Allocation of eCommerce fraud management spending: Please indicate the percent of your current annual eCommerce fraud
management spending that is allocated to each of the following areas.
Figure 13: Role of manual review in future fraud strategy plans: How do your organization’s future fraud strategy plans incorporate manual review?
Figure 14:% outsourcing manual review: Which of the following fraud management functions, if any, does your organization outsource?
[response option: Manual review].

Cybersource

2021 Global Fraud Report26

% of eCommerce fraud management spending allocated to order review: Please indicate the percent of your current annual
eCommerce fraud management spending that is allocated to Order review, business and administrative staff (excluding IT staff)% of orders manually reviewed: Please indicate the percentage of eCommerce orders you manually screen for fraud.
% of orders subsequently declined: Of the eCommerce orders manually reviewed by your organization, please indicate thepercentage you decline (cancel) due to suspicion of fraud.
% planning to eliminate manual review from their fraud strategy in the future: How do your organization’s future fraud strategy
plans incorporate manual review? [response option: They don’t, we plan to eliminate manual review]
Figure 15: How prepared would you say your organization is for PSD2?
Figure 16:
Preparedness for PSD2: How prepared would you say your organization is for PSD2?
% that expected PSD2 to have a major impact on their organization: What type of impact do you expect PSD2 to have on
your organization? [Response option: Major impact]
Figure 17 & 18: Which of the following types of fraud attacks, if any, have you ever experienced at your organization?
Figure 19: Please indicate the percent of accepted annual eCommerce orders over the past 12 months that turned out to be friendly fraud /chargeback fraud i.e. where the customer requested a chargeback from their bank after receiving the purchased product/service.
Figure 20: Which of these describe your organization’s current approach to combating friendly fraud / chargeback fraud, i.e. when a customer
requests a chargeback from their bank after receiving the purchased product/service?
Figure 21:% of organizations with tools in place to monitor account takeover fraud: Do you have tools in place to monitor accounttakeover fraud during the customer account creation and login process? [Response option: Yes]
% of organizations experiencing account takeover fraud: Which of the following types of fraud attacks, if any, have you everexperienced at your organization?
Figure 22:
Incidence of fraud management challenges: Which of the following challenges related to eCommerce fraud
management, if any, has your organization experienced in the last 12 months?
Severity of fraud management challenges: And how challenging would you say each of the following have been foryour organization to manage? [Scale ranged from extremely challenging to not at all challenging]
Figure 23: Which one fraud management practice would you say is the most important to your organization when evaluating fraud
management practices
Figure 24 & 25: Please indicate which fraud detection tools your organization currently uses.
Figure 26 & 27:
Tools currently used: Please indicate which fraud detection tools your organization currently uses.
Tools organizations plan to adopt in the future: You indicated that your organization does not currently use anyof the following fraud detection tools. Which tools, if any, does your organization have plans to start using in the
future?
Effectiveness of tools: Now, how effective is each of the following tools in detecting eCommerce payment fraud?
[Scale ranged from extremely effective to not at all effective]

Cybersource

2021 Global Fraud Report27For more information,please visit: cybersource.com