The true costof online fraud
A 2022 global study
Conducted by the Ponemon Institute and sponsored by PayPal

PayPal / The true cost of online fraudContents
03

Introduction

07

Key findings

07

Challenges to reducing fraud risk in online transactions

12

The use of fraud teams to prevent and detect online fraud

14

Organizations’ approach to reducing chargeback fraud

16

Securing online transactions with automationand other security technologies

19

Organizations’ online compliance andgovernance practices

21

The impact of online fraud on revenues,
cost, and budget

24

Methods

25

Caveats

26

Appendix

2

PayPal / The true cost of online fraud

Introduction
According to the research, only slightly more thanhalf (52%) of respondents say their organizations arehighly effective at reducing online fraud and lessthan half (47%) of respondents say they are highly
effective at investigating online fraud. Accordingly,
organizations represented in this research lose an
average of $3.7 million per year due to fraudulent
online transactions.

Ensuring secure online transactions is critical tomaintaining customers’ confidence and trust whenpurchasing products and services. However, as
shown in this research, organizations struggle withachieving the right balance between preventing failedtransactions and having a secure payment process.
Sponsored by PayPal, Ponemon Institute surveyed
3,739 individuals in the United States (442), Canada(468), Australia (475), United Kingdom (471), France(462), Germany (453), and European Cluster (968)
who are involved at some level in deciding which
tools/solutions their organizations use for accepting
payments and how it completes credit card and debitcard transactions from customers or risk solutions.

As shown in Figure 1, the primary challenges tomitigating online financial fraud are the increasing
sophistication of fraudsters (63% of respondents),
not having the right technologies to mitigate
online financial fraud (55% of respondents) and notconsidering it a priority (43% of respondents).

Figure 1. What are the primary challenges to mitigating online financial fraud? Three responses permitted
The increasing sophistication of fraudsters

63%
Our organization does not have the right technologies to mitigate online financial fraud55%
Not considered a priority

43%
Lack of in-house expertise42%
Lack of leadership33%
Our organization does not have programs or policies dealing with online financial fraud

33%
Lack of budget

30%
Other

1%

0%

10%

20%

30%

40%

50%

60%

70%

3

PayPal / The true cost of online fraud

The following findings provide guidance on
reducing online fraud risks.
The types of data most at risk are those usedin online transactions. 62% of respondents saycustomer information and 58% of respondents say
financial information are most at risk. This is followed
by 54% of respondents who say payment data is mostat risk. Of far less concern to organizations are legal
documents, research data, business correspondence
and product information.

62%of respondents say customer
information and 58% of
respondents say financial
information are most at risk.

A lack of in-house expertise and fraudassessments hinder the ability to fight online fraud.
Only 42% of respondents say their organizations
have the necessary in-house expertise to identify
and prevent e-commerce fraud and only 44% of
respondents say their organizations regularly assess
the ability of their payments infrastructure to preventand contain online financial fraud.
To minimize revenue losses, organizations should
prioritize the protection of customer data. The
most significant payment risk, according to 56% ofrespondents, is the theft of customer data due to theincreasing sophistication of fraudsters. This is followedby false declines (53% of respondents), which isdefined as a legitimate transaction blocked by fraud
prevention systems. This occurs when something about
the transaction gets inaccurately flagged as fraudulent.

To avoid customer turnover, organizations’ online
payment processes need to be consideredsecure and trustworthy. The primary step taken byorganizations to create and retain customers’ trust in
online transactions is to have policies to ensure strict
security safeguards are in place (69% of respondents).
This is followed by transparency in sensitive data usedin online financial transactions (59% of respondents)
and regular assessments of the online security risks tocustomers (53% of respondents).
Organizations face the challenge of being able
to quickly respond to online fraud incidents.
On average, organizations represented in thisresearch have 8.78 million online transactions annuallyand of these an average of 29% or 2.5 million arecompromised annually. Organizations are spending
an average of 14 days to respond to one online
fraud incident. According to the research, only 34%
of respondents say the time to detect, contain andrespond to an online fraud incident has decreased(19% of respondents) or decreased significantly (15%of respondents). As a result, organizations are at greatrisk for the theft of customer and financial information.

On average, organizations represented
have 8.78 million online transactions
annually and of these an average of
2.5 million are compromised.

4

Digital transformation creates online fraud risks.
53% of respondents say they are familiar with
their organizations’ strategy for achieving digitaltransformation. 80%of these respondents say theirorganizations are much more vulnerable (42% ) or
vulnerable (39% ) to an online fraud attack due todigital transformation.
Further, 59% of respondents say their organizations are
significantly concerned about having an online fraud
incident caused by insecure digital transformation and
56% of respondents say it is very likely an online fraudattack will occur due to insecure digital transformation.
Because of digital transformation risks, organizations
should consider leveraging advanced technologies,
such as automation and AI, to detect online fraud.

80%of respondents say theirorganizations are much more
vulnerable or vulnerable to an
online fraud transformation.

Most organizations are using a team fully
dedicated to detecting, responding, and containing
online fraud and preventing chargebacks.
64% of respondents say their organizations have ateam fully dedicated to detecting, responding, andcontaining online fraud. An average of 7 staff are on
the fraud team. Despite the use of fraud teams, only
slightly more than half (52%) of respondents say theirorganizations are highly effective at reducing online
fraud. Less than half (47%) say their organizations arehighly effective in investigating fraud.

Four members of the fraud team are fully dedicatedto chargebacks. An average of 679 chargeback
frauds are experienced each month and on average
31 hours are spent to investigate and respondto chargeback fraud each month. According to
the research, the top two steps taken to prevent
chargeback fraud are clear merchant descriptors(65% of respondents) followed by clear and flexible
return policies (64% of respondents). Only slightly
more than half (51%) of respondents say theirorganizations are prepared with evidence.
The lack of collaboration between the fraud
function and cybersecurity teams can be a barrier
to minimizing online fraud. While 60% of respondents
say collaboration between the fraud and cybersecurity
teams is very important, only 25% of respondents
say complete collaboration has been achieved.
One possible reason for the difficulty in achieving
collaboration is that important decisions are divided
between the fraud function and IT security instead ofbeing cohesive. Specifically, the fraud function directs
the online fraud prevention strategies while IT security
allocates the budget for technologies used to reduce
online fraud.
Fraud prevention, legal and the chief risk officer are
most involved in making fraud prevention decisions.
Almost half (49%) of respondents who are mostinvolved in determining how best to secure onlinetransactions without losing revenues are in fraud
prevention, legal and the risk functions. In contrast,
only 25% of IT and IT security are most involved inthese decisions.

5

PayPal / The true cost of online fraud

Online fraud strategies are not supportive of
business initiatives and enablement. Less than half(46%) of respondents say their fraud security solutions
and policies help balance security requirements withbusiness enablement and only 44% of respondents
say online fraud security strategies are aligned withbusiness initiatives.
AI and machine learning are consideredessential to the detection of online fraud.
The most frequently used technologies are AI (61% of
respondents), machine learning (58% of respondents
and orchestration (50% of respondents). 53% of
respondents who use these technologies say they
are very essential and the top security benefits are
better integration with threat intelligence sources andto find stealthy threats that have evaded the standard
security defenses.
The primary benefit of automation is greater
efficiencies in the investigation of online fraud.
As discussed, 67% of respondents say theirorganizations use an automation layer to optimize
fraud protection and authorization rates. Most
respondents are getting value out of automation.
The number one benefit is the reduction in the numberof false positives that analysts must investigate(64% of respondents) followed by reduction in thetime and effort required to investigate an alert(62% of respondents). Automation is also consideredhelpful in finding attacks before they do damage(59% of respondents).

While most organizations are effective inpreventing lost sales at the checkout, they struggle
to balance strong fraud protection with preferredpayment methods. 59% of respondents say theirorganizations are very or highly effective in keeping
customer data current and preventing lost sales at thecheckout. 57% of respondents say their organizations
are very or highly effective in having both strong fraud
protection and positive authorization rates.

Organizations have lost an average of
between $1.5 million to more than
$10 million each year.

Customer sales are frequently lost due totransactions being declined. 49% of respondents saytheir organizations calculate lost revenue due to online
fraud. According to these respondents, organizations
have lost an average of between $1.5 million to morethan $10 million each year. While less than half (47%)
of respondents say their customers have frequently
abandoned a shopping cart when their preferredpayment is unavailable. 56% of respondents saytransactions are being frequently declined.

Compliance is not an important part of theorganizations’ online fraud prevention strategy.
Only 46% of respondents say achieving compliancewith regulations is considered an important objectiveof anti-fraud efforts and only 44% of respondents saycompliance with regulations is the minimum standard
for achieving a strong security posture.

6

PayPal / The true cost of online fraud

Key findings
This section features an analysis of the research findings. The complete audited findings are presented
in the Appendix of this report. The following topics are covered in this report.

Challenges to reducing fraud
risk in online transactions

Securing online transactions with
automation and other technologies

The use of fraud teams toprevent and detect online fraud

Organizations’ online complianceand governance practices

Organizations’ approach to
reducing chargeback fraud

The impact of online fraud onrevenues, cost, and budget

Challenges to reducing fraud risk inonline transactions
The types of data most at risk in organizations are those used in online transactions. As shown in Figure 2,
62% of respondents say customer information and 58% of respondents say financial information are most at risk.
This is followed by 54% of respondents who say payment data is most at risk. Of far less concern to organizations
are legal documents, research data, business correspondence and product information.
Figure 2. What types of data are most at risk in your organization? More than one response permitted

62%

42%

26%

58%

39%

23%

52%

29%

21%

54%

28%

4%

Customer information

Financial information

Intellectual property

Payment data

Employee records

Source code

Trade secrets

Legal documents

Research data

Business correspondence

Product information

Other

7

PayPal / The true cost of online fraud

To minimize revenue losses, organizations should
prioritize the protection of customer data.
Figure 3 lists the most significant online payment
risks. The biggest concern, according to 56% ofrespondents, is the theft of customer data due to theincreasing sophistication of fraudsters.

56%

This is followed by false declines (53% of
respondents), which is defined as a legitimatetransaction blocked by fraud prevention systems.
This occurs when something about the transaction
gets inaccurately flagged as fraudulent. This
inaccurate flag occurs because there are several
verifications put in place by an organization’s system.

of respondents say the biggest concern is the theft of customer
data due to the increasing sophistication of fraudsters.

Figure 3. What are your organization’s most significant payment risks?
More than one response permitted

Stolen customer data

56%

False declines

53%

Goods and services
loss

49%

Friendly fraud48%

Account takeover/credential theft

46%
42%

Chargebacks

37%

Phishing
DDoS attacks

35%
1%

Other

0%

10%

20%

30%

40%

50%

60%

8

PayPal / The true cost of online fraud

To avoid customer turnover, organizations need to be considered trustworthy. According to Figure 4, theprimary step taken to create and retain customers’ trust in organizations’ online transactions is to have policies toensure strict security safeguards are in place (69% of respondents). This is followed by transparency in sensitive
data used in online financial transactions (59% of respondents) and regular assessments of online security risks tocustomers (53% of respondents).

69%

of respondents say the primary step taken to create and retain
customers’ trust in organizations’ online transactions is to havepolicies to ensure strict security safeguards are in place.

Figure 4. What steps does your organization take to create and retain trust in its online transactions?
More than one response permitted

Policies to ensure strict security
safeguards are in place

69%

Transparency in sensitive
data used in online financialtransactions

59%

Regular assesments of online
security risks to customers

53%

Commitments to protect
the privacy of customers

49%

3%

Other

0%

10%

20%

30%

40%

50%

60%

70%

9

PayPal / The true cost of online fraud

Organizations are at great risk for the theft ofcustomer data because of the inability to quickly
respond to online fraud incidents. On average,organizations represented in this research have
8.78 million online transactions annually and of thesean average of 29% or 2.5 million are compromised
annually. Organizations, on average, spend 14 days torespond to an online fraud incident.

Digital transformation creates online fraud risks.
53% of respondents say they are familiar with
their organizations’ strategy for achieving digitaltransformation. According to Figure 6, 81% of
respondents say their organizations are much more
vulnerable (42%) or vulnerable (39%) to an online
fraud attack due to digital transformation.

As shown in Figure 5, only 34% of respondents say
the time to detect, contain and respond to an online
fraud incident has decreased (19% of respondents)
or decreased significantly (15% of respondents). As
a result, organizations are at great risk for the theft ofcustomer data.

81%
of respondents say their organizations aremuch more vulnerable (42%) or vulnerable(39%) to an online fraud attack due to digitaltransformation.

Figure 5. In the past 12 months, how has the time
to detect, contain and respond to an online fraud
incident changed?

Figure 6. Is your organization more vulnerable to an

Time has increased significantly

online fraud attack following digital transformation?

18%

Much more vulnerable

Time has increased

42%

22%
Somewhat more vulnerable

Time has remained unchanged

39%

26%
No change in vulnerability to a fraud attack

Time has decreased

19%

19%
Time has decreased significantly

0%

15%

0%

10%

20%

10%

20%

30%

40%

50%

30%

10

PayPal / The true cost of online fraud

Organizations acknowledge the online fraud risks
created by digital transformation. Respondents wereasked to rate the concerns organizations have about
online fraud attacks due to digital transformation ona scale of 1 = no concern/not likely to 10 = significant
concern/very likely. Figure 7 presents the 7+ responses
on the 10-point scale.

59% of respondents say their organizations are
significantly concerned about having an online fraud
incident caused by insecure digital transformation and
56% of respondents say it is very likely an online fraudattack will occur due to insecure digital transformation.
These risks should encourage organizations toleverage advanced technologies, such as automation
and AI, to detect online fraud.

Figure 7. How risky are digital transformations that are insecure?
On a scale from 1 = no concern/not likely to 10 = significantly concerned/very likely, 7+ responses presented

59%
Concern about having an online
fraud incident as a result ofinsecure digital transformation

56%
Likelihood that an online fraudattack will occur as a result ofinsecure digital transformation

11

PayPal / The true cost of online fraud

The use of fraud teams to prevent anddetect online fraud
Most organizations are using a team fully dedicated to detecting, responding and containing online fraud.
64% of respondents say their organizations have a team fully dedicated to the detection, response, andcontainment of online fraud. According to Figure 8, an average of 7 members are on the fraud team and in thisteam, 4 are fully dedicated to chargebacks. As defined in this research, chargeback fraud is the fraudulent request
for a return or refund in the form of a chargeback. The customer disputes the transaction to regain the dollar
amount while retaining the product or services rendered.

64%

of respondents say their organizations have a team fully dedicatedto the detection, response, and containment of online fraud.

Figure 8. How many members are on the fraud and chargeback teams?
Extrapolated values presented
Number of members on the fraud team

6.8
Number of members on the fraud team that are fully dedicated to preventing chargebacks

3.9

0

1

2

3

4

5

6

7

12

PayPal / The true cost of online fraud

Despite the use of fraud teams, only slightly morethan half of respondents say their organizations
are highly effective at reducing online fraud.
Respondents were asked to rate the effectivenessof reducing and investigating online fraud on ascale from 1 = not effective to 10 = highly effective.
Figure 9 presents the highly effective responses(7+ responses on the 10-point scale). 52% of
respondents say their organizations are highly
effective at reducing online fraud. Less than half(47%) of respondents say they are highly effective atinvestigating online fraud.

Less than half of respondents say they arehighly effective at investigating online fraud.

Figure 9. Effectiveness in investigating andreducing online fraud
On a scale from 1 = not effective to 10 = highly effective,
7+ responses presented

not important to 10 = complete collaboration/

Effective at investigating online fraud

30%

40%

50%

collaboration very important, 7+ responses presented

60%

47%

20%

Figure 10. The state and importance of collaboration
On a scale of 1 = no collaboration/collaboration

52%

10%

One possible reason for the difficulty in achieving
collaboration is that important decisions are divided
between the fraud function and IT security instead ofbeing cohesive. Specifically, the fraud function directs
the online fraud prevention strategies while IT security
allocates the budget for technologies used to support
these strategies.

between the fraud and cybersecurity teams

Effective at reducing online fraud0%

The lack of collaboration between fraud andcybersecurity teams can be a barrier tominimizing online fraud. Respondents were asked
to rate the level and importance of collaboration
between fraud and cybersecurity teams on a scaleof 1 = no collaboration achieved/collaboration notimportant to 10 = complete collaboration achieved/collaboration very important. Figure 10 presents the7+ responses on the 10-point scale. While 60% of
respondents say collaboration between the fraudand cybersecurity teams is very important, only
25% of respondents say complete collaboration has
been achieved.

60%

Importance of collaboration
between the fraud andcybersecurity team

25%
Level of collaboration between
the fraud and cybersecurity team

13

PayPal / The true cost of online fraud

Organizations’ approach to reducing
chargeback fraud
Chargeback fraud is a payment risk. As shown in Figure 11, the top two steps taken to prevent chargeback
fraud are clear merchant descriptors (65% of respondents) followed by clear and flexible return policies (64% of
respondents). Only slightly more than half (51%) of respondents say their organizations are prepared with evidence.
Figure 11. What steps are taken to prevent chargeback fraud?
More than one response permitted
Have clear merchant descriptors

65%
Have clear and flexible return policies

64%
Respond to every dispute

58%
Ensure customer service resolves the issue before it becomes a dispute54%
Put fraud filters in place to stop a fraudulent transaction from being completed

52%
Be prepared with evidence

51%
Send email confirmations and reminders

48%
Other

6%

0%

10%

20%

30%

40%

50%

60%

70%

14

PayPal / The true cost of online fraud

Organizations are more effective in dealing withfalse declines than preventing chargeback fraud.
Respondents were asked to rate the effectivenessof dealing with false declines and chargeback fraud
on a scale of 1 = not effective to 10 = highly effective.
Figure 12 presents the highly effective responses(7+ on a 10-point scale). As shown, 59% of
respondents say their organizations are highly
effective in detecting fraud without rejecting
legitimate transactions (false finds). However, only
43% of respondents say their organizations arehighly effective in preventing chargeback fraud.
Figure 12. Effectiveness in preventing chargeback
fraud and in detecting fraud without rejecting

43%

of respondents say theirorganizations are highly
effective in preventing
chargeback fraud.

An average of 679 chargeback frauds are experienced
each month. As shown in Figure 13, a monthly
average of 31 hours is spent to investigate andrespond to chargeback fraud. As discussed previously,
4 members of the fraud team are fully dedicated topreventing chargebacks.

legitimate transactions

Figure 13. The number of chargeback frauds each

On a scale from 1 = not effective to 10 = highly effective,

month and the time spent monthly to investigate

7+ responses presented

and respond to chargeback fraud
Extrapolated values presented

Effectiveness in detecting fraud without
rejecting legitimate transactions

59%

Chargeback frauds experienced each monthEffectiveness in preventing chargeback fraud

31 hours

43%

0%

10%

20%

30%

40%

679

50%

60%

Time spent per month to investigate andrespond to chargeback fraud

15

Securing online transactions with
automation and other technologies
Most organizations are not prepared to prevent,detect, and respond to online fraud. According
to Figure 14, only 42% of respondents say theirorganizations have the necessary in-house expertise
to identify and prevent e-commerce fraud and only
44% of respondents say their organizations regularly
assess the ability of their payments infrastructure toprevent and contain online financial fraud.

42%

Further, online fraud strategies are not supportive of
business initiatives and enablement. Less than half(46%) of respondents say their fraud security solutions
and policies help balance security requirements withbusiness enablement and only 44% of respondents
say online fraud security strategies are aligned withbusiness initiatives.

of respondents say their organizations have the necessary
in-house expertise to identify and prevent e-commerce fraud.

Figure 14. Perceptions about online security Strongly agree and agree responses presented
Our online fraud security solutions and policies help balance
security requirements with business enablement

46%
My organization regularly assesses the ability of its payments
infrastructure to prevent and contain online financial fraud

44%
Our organization implements online fraud security
strategies that align with its business initiatives

44%
My organization has the necessary in-house expertise
to identify and prevent e-commerce fraud

42%

0%

10%

20%

30%

40%

50%

16

PayPal / The true cost of online fraud

AI and machine learning are the top technologies used to detect online fraud. 67% of respondents saytheir organizations use an automation layer to optimize fraud protection and authorization rates. Figure 15 lists
technologies that organizations may use as part of their online fraud security practices and 53% of respondents
who use these technologies say they are very essential.
The most frequently used technologies are AI (61% of respondents), machine learning (58% of respondents)and orchestration (50% of respondents).
Figure 15. Does your organization use any of the following technologies to detect online fraud?
More than one response permitted

61%

Artificial intelligence58%

Machine learning

50%

Orchestration

34%

Behavioral analytics

16%

None of the above

0%

10%

20%

30%

40%

50%

60%

70%

17

PayPal / The true cost of online fraud

Of the organizations using these technologies,
the two top benefits are better integration with threat
intelligence sources and to find stealthy threats thathave evaded the standard security defenses, as
shown in Figure 16.
Figure 16. The top security benefits of using thesetechnologies in fraud detection
Three responses permitted
Better integration with threat
intelligence sources

57%
Find stealthy threats that have evaded thestandard security defenses

57%
More efficient investigations

56%

The primary benefit of automation is greater
efficiencies in the investigation of online fraud.
As discussed, 67% of respondents say theirorganizations use an automation layer to optimize
fraud protection and authorization rates. Respondents
were asked to rate the importance of automation on ascale from 1 = low importance to 10 = highly important.
Figure 17 presents the very and highly important
responses (7+ on the 10-point scale).
As shown, most respondents are getting value
out of automation. The number one benefit is the
reduction in the number of false positives that analysts
must investigate (64% of respondents) followed by
reduction in the time and effort required to investigate
an alert (62% of respondents). Automation is also
considered helpful in finding attacks before they dodamage (59% of respondents).
Figure 17. The benefits of automation 7+ responses
On a scale from 1 = low importance to 10 = highly
important, 7+ responses permitted

Increase effectiveness of detecting fraud

54%

Reduce the number of false positives thatanalysts must investigate

64%

Reduction in false declines

44%

Reduce the amount of time and effort
required to investigate an alert

Automate routine tasks

62%
32%
Find attacks before they do damage

0%

10%

20%

30%

40%

50%

59%

60%

0%

10%

20%

30%

40%

50%

60%

70%

18

PayPal / The true cost of online fraud

Organizations’ online complianceand governance practices
Compliance is not an important part of theorganizations’ online fraud prevention strategy.
According to Figure 18, only 46% of respondents sayachieving compliance with regulations is considered
an important objective of anti-fraud efforts and only
44% of respondents say compliance with regulations
is the minimum standard for achieving a strong
security posture.

46%

of respondents say achieving
compliance with regulations
is considered an important
objective of anti-fraud efforts.

Figure 18. Perceptions about protection of online transactions Strongly agree and Agree responses presented
Achieving compliance with such regulations as 3DS Security
Protocol, PSD2, PCI-DSS and other government regulations is an
important objective of our organization’s anti-fraud efforts46%
Our organization considers compliance with regulations as theminimum standard for achieving a strong security posture

44%

0%

10%

20%

30%

40%

50%

19

Fraud prevention, legal and the chief risk officer are most involved in making fraud prevention decisions.
Figure 19 presents a list of functions that could be most involved in fraud prevention decisions. Almost half(49%) of respondents who are most involved in determining how best to secure online transactions without losing
revenues are in fraud prevention, legal and the risk functions. In contrast, only 25% of IT and IT security are mostinvolved in decision making.

Only 25% of IT and IT security are most involved in decision making.

Figure 19. Who is most involved in making decisions about fraud prevention in your organization?

19%

Fraud prevention

17%

Legal

14%

Business unit leader

13%

Chief risk officer
Chief information
security officer

10%

Head of payments

9%

Chief technology officer

9%

Chief information officer

6%
2%

Other

0%

5%

10%

15%

20%

25%

20

PayPal / The true cost of online fraud

The impact of online fraud on revenues,
cost, and budget
While most organizations are effective in preventing
lost sales at the checkout, they struggle inbalancing strong fraud protection with preferredpayment methods. Respondents were asked to rate
the effectiveness in preventing lost sales on a scalefrom 1 = not effective to 10 = highly effective.
Figure 20 presents the 7+ responses on the 10-point
scale. 59% of respondents say their organizations
are very or highly effective in keeping customer data
current and preventing lost sales at the checkout. 57%
of respondents say their organizations are very or highly
effective in having both strong fraud protection andpositive authorization rates.

Figure 20. Effectiveness in preventing lost sales
On a scale from 1 = not effective to 10 = highly effective,
7+ responses presented

59%
Effectiveness in keeping
customer data current

59%
Effectiveness in preventing
lost sales at the checkout

57%
Effectiveness in striking a balance
between strong fraud protection
and positive authorization rates

21

Customer sales are frequently lost due to transactions being declined. Respondents were asked to rate thefrequency of lost sales on a scale from 1 = not frequent to 10 = very frequently. Figure 21 shows the frequent andvery frequent responses. While less than half (47%) of respondents have frequently abandoned a shopping cart
when not having their preferred payment method available, transactions are being frequently declined(56% of respondents).
Figure 21. Frequency of lost sales
On a scale from 1 = not frequently to 10 = very frequently, 7+ responses presented
How frequently do online customers abandon a shopping cart
when their preferred payment method is unavailable

59%
How frequently do online customers experience at least one of theirtransactions being declined

56%
How frequently do your online customers leave without
placing an item in the shopping cart

47%

0%

10%

20%

30%

40%

50%

60%

22

PayPal / The true cost of online fraud

According to Figure 22, 46% of respondents say theirorganizations are allocating more than $500,000 toonline fraud prevention.
Figure 22. Approximately, what range best defines
your organization’s 2022 online fraud budget?

Table 1 provides seven cost categories of online
fraud. As shown, most of the budget is allocated tooperational costs (23%), chargeback fraud (16%) andcustomer attrition (15%).
Table 1. Allocation of the budget to seven cost
categories of online fraud

50%
46%

40%

28%

30%

20%
12%

14%

Less than$100,000$100,000
to $250,000$250,001
to $500,000

Percentage
distribution

Operational costs

23%

Chargeback fraud

16%

Customer attrition

15%

Customer retention

13%

Loss of business relationships

12%

Legal and regulatory costs

11%

Reputation and brand damage

10%

Total

10%

0%

Cost categories

100%

More than$500,00023PayPal / The true cost of online fraud

Methods
A sampling frame of 76,094 individuals who are
involved at some level in deciding which tools/
solutions their organizations use for accepting
payments and how it completes credit card and debitcard transactions from customers or risk solutions wereselected as participants to this survey. Table 2 shows
4,000 total returns. Screening and reliability checks
required the removal of 261 surveys. Our final sample
consisted of 3,749 surveys or a 4.9% response.

Table 2. Sample response
Freq

Pct%

Sampling frame

76,094100.0%

Total returns

4,000

5.3%

261

0.3%

3,739

4.9%

Rejected or screened surveys
Final sample

Pie Chart 1 reports the respondent’s organizational level within participating organizations. By design, morethan half (61%) of respondents are at or above the supervisory levels. The largest category at 18% of respondents
is manager.
Pie Chart 1. Current position within the organization

6% Senior Executive

17% Technician/Analyst

7%

12% Staff

Vice President

14% Director

7%

Contractor

18% Manager

3%

Other

16% Supervisor

According to Pie Chart 2, 17% of respondents are located within corporate IT. This is followed by IT security(15% of respondents), internal audit (11% of respondents), risk management (10% of respondents),
fraud prevention (10% of respondents), and payment processing (10% of respondents).
Pie Chart 2. Respondents’ primary department within the organization

17% Corporate IT

10% Payment Processing

15% IT Security

9% Compliance

11% Internal Audit

8%

Supply Chain

10% Risk Management

7%

Finance & Accounting

10% Fraud Prevention

3%

Other

24

PayPal / The true cost of online fraud

Caveats to this study
There are inherent limitations to survey research that need to be carefully considered before drawing inferencesfrom findings. The following items are specific limitations that are germane to most web-based surveys.

Non-response bias

Self-reported results

The current findings are based on a sample ofsurvey returns. We sent surveys to a representative
sample of individuals, resulting in a large number ofusable returned responses. Despite non-response
tests, it is always possible that individuals who did notparticipate are substantially different in termsof underlying beliefs from those who completed
the instrument.

The quality of survey research is based on the integrityof confidential responses received from subjects. Whilecertain checks and balances can be incorporated into
the survey process, there is always the possibility that a
subject did not provide accurate responses.

Sampling-frame bias
The accuracy is based on contact information andthe degree to which the list is representative of
individuals who are involved in deciding which
tools/solutions their organizations use for accepting
payments. We also acknowledge that the results may
be biased by external events such as media coverage.
Finally, because we used a web-based collection
method, it is possible that non-web responses bymailed survey or telephone call would result in adifferent pattern of findings.

25

PayPal / The true cost of online fraud

Appendix with thedetailed audited finding
The following tables provide the frequency or percentage frequency of responses to all survey
questions contained in this study. All survey responses were captured in June 2022.

Survey response

S3.

Total sampling frame

76,094

Total survey returns

4,000

Rejected surveys

261

Approximately, what was your organization’s annual
revenue in 2021?
Less than $20,000,000 (Stop)0%$20,000,000 to $30,000,000

45%$30,000,001 to $50,000,000

26%$50,000,000 to $100,000,000

19%$100,000,001 to $250,000,000

14%$250,000,001 to $500,000,000

10%What is your role in deciding which tools/solutions yourorganization uses for accepting payments and how it
completes credit card and debit card transactions from
customers or risk solutions?

More than $500,000,000

6%The sole decision maker

29%

S4.

A key decision maker31%

An influential decision maker

22%

What best describes your organization’s industry focus?
Please select one choice only.

Some influence over the decision17%

E-commerce

8%

No influence (Stop)0%

Online education

7%

Entertainment & media

9%

Financial services

11%

Gaming9%Grocery (food services)17%

Hospitality

17%

Insurance

10%

Final sample

3,739

Response rate

3.80%

S1.

Total

Total

100%

S2.
What percentage of your organization’s total sales arefrom online transactions?

100%

Less than 20%

0%

Retailers

8%

20% to 30%

42%

Travel5%

31% to 50%

30%None of the above (Stop)0%

More than 50%

28%

Total

Total

100%

100%

26

PayPal / The true cost of online fraud

Part 2. Attributions

Q2b.

Please rate each one of the following statements using
the scale provided below each item. Strongly Agree andAgree response combined.
Q1a. Our organization makes it a priority to protect
online financial transactions.

48%

Q1b My organization’s leadership is willing toaccept revenue losses because they believe thecost of protection outweighs the cost of dealing
with losses.

39%

Q1c. My organization regularly assesses the abilityof its payments infrastructure to prevent andcontain online financial fraud.

44%

Q1d. My organization has the necessary in-house
expertise to identify and prevent e-commerce
fraud.

42%

How effective is your organization in reducing online fraud
on a scale from 1 = not effective to 10 = highly effective?
1 to 212%

3 to 417%

5 to 624%

7 to 826%

9 to 10

21%

Total

100%

Extrapolated value

6.03

Q2c.

Q1e. Our online fraud security solutions andpolicies help balance security requirements withbusiness enablement.

46%

How effective is your organization in achieving compliancewith IT security and privacy regulations on a scale from
1 = not effective to 10 = highly effective?

Q1f. Our organization implements online fraud
security strategies that align with its businessinitiatives.

44%

1 to 215%

3 to 418%

Q1g. Achieving compliance with such regulations
as 3DS Security Protocol, PSD2, PCI-DSS andother government regulations is an important
objective of our organization’s anti-fraud efforts.

5 to 626%

46%

7 to 822%

Q1h. Our organization considers compliancewith regulations as the minimum standard forachieving a strong security posture.

9 to 10

19%

44%

Total

100%

Extrapolated value

5.72

Q2a.

Part 3. Security of online transactions

How effective is your organization in investigating
online fraud on a scale from 1 = not effective to
10 = highly effective?

Q3.
What are the primary challenges to mitigating online
financial fraud? Please select all the top three challenges.

1 to 28%

3 to 414%

Lack of budget

30%

Lack of in-house expertise42%

5 to 625%

7 to 828%

Lack of leadership33%

9 to 10

24%

33%

Total

100%

Our organization does not have programs or
policies for dealing with online financial fraud

Extrapolated value

6.41

Not considered a priority

43%

Our organization does not have the righttechnologies to mitigate online financial fraud55%

The increasing sophistication of fraudsters

63%

Other (please specify)
Total

1%
300%

27

PayPal / The true cost of online fraud

Q4.

Q6.

What types of data are most at risk in your organization?
Please select all that apply.

Who is most involved in making decisions about fraud
prevention in your organization? Please check one
choice only.

Employee records

42%Intellectual property

52%

Business unit leader

14%

Business correspondence

23%

Chief information officer (CIO)

6%

Legal documents

28%

Chief technology officer (CTO)

9%

Customer information

62%

Chief risk officer (CRO)13%

Research data

26%

Chief information security officer (CISO)

10%

Payment data

54%

Fraud prevention

19%

Trade secrets

29%

Head of payments

9%

Source code

39%

Legal

17%

Financial information

58%

Other (please specify)

2%

Product information

21%

Total

Other (please specify)

4%

Total

100%

437%

Q7.
Q5.

What steps does your organization take to create and retain
trust in its online transactions? Please select all that apply.

What are your organization’s most significant payment
risks? Please select all that apply.

Transparency in sensitive data used in
online financial transactions

59%

Commitments to protect the privacy of
customers

49%

Policies to ensure strict security
safeguards are in place

69%
53%
3%

Stolen customer data

56%

False declines

53%

Goods and services loss

49%

Friendly fraud

48%

Chargebacks

42%

Regular assessments online security risks
to customers

Phishing

37%

Other (please specify)

DDoS attacks

35%

Total

Account takeover/credential theft

46%

Other

1%

Total

367%

234%

Q8a.
Does your organization have a team fully dedicated todetecting, responding and containing online fraud?
Yes

64%

No (please skip to Q9a)

36%

Total

100%

28

PayPal / The true cost of online fraud

Q8b.

Q10.

If yes, how many members are on the fraud team?

What steps are taken to prevent chargeback fraud?
Please check all that apply.

1 to 322%

4 to 527%

Be prepared with evidence

51%

6 to 1025%

54%

More than 10

26%

Ensure customer service resolves the issue
before it becomes a dispute

Total

100%

Have clear and flexible return policies

64%

Extrapolated value

6.80

Have clear merchant descriptors

65%

Put fraud filters in place to stop a fraudulent
transaction from being completed

52%

Respond to every dispute

58%

Send email confirmations and reminders

48%

Other (please specify)

6%

Q8c.
If yes, how many members of the fraud team are fully
dedicated to preventing chargebacks?

Total

None

7%

1 to 211%

3 to 427%

Q11.

More than 4

56%

Total

100%

Extrapolated value

3.88

How effective is your organization in preventing
chargeback fraud on a scale from 1 = not effective to
10 = highly effective?

Q9a.
How much collaboration occurs between the fraud andcybersecurity team on a scale of 1 = no collaboration to
10 = complete collaboration?
1 to 228%

3 to 429%

5 to 617%

7 to 816%

9 to 10

9%

Total

100%

Extrapolated value

4.49

Q9b.
How important is collaboration between the fraud andcybersecurity team on a scale of 1 = not important to
10 = very important?

1 to 216%

3 to 417%

5 to 623%

7 to 823%

9 to 10

20%

Total

100%

Extrapolated value

5.78

Q12.
Approximately, how many chargeback frauds does yourorganization experience each month?
5 to 50

11%

51 to 100

17%

101 to 1,000

30%More than 1,000

41%

Total

100%

Extrapolated value

1 to 27%

3 to 413%

5 to 620%

7 to 827%

9 to 10

33%

Total

100%

Extrapolated value

6.85

398%

679

29

PayPal / The true cost of online fraud

Q13a.

Q16.

On average, approximately how much time is spentmonthly to investigate and respond to chargeback fraud?

Does your organization use any of the following technologies
to detect online fraud? Please select all that apply.

Less than 5 hours

6%

Artificial intelligence61%

5 to 10 hours

12%

Machine learning58%

11 to 25 hours

18%

Orchestration50%

26 to 50 hours

29%

Behavioral analytics

34%

More than 50 hours

34%

None of the above (Please skip to Q20)

16%

Total

100%

Total

218%

Extrapolated value

31.11

Q17.
If your organization uses any of these technologies, howessential are they to detecting online fraud incidents on ascale from 1 = not essential to 10 = very essential?

Q13b.
On average, approximately how many staff are
involved monthly in investigating and responding tochargeback fraud?

1 to 215%

Less than 3

15%

3 to 412%

3 to 522%

5 to 620%

6 to 1032%

7 to 830%

More than 1030%

9 to 10

23%

Total

100%

Total

100%

Extrapolated value

7.51

Q18.

Q14.
How effective is your organization in detecting fraud
without rejecting legitimate transactions 1 = not effective
to 10 = highly effective?

What are the top three key security benefits of using thesetechnologies in fraud detection? Please select your top
three choices.
Automate routine tasks

32%
57%

1 to 29%

3 to 4

14%

Find stealthy threats that have evaded
the standard security defenses

5 to 618%

Increase effectiveness of detecting fraud

54%

7 to 827%

57%

9 to 1032%

Better integration with threat
intelligence sources

Total

100%

More efficient investigations

56%

Extrapolated value

6.68

Reduction in false declines

44%

Total

300%

Q15.
Does your organization use an automation layer to optimize
fraud protection and authorization rates?
Yes

67%

No

33%

Total

100%
30

PayPal / The true cost of online fraud

Q19.

Q20.

Using the following ten-point scale, please rate theimportance of the following three benefits of automationto achieving a more efficient and effective online security
posture from 1 = low importance to 10 = highly important.

In the past 12 months, how has the time to detect, containand respond to an online fraud incident changed?

Q19a.
Reduce the number of false positives that analysts must
investigate
1 to 27%

3 to 412%

5 to 617%

7 to 826%

9 to 10

38%

Total

100%

Extrapolated value

7.03

Q19b.
Reduce the amount of time and effort required toinvestigate an alert
1 to 28%

3 to 411%

5 to 619%

7 to 828%

9 to 10

34%

Total

100%

Extrapolated value

6.88

Q19c.

Time has increased significantly

18%

Time has increased

22%

Time has remained unchanged

26%

Time has decreased

19%Time has decreased significantly

15%

Total

100%

Q21.
What is the average time (days) to respond to an online
fraud incident?
Less than 1 day

9%

1 day to 2 days

21%

3 days to 1 week24%

2 weeks to 1 month

26%

More than 1 month

20%

Total

100%

Extrapolated value (days)

13.7

Q22a.
Does your organization have a dedicated incident
response plan for fraud incidents?
Yes

64%

No

36%

Total

100%

Find attacks before they do damage
1 to 29%

Q22b.

3 to 414%

5 to 618%

If yes, does the plan include proactive steps to respondto online fraud incidents?

7 to 8

27%

Yes

58%

9 to 10

32%

No

42%

Total

100%

Total

100%

Extrapolated value

6.68

31

PayPal / The true cost of online fraud

Q23.

Q27.

Are you familiar with your organization’s strategy forachieving digital transformation?

How effective is your organization in preventing lost
sales at the checkout on a scale from 1 = not effective to
10 = highly effective?

Yes

53%

No (please skip to Q27)

47%

1 to 2

9%

Total

100%

3 to 4

14%

5 to6

18%

7 to 827%

Q24.

9 to 1032%

Is your organization more vulnerable to an online fraudattack following digital transformation?

Total

100%

Extrapolated value

6.68

Yes, much more vulnerable

42%

Yes, somewhat more vulnerable

39%

No change in vulnerability to a fraud attack

19%

Q28.

Total

100%

How effective is your organization in keeping customer
data current on a scale from 1 = not effective to
10 = highly effective?

Q25.

1 to 29%How concerned is your organization about having an online
fraud incident as a result of insecure digital transformation ona scale from 1 = no concern to 10 = significantly concerned?

3 to 414%

5 to 618%

7 to 827%

1 to 29%9 to 1032%

3 to 4

14%

Total

100%

5 to 618%

Extrapolated value

6.68

7 to 827%

9 to 10

32%

Total

100%

Extrapolated value

6.68

Q26.
How likely is it that your organization had an online fraudattack as a result of insecure digital transformation on ascale from 1 = not likely to very likely?
1 to 29%

3 to 415%

5 to 620%

7 to 827%

9 to 10

29%

Total

100%

Extrapolated value

6.55

Q29.
How effective is your organization in striking a balance
between strong fraud protection and positive authorization
rates on a scale from 1 = not effective to 10 = highly effective?
1 to 29%

3 to 414%

5 to 620%

7 to 827%

9 to10

30%

Total

100%

Extrapolated value

6.60

32

PayPal / The true cost of online fraud

Q30.

Part 4. The cost of fraud

How frequently do your online customers leave without
placing an item in the shopping cart on a scale from
1 = not frequently to 10 = very frequently.

Q33.
How many online transactions does your organization
have annually?

1 to 29%

3 to 414%

5 to 618%

7 to 829%

9 to 10

30%

Total

100%

Extrapolated value

6.64

Q31.
How frequently do your online customers abandon a shopping
cart when their preferred payment method is unavailable on ascale from 1 = not frequently to 10 = very frequently.
1 to 29%

3 to 414%

5 to 630%

7 to 827%

9 to 10

20%

Total

100%

Extrapolated value

6.20

Q32.
How frequently do your online customers experience atleast one of their transactions being declined on a scalefrom 1 = not frequently to 10 = very frequently.

Less than 10,000

7%

10,000 to 25,000

12%

25,001 to 50,000

8%50,001 to 100,000

10%

101,000 to 250,000

8%251,000 to 500,000

8%501,000 to 1,000,000

9%1,001,000 to 5,000,000

11%

5,001,000 to 10,000,000

11%

10,001,000 to 50,000,000

11%

50,001,000 to 100,000,000

5%More than 100,000,000

0%

Total

100%

Q34.
On average, what percentage of these online transactions
are compromised annually?
Less than 10%

24%

10% to 25%

28%

26% to 50%

26%

More than 50%

23%

Total

100%

Extrapolated value

29%

1 to 29%

3 to 410%

5 to 625%

7 to 829%

9 to 10

27%

Yes

49%

Total

100%

No

51%

Extrapolated value

7.40

Total

100%

Q35a.
Does your organization calculate the revenue lost due toonline fraudulent transactions?

33

PayPal / The true cost of online fraud

Q35b.

Q38.

If yes, on average how much revenue is lost per year due
to online fraudulent transactions?

Approximately, what range best defines your organization’s
2022 online fraud budget?

Less than $50,000

2%Less than $100,000

12%$50,000 to $100,000

2%$100,000 to $250,000

14%$101,000 to $250,000

5%$250,001 to $500,000

28%$251,000 to $500,000

7%More than $500,000

46%$501,000 to $1,000,000

8%

Total

100%

$1,001,000 to $1,500,000

14%$1,501,000 to $2,000,000

13%$2,001,000 to $5,000,000

22%Part 6. Your role & organization characteristics$5,001,000 to $10,000,000

14%More than $10,000,000

12%

D1.

Total

100%

What organizational level best describes yourcurrent position?
Senior Executive

Q36.
The following table provides seven cost categories of
online fraud, including chargeback fraud. Please allocate
all 100 points to provide the relative distribution of eachcost category. Please keep in mind that the total points
must equal 100.

6%Vice president

7%

Director

14%

Manager

18%

Supervisor

16%

Technician/Analyst

17%

Staff

12%

Operational costs

23.00

Contractor

7%

Legal and regulatory costs

11.00

Other

3%

Reputation and brand damage

10.00

Total

100%

Customer attrition

15.00

Customer retention

13.00

Loss of business relationships

12.00

D2.

Chargeback fraud

16.00

Total points

100.00What best describes your primary department in
the organization?
Compliance9%Corporate IT

17%

Part 5. Budget

Finance & accounting

7%

Q37.

Fraud prevention

10%

Where does the budget reside for funding theprevention, response to and the containment of an
online fraud incident?

Internal audit

11%

IT security

15%

Payment processing

10%

IT

40%

Risk management

10%

IT security

26%

Supply chain

8%

Compliance

19%

Other

3%

Finance

12%

Total

100%

Other

3%

Total

100%

34

PayPal.com