Thursday, April 28, 2016

Why is there so much credit card fraud?

Because implementing the new security technologies can cost a lot more than the fraud loss.  From the comments at Brian Kreb's blog:
I can tell you first hand why so many retailers haven’t implemented EMV: cost. We did the analysis, and our fraud per year number is way below the implementation costs – and I mean WAY below. So our position has been not to spend the money to implement EMV, and eat the fraud costs because of it, as that is a much smaller number. For other retailers that is going to be a different cost benefit analysis, but if you don’t sell reloadable gift cards (or implement a policy like this one to not allow buying with a CC), and you don’t sell high dollar items that are easy to flip for cash, it isn’t worth the cost.
The implementation costs for EMV, much like E2E encryption, are ridiculous. You have a recurring licensing fee from the manufacturer of the PIN pad devices for each device, and that is IF you already have hardware to support EMV, which for many retailers isn’t the case. Or you have older hardware that does support EMV, but the hardware is already maxed out and you would have to remove 1 feature from the hardware just to accommodate EMV. If a retailer has to replace the hardware, you are talking about anywhere from $200-$1000 per lane per store in hardware alone, not counting the costs to send out someone to replace them all. Even if you have all the hardware in-place, and can eat the EMV feature license cost, you still have to spend the money with your POS integration partner to do all the POS software work to even handle EMV, since the transaction occurs in a different way, and completely different data is sent to and from the POS. As is the case anytime you are working with a vendor on software customization, the integration costs are nothing to sneeze at.
If you think not in terms of security, but rather in terms of managing risk, this makes perfect sense.  It doesn't make sense to pay $100 to stop $20 of fraud.  Now what this particular store does is different than what other stores do, but this is the right way to look at the problem.

1 comment:

Ruth said...

Oh now thats interesting, especially in light of which companies I see around here who've switched and which ones haven' actually makes alot of sense!