Reducing the Impact of Fraud With EMV Fallback Strategies
Learn the precautionary measures you must take to protect against chip magnetic stripe fallback-related fraud loss.
Enabling EMV technology on all of your cards and ATMs may take some time and money to do, but it’s an essential step toward protecting your credit union against potentially debilitating financial losses from card and ATM fraud attacks. As a secondary benefit, implementing EMV gives you the right to pursue chargebacks from merchants and ATMs that are not EMV-enabled.
Managing Card Fraud Losses With EMV
Visa reported a 70% drop in the dollar amount of card fraud from September 2015 (one month before the EMV shift) to December 2017, largely due to the increased proliferation, adoption, and usage of chip cards over non-chip cards, according Creditcards.com.
On the flip side, Mastercard reported seeing a 77% increase in counterfeit card fraud year-over-year among merchants that have not moved to EMV or are in the early stages of doing so, MobilePaymentsToday.com reported.
Enabling EMV on your entire debit and credit card portfolio is a must if you want to keep criminals from coming after your business for card fraud. Taking this step can majorly protect your credit union’s bottom line while also strengthening member relations and trust.
It is equally as important for credit unions to adopt airtight fallback authorization strategies for chip cards to protect against fraud losses incurred from magnetic stripe fallback authorizations, or “fallback fraud,” on non-EMV terminals. If your credit union has not yet verified the strength of your fallback authorization strategies, you could very well be experiencing more extensive card fraud losses as a result of increased fallback fraud exposure.
Reducing Fallback Fraud on EMV Cards
It is very important that your credit union take some proactive steps to strengthen your fallback authorization strategies and protect against fallback fraud.
The most effective way to protect against fallback fraud is to work with your card processor(s) to block fallback authorizations on EMV cards so the fraud liability is not shifted to your credit union. Performing this strategy will prevent fallback authorizations at both a point-of-sale and ATM. However, this option is only possible if your credit union has EMV on 100% of your cards.
If you do not have EMV on all of your cards and are therefore unable to block all fallback authorizations, it’s key you regularly monitor your card authorization reports and fallback authorization codes to swiftly detect and resolve any unauthorized or discrepant magnetic stripe fallback transactions on your chip cards. If needed, work with your vendor to verify what these authorization codes mean and where they are located.
You should also require a PIN on fallback transactions, so that the merchant can still authorize the chip payment with an accurate PIN if an attempted chip transaction can’t be processed at a merchant’s terminal because it is a blank chip or the chip fails for some unknown reason.
If a merchant’s terminal or ATM is not yet set up for chip and you as the card issuer have chip enabled on your cards and ATMs, you have chargeback rights for unauthorized card fraud under the chargeback rules of the card associations. But merchants will not always adhere to these chargeback rights, which is why you will need to do your due diligence to address any unauthorized or discrepant fallback transactions.
Managing Fallback Fraud on ATMs and Point-of-Sale Devices
First and foremost, you should work with your vendors to enable EMV technology on all of your ATMs, if you haven’t done so already, and to also make sure you are using all of the tools available to help prevent shimming at chip cards at the ATMs. Next, you should ensure you implement fallback authorization strategies that better manage fraud impact resulting from fallback transactions on your credit union’s chip-enabled ATMs and point-of-sale devices.
Since the MasterCard and Visa chargeback liability shifts went into effect, credit unions are now financially liable for EMV-related ATM fraud losses while acting as a merchant. In other words, you are liable for the chargeback if either of the following occurs:
- Fraud occurs on your credit union’s non-EMV cards at another financial institution’s chip-enabled ATM or point-of-sale device, including any cashback transactions.
- Fraud occurs at a credit union’s non-chip-enabled ATM or point-of-sale device using another card issuer’s EMV cards.
In one recent fraud attack, a credit union owed $400,000 to the card issuer because their ATMs weren’t chip-enabled and the card issuer’s cards were chip-enabled. Ensuring all of your ATMs have EMV turned on is one of the best ways to prevent fraud losses and chargebacks on these devices. We strongly recommend you investigate if you are receiving chargebacks from the other card issuer involving fraud at your non-EMV chip ATMs. Also, work with your ATM vendor to confirm the proper hardware and software is in place and you have the proper settings to limit your fraud risk exposure.
It is essential you block magnetic stripe fallback authorizations on all of your EMV-enabled ATM machines. Additionally, if a non-member’s card is chip-enabled and being used at your chip-enabled ATM, do not allow fallback to a magnetic stripe authorization. If you allow this type of fallback and there is fraud, you will retain the fraud loss since you are acting as a merchant.
If you have not yet upgraded your ATMs to be EMV-enabled, it is important you set transaction and dollar limits for the cards used at your ATMs to reduce the chargeback liability if another financial institution’s chip card is used at these machines. You will also want to check your settings for non-credit union-issued cards used at your ATMs to help limit the dollar loss if your ATMs are not set up for EMV chips. It is also smart to set a daily dollar or transaction limit for the amount of times a single chip card is authorized as a magnetic stripe transaction, and decline any transactions once these fallback transaction limits are met.
If you are chip-enabled on 100% of your cards, you should block all magnetic stripe fallback authorizations at your point-of-sale and ATM devices to prevent fallback fraud on these devices. You should also continue to prevent key-entered fallback authorizations across on all of your devices and cards, as this can more easily pave the way for hefty card fraud damages, for which you will be liable.
All in all, your credit union should take both of these precautionary measures to protect against chip magnetic stripe fallback-related fraud loss:
- Adopt EMV on 100% of your debit cards, credit cards, ATMs and in-branch point-of-sale devices.
- Establish strong magnetic stripe fallback authorization strategies that protect your institution from incurring unnecessary fraud or non-fraud losses on your chip-enabled cards and devices.
Ann Davidson is Vice President of Risk Consulting for Allied Solutions LLC. She can be reached at ann.davidson@alliedsolutions.net.