Card Fraud Trends and Predictions

A year ago, I blogged about PIN points of compromise and the shifting sands of card fraud trends that helped shape the cases we investigated through FICO® Card Alert Service.  In 2012, we saw another shift—an increase in card skimming activity at financial institutions, looking at overall volume of activity.  Financial institution ATMs have been a favored target for a few years now, particularly along the US east coast and in some Midwestern cities.

Card Alert Service also identified a sizable retail point-of-sale (POS) compromise involving cafes at a US-based bookseller with compromised locations throughout the US.  This case was not nearly as large as in 2011 when there was an incredibly large craft store compromise that involved over 70 locations in 18 states.  

Last year, white-label ATMs (marked ATM–Non Bank on the above legend) contributed to more compromised skimming cases than 2011.  However, the margin was still quite small compared to ATMs located on financial institution property.   

What can we expect to see in 2013?

I believe that fraudsters are becoming more reliant on malware intrusions for gathering stolen payment card data.  “Memory scraping” malware is relatively commonplace today.  We may see a drop in the more typical “POS device swap-out scams” as criminals find more and more vulnerable operating systems to hack into remotely.  Why not reduce the risk for arrest by working remotely, right? 

I also expect to see an increase in non-PIN card fraud as social engineers attack consumers through virtual communication channels like social media. This would result in increased signature fraud and card-not-present fraud.