Questions for Going Global - Q&A on Bifu Risk Control Products [Part 1]

In this issue of Bifu PAY "Questions for Going Abroad", we invited Junyin, a senior strategy expert in card acquiring risk management from the risk control team of Ant International, to discuss the risk control-related issues that merchants going abroad are concerned about, hoping to help more merchants going abroad understand the importance of risk control in the process of going abroad and help them go abroad smoothly.

Why do I need to pay attention to the risks of international card theft and fraud as a merchant going abroad?

Ant International Bifu PAY: Risky transactions such as fraud and card theft may cause serious losses to merchants' overseas operations. From past experience, many merchants have suffered a major blow as a result.

There is a fashion accessories brand whose products are sold in the North American market with annual sales of approximately US$30 million. However, due to insufficient understanding of risk control and failure to take effective prevention and management measures, this brand has encountered multiple card theft transactions by fraud gangs. (International credit card information leakage is a common situation). When the owner finds that his card has been stolen, he will call the issuing bank to cancel the transaction. At this time, the merchant has already sent the goods to the buyer, thus facing the situation of losing both money and goods. Merchants had no experience in dealing with chargebacks due to stolen cards, and had no strong evidence to prove the reasons for a large number of chargebacks to the card group, resulting in a cumulative loss of millions of dollars.

Another serious case was a certain overseas car rental company, which did not have sufficient resources and capabilities to deal with chargebacks, and did not have a systematic solution to analyze the reasons for customer chargebacks after the chargebacks occurred. As a result, the losses caused by chargebacks became higher and higher, and the total amount exceeded 4.4 million US dollars.

In addition to these examples, we also learned that when expanding business to some high-risk areas for card theft (such as North America and Latin America), merchants often encounter a large number of fraudulent orders from abnormal IPs. Because of lack of experience, these merchants can only manually review each order, which not only increases the risk of chargebacks, but also leads to a significant increase in operating costs, which can be said to be a heavy loss.

Therefore, our overseas merchants need to pay attention to and understand the risk of international card theft, and take preventive and countermeasures in advance to ensure the safety and stability of our overseas operations.

In the domestic payment scenario in China, merchants rarely face major credit card theft and chargeback risks. In overseas payment scenarios, the risk of rejection due to the misuse of international credit cards (hereinafter referred to as "international cards") is an almost unavoidable problem for merchants. Some merchants have little understanding of similar overseas payment risks and relevant coping experience, and the risk losses they encounter will be greater.

According to Juniper Research's forecast, from 2023 to 2028, the cumulative losses of overseas merchants due to online payment fraud may reach as high as US$362 billion. Regardless of the stage of overseas merchants, the industry they are engaged in, the region they do business in, and the platforms and channels they operate through, when it comes to overseas credit card collection, it is necessary to understand the risk of international card misuse in advance and prepare early.

Previous article: How much do you know about overseas payment risks?

Q1: What exactly are fraudulent transactions and card misuse risks?

Ant International PAY: Overseas, ordinary individual buyers are accustomed to using credit cards to pay after placing orders through e-commerce channels. After the payment is completed, if the overseas buyer finds that there is a problem with the order or wants a refund, he can call the issuing bank directly to request a rejection. Usually, card organizations usually require merchants to bear the loss of chargebacks, so overseas merchants need to pay a certain cost for chargebacks. In addition, due to the fewer verification factors for international card payments and the frequent leakage of international card information, the risk of fraud caused by stolen card chargebacks is common, and has become a common risk in cross-border trade.

As shown in the figure below, after fraudsters use illegally obtained credit card information for consumption, when cardholders discover these unauthorized transactions, they will initiate a chargeback request to the issuing bank to recover the losses. After the international credit card organization (hereinafter referred to as the "card group") intervenes, it will be judged that the stolen card losses will be borne by the merchant.

image.png (Simple process from international card theft to chargeback)

When a chargeback occurs due to stolen cards, it is often accompanied by some abnormal orders, including:

The same consumer repeatedly places orders for the same product in a short period of time;

Buyers who use different cards to pay for multiple orders with the same delivery address;

Buyers who usually spend small amounts suddenly make large purchases and repeatedly urge for shipment as soon as possible after the purchase;

Buyers use their own credit cards but the delivery address is in another country;

Multiple transactions using similar credit card numbers; (Card thieves obtain a large number of card numbers through illegal means, and then batch change certain digits of similar card numbers to try to complete transactions. Therefore, if similar card numbers are traded multiple times, the order will generally be considered abnormal.)

Transactions with the same card or multiple cards but different delivery addresses;

Multiple cards are used for transactions with the same IP address, etc.

In short, the risk of international card theft is that criminals steal other people's credit cards to consume in online stores, causing the issuing bank to refuse to pay and refund, thereby defrauding merchants of goods and money, causing loss risks. After these "people hiding in the dark" get complete information such as credit card numbers, expiration dates, CVV, etc. through various means, they will unscrupulously swipe other people's cards, and merchants may not know it at all.

Q2: What are the common fraud methods used by these criminals?

Ant International PAY: International card fraud gangs are usually a group of highly organized criminal gangs that carry out fraud crimes around the world.

Among them, there are not only money laundering experts and cyber hackers, but also technical experts and financial experts, who commit fraud through the continuous updating of technology and criminal strategies. Therefore, merchants are not facing "petty theft" by one or two people, but organized and premeditated professional gangs.

There are three common types of international card fraud:

1. Direct card fraud: that is, after stealing the identity information of the cardholder, the cardholder's credit card is used for consumption and money is directly stolen from the account.

2. Bank card test fraud: usually used to test the validity of stolen credit or debit cards. Fraudsters will purchase stolen credit card information and then try to use it to purchase small items to verify which credit cards are valid, and then sell the valid credit cards on illegal websites.

3. Card replacement refund fraud: Fraudsters will enter an amount that exceeds the price of the item when paying, and then lie that they have entered it incorrectly, asking the merchant to use other alternative methods to refund, but not to the original credit card. If the legitimate original cardholder finds out and raises an objection to cancel the transaction, the merchant will lose part of the refund amount.

Q3: Which cross-border merchants are more likely to become targets of fraudsters?

Ant International PAY: Basically no merchant can be spared, but the following two types of merchants are at higher risk:

First, merchants that focus on high-risk markets such as North America and Latin America.

The main fraud in the North American market comes from local bank cards.

North American companies pay more attention to the customer's payment experience, so 3DS verification (described in detail below) has not been widely adopted, which has increased the difficulty of distinguishing between ordinary transactions and fraudulent transactions, making North America a high-risk area for payment fraud.

Consumers in the Latin American market lack the habit of saving, and credit cards are the main way for consumers in these countries to pay online. At the same time, credit card users in Latin America enjoy strong consumer protection, including a zero-liability policy in the event of fraudulent card use. This protects innocent consumers on the one hand, but it may also encourage fraudsters to try to use the card fraudulently on the other hand. Because even if they are discovered, cardholders often do not need to bear financial losses, while banks or merchants need to bear the corresponding risks and costs. At the same time, due to the high incidence of social security problems such as theft and robbery, and the relatively limited risk control capabilities of the financial system, the Latin American market has become a high-incidence area for credit card fraud.

In addition, different regions have different risk characteristics and methods. The risk of card theft in Europe is relatively high, while phishing websites are more common in Southeast Asia.

The second is stores that sell high-priced and easily convertible goods.

From an industry perspective, since the main purpose of fraudsters to use international card fraud is to realize cash, some high-value and easily convertible goods, such as virtual products, jewelry and gold, and high-priced 3C digital products, often become the main targets of fraudsters.

Merchants selling such products are more likely to become victims of international card fraud attacks.

Q4: What serious losses will fraudulent card transactions bring to cross-border merchants?

Ant International PAY: The losses and harms can be said to be all-round, mainly in the following three categories.

● First, direct rejection of real money and capital losses.

According to data from Juniper Research, online payment fraud will cause global merchants to lose $38 billion in 2023. After the cardholder finds that the card has been stolen, he will initiate a rejection of the card to the issuing bank, and the resulting capital losses will be borne by the merchant side.

Assuming a merchant with an annual TPV of $10 million and a fraud rate of 0.4%, the annual operating cost will increase by $40,000 to directly bear this part of the loss. According to data from Chargebacks911, a US payment research organization, in 2023, for every $1 increase in the amount of merchant rejections, the total capital loss will increase by $3.6. But this is not the most important thing.

image.png● Second, a high fraud rate will lead to a series of penalties from the issuing bank.

Merchants are subject to restrictions from card organizations such as Visa/Mastercard and need to control the fraud rate and chargeback rate of transactions. If these indicators exceed the standards set by the card organizations, merchants may face fines or even the risk of being liquidated.

According to the regulations of the card organizations, if the merchant's chargeback indicators exceed the standards continuously, an additional fine of US$50 will be paid for each chargeback. In addition, in some countries and regions, card organizations have launched a "fraud monitoring program". If the merchant's monthly fraud rate reaches 0.9%~1.8% and the fraud amount is between US$75,000 and US$250,000, it will be included in the program. For example, if it exceeds 5 months, the merchant will face a fine of US$25,000; if it exceeds 7 months, it will face a fine of US$50,000; if it exceeds 12 months, the merchant will lose the qualification to use the card organization to process payments.

● Third, the risk of public opinion.

If the overseas stores/platforms of merchants going overseas become the places where stolen card gangs sell stolen goods, and there are more suspicious transactions of card theft, it is very likely to bring negative public opinion risks to merchants, which will have a very adverse impact on the long-term operation and brand building of merchants going overseas.

Q5: Why do I rarely hear people around me talking about card theft and other issues? How should I understand it?

Ant International PAY: In many cases, the "victimized" merchants are unwilling to talk publicly for the sake of face, and merchants who have not experienced it do not know "how deep the water is".

In addition, many merchants do not have time to conduct in-depth understanding and research on international card fraud, so they tend to ignore the problem of fraud and rejection.

Many merchants even have such ideas: "This is part of what I must experience when doing business overseas", "As long as the risk is included in the cost, my income can cover it, it's no big deal", "If the risk of fraud is controlled within a certain proportion, I don't have to worry about it", "Anyway, the card group will notify me if there is a fraud, and the card group will take care of it, and I don't need to do anything myself".

These ideas are actually biased. In fact, the consequences of rejection disputes caused by fraud may be much more serious than imagined. In the previous question, we can see that payment risk control may be one of the biggest "pitfalls" we will encounter - if marketing is a "development problem", then risk control is a "life-saving problem".

With the rapid development of e-commerce around the world, fraudsters have also targeted the payment links that are ignored by overseas merchants to carry out fraudulent activities. Taking international card theft attacks as an example, merchants will have rejections after suffering international card theft attacks, and the entire overseas sales chain cannot be closed. Merchants not only face customer loss, but also have to bear the financial losses caused by rejections.

Overseas merchants usually pay attention to product value, supply chain, marketing channels, etc., but the overseas payment link, as the "last mile" of the merchant sales chain, should be more worthy of attention by merchants. Once the "last mile" cannot be successfully crossed, all the efforts of the merchant before this, including the early product promotion and marketing costs, will be in vain. This is why we suggest to merchants: be aggressive in profits and take risks into consideration.