Susan Burns, George R. S. Weir, Department of Computer and Information Sciences, University of Strathclyde, Glasgow G1 1XH, UK

A recent report from the European Security Transport Association (ESTA) found that nearly 20% of the adult population in Great Britain has been targeted as part of a credit or debit card scam. As a result, the UK has been termed the ‘Card Fraud Capital of Europe’ [1], with UK citizens twice as likely to become victims of card fraud as other Europeans. Plastic card fraud is a lucrative exploit for criminals and the proceeds may be used to fund organised crime. Smart payment cards (Chip and PIN cards) were introduced in the UK to replace magnetic stripe cards and support PIN verification of card transactions. By the end of 2005, more than 107 million of the 141.6 million cards in the UK had been upgraded to smart cards [2]. Levels of plastic card fraud fell by 13% to £439.4 million in 2005 [3] and again to £428 million in 2006 (Figure 1). The reduction has been widely attributed to the rollout of smart cards with Chip and PIN authentication.

Trends in Smartcard Scam, Department of Computer and Information Sciences, University of Strathclyde and Associates: Lost and Stolen Fraud. This type of fraud occurs when a card is lost by the cardholder or is stolen from them. Fraudsters can then use the card to obtain goods and services. Once the cardholder notices their card is gone, they will contact the card issuer but as it can take time to realise the card has gone, most fraud of this type takes place before the card has been reported as lost or stolen.

Levels of this type of fraud have remained static for the past five years but the introduction of Chip and PIN is expected to reduce this by making it more difficult for fraudsters to use a lost or stolen card in person at a retail outlet. Prior to Chip and PIN, the retailer would verify that the signature on the sales voucher matched that written on the back of the card. The signature strip was signed by the cardholder in ink and was subject to wear and tear over the lifetime of the card.

University of Strathclyde and Associates - Mail Non-Receipt. This occurs where a card is stolen when it is in transit from the issuing bank or building society to the cardholder. This is similar to lost and stolen fraud since it takes time for the cardholder to realise that a card has not arrived. This delay is often compounded by the fact that cards are often sent out automatically by the issuers rather than at request of the cardholder, e.g. when a card is nearing its expiry date. Card issuers have endeavoured to reduce levels of this type of fraud by using secure mail services and/or requiring the cardholder to phone and activate the card before it can be used. However, fraudsters could still intercept cards in transit and skim the details before re-mailing them to the cardholder. Once the cardholder activates the card, the fraudster can also use the counterfeit card produced using the skimmed details. Credit card cheques, often sent to cardholders on an unsolicited basis by the card issuing company, also offer criminals an additional means of obtaining unauthorized spending against a card account.

Card Not Present, Trends in Smartcard Scam: Lost and Stolen Fraud. This type of fraud covers any card transactions where the cardholder is not physically present, i.e. those conducted over the internet, telephone, fax and mail order, and is now the largest type of card fraud in the UK [6]. Fraudsters obtain details of a card, i.e. cardholder name, card number and the 3 digit security number from the back of the card, and can use these to pay for goods or services over the internet, phone, fax or mail order. Companies reliant on Card Not Present (CNP) transactions are unable to check the physical security features of the card to determine if it is genuine and cannot rely on signature or PIN authentication. Equally, there is no check that the information is being provided by the genuine cardholder.