CUNA Mutual distributes best practices vs. plastics fraud

MADISON, Wis. (3/14/06)--Trying to stem the tide of runaway plastic card fraud losses, CUNA Mutual Group has delivered a set of fraud prevention "best practices" to its 5,500 card-issuing policyholder credit unions, accompanied by a strong call to action.

The nine-page booklet covers 13 security measures and provides more than 70 specific recommendations that card-issuing credit unions should adopt immediately, if they haven't already done so. Electronic copies are available to policyholders within the "Credit Union Protection" area of its website by using the resource link.

"Fighting plastic card fraud is CUNA Mutual's No. 1 priority," said Jeff Post, president/CEO. Credit unions incurred $100 million in plastic card fraud losses in 2005--a 15% increase over 2004 losses and a 50% increase over losses in 2003.

"Credit union plastic card losses in 2006 are already ahead of last year's $100 million pace, and what's more troubling is that the worst may be yet to come," Post said.

"Most of the losses are coming from about 1,000 credit unions, but we fear it's only a matter of time before the majority of card-issuing credit unions also face plastic card losses. This makes the need for change even more urgent," Post said.

CUNA Mutual developed the Plastic Card Security Best Practices after researching claim files to determine why losses occurred; making on-site assessments at hundreds of credit unions; and consulting with processors and industry experts.

The most critical "best practices" credit unions should adopt, said CUNA Mutual, are:

• 24 x 7 review of potentially fraudulent activity. This goes beyond having a fraud model or rules that "score" a transaction around the clock. 24 x 7 means being able to take action on alerts any time, day or night.

• CVV (Visa) and CVC (MasterCard) validation. If credit unions don't check CVV/CVC on PIN-debit transactions, members can be duped into providing their name, account number, expiration date and PIN number to criminals--that's all they need to commit fraud.

• CVV2/CVC2. This three-digit code on the cardholder's signature panel is used to authenticate Internet, mail, telephone and key-entered transactions. These should be declined when a mismatch occurs.

• Daily limits. A criminal with access to a working card will spend every dime as quickly as possible. Establishing and enforcing daily limits is critical in putting a lid on fraudulent activity.

• Compliance/Recovery. Most credit unions don't assert their rights to recover fraudulent losses from merchants that improperly store card data and later suffer a compromise that puts member data in the hands of organized, high-tech crime rings. Increase pressure on merchants by holding them accountable for irresponsible data management and violation of card association compliance rules.

• Name matching. Set up the authorization system to decline for all card programs when the name transmitted on the magnetic stripe doesn't match the cardholder's name stored on the credit union's master file.

• Exact cardholder expiration date. An expiration date mismatch should be set to decline for both swiped (magnetic stripe read) and manually-keyed transactions.

• Card activation. Use an effective activation procedure for all credit and debit card programs, such as PIN-driven or calling from a home phone.

• Address verification service (AVS)--Support the AVS tool to allow mail, telephone order and Internet merchants to automatically match a cardholder's billing address to the shipping address.

Not all of the measures included in the booklet are contractually required, but their use, along with a credit union's claims experience, will be factored into future underwriting decisions, Post said.

CUNA Mutual's multi-pronged approach to fighting fraud also includes credit union education and on-site risk assessments, RISK alerts, merchant litigation, lobbying of card associations, and partnering with card processors.

Copyright © 2008 - Credit Union National Association, Inc. All rights reserved. Reproduction is prohibited without written consent.