Poll: Fraud alert false alarms common
Error rate high when cards issue warnings or block transactions
Have you been contacted by your credit or debit card company about possible fraud on a legitimate charge? Better get used to it.
About 4 in 10 Americans have had a transaction blocked or questioned by their card company, according to a new national survey released Wednesday by CreditCards.com.
Of those who were alerted to possible fraudulent activity, more than half (53 percent) said all or most of the questioned charges were false alarms. And about 7 in 10 (68 percent) said they received at least one alert on a legitimate purchase.
Those numbers may seem high, but payment security experts say they're not surprising. A rash of high-profile data breaches and sophisticated online scams have forced card companies to get more aggressive.
"There are a lot of compromised credit card numbers out there, and the fraud is getting more sophisticated," said David Stewart, director of financial crimes & compliance at SAS, a business analytics company in Cary, North Carolina. "In order to keep their losses at the same historical levels, financial institutions have had to monitor their cards more closely and accept higher false positive rates."
Mark Nelsen, senior vice president of risk products at Visa, said the way some banks have chosen to handle data breaches has also contributed to higher numbers of false alarms.
"When a breach occurs, only 2 to 5 percent of cards ever have fraudulent activity, so issuers have a choice," he said. "They can reissue every card, or they can write new authorization rules that are more restrictive. If they take the second approach, that creates an uptick in those false notifications."
The CreditCards.com telephone poll was conducted April 30-May 3, 2015. Of the 1,000 adults polled, 38 percent said they had been contacted about fraud at least once. A few findings about that group:
- About 1 in 5 respondents (19 percent) said they were contacted about possible fraud on a credit card, compared to 14 percent who received alerts about a debit card and 5 percent who had an alert on both types of cards.
- For some, the alerts didn't catch any actual fraud. About 4 in 10 (39 percent) said every alert they received was in error.
- For a smaller number, the system worked. Twenty-eight percent said all of the alerts they received were about transactions that were fraudulent.
- The rest of the respondents received a mix of alerts flagging both legitimate purchases and fraud. Fourteen percent said "most" of the fraud alerts they received were in error, 8 percent said "some" were in error and 7 percent said "a few" were.
Card companies want to do more notifying, less blocking
A CreditCards.com survey last year found that customers have mixed responses to the alerts they get for legitimate transactions. In that poll, roughly similar numbers of frequent credit card users said they were unbothered, annoyed or relieved when a legitimate purchase was challenged. But the survey also found that a majority believed card companies were challenging transactions "about as often as they should."
Fraud experts said the customer response likely depends on what happens when an alert is triggered. Financial institutions generally have two choices if a transaction comes up as suspicious: They can block approval, or they can allow the purchase to go through, flag it for investigation and send you an alert afterward.
For financial institutions, that has become a key distinction. While having a transaction blocked at the cash register can be embarrassing and inconvenient, customers are increasingly comfortable with other types of fraud alerts, said Seth Ruden, senior fraud consultant at ACI Worldwide.
He cites a 2014 survey by ACI in which 77 percent of global consumers said they were "very interested" in being contacted about suspicious activity on their accounts via a phone call, email or text message.
"Our research suggests that customers want to be part of the fight against fraud and would prefer to be proactively contacted, so we're using more strategies that involve trying to reach the customer, like calling them on their cellphone instead of at their home or office, and using two-way texts," Ruden said. "At the same time, we don't want to flood customers with so many false alerts that a card becomes less attractive for them to use."
Card companies use sophisticated algorithms that examine up to 500 different elements to calculate the risk score for every transaction that runs through their networks. Since American Express issues its own cards, it makes the determination itself whether to block your card or simply flag a transaction and send you an alert. Visa and MasterCard share their scores with the issuing bank and let them make the call.
Nelsen said Visa tracks decline rates by issuer and proactively reaches out to those that seem to be blocking too many transactions. "We want our product to be the safest, most convenient and seamless way to pay so we will say, ‘We need to work with you on your authorization rules because your decline rate is too high,'" he said.
Even when an anti-fraud system is working well, only about 1 in 5 suspected transactions that are declined at the point of sale turn out to be an actual fraud, Nelsen and Stewart said. The rest of the time, it's a false alarm. Because consumers don't mind the after-the-fact alerts as much, most issuers allow much higher false positive ratios for those -- as high as 25 to 1.
Larger banks with more sophisticated analytics typically have lower rates because they have more information they can use to determine if a transaction might be fraudulent. Financial institutions may also have higher tolerance rates for certain customers. For example, Ruden said, some banks will never freeze the card of a high-net-worth cardholder because they don't want to do anything to alienate that customer. "They just take that loss," he said.
Meanwhile, card companies are constantly rolling out new technology to better analyze your spending patterns to determine if a transaction is likely to be fraudulent -- and to reduce their numbers of false alarms. This summer, both MasterCard and Visa are launching mobile phone location tracking programs. If your device is in the same location as the attempted transaction, the credit card issuer can more confidently confirm the transaction.
A growing number of banks are also adopting technology that allows them to reach out to cardholders in real time as an alternative to blocking a transaction, Ruden and Stewart said. To get those kinds of real-time alerts, you may have to download a bank's mobile app onto your smartphone or opt in on the bank's website.
Stewart said his own experience with one of his cards illustrates how far that technology has come. Two years ago, he said, one of his cards was declined when he tried to use it while shopping with his wife at Macy's during a trip to New York City. "It was frustrating for me, and I didn't use that card for the rest of the trip, so they lost a lot of revenue that weekend," he said.
Recently, however, he was traveling again and used that same card to make what the bank considered to be a suspicious transaction. "Instead of a decline, I got text on my phone that showed the transaction and asked: 'Is this a legitimate transaction?' I hit 'yes' and was able to complete my purchase," he said. "That's a great example of how companies are improving the customer experience."
Other survey findings
The CreditCards.com survey found that the following demographic groups were more likely to have received a fraud alert:
- 54 percent of college graduates, compared to just 24 percent of those with no more than a high school education.
- 46 percent of whites, almost double the number of nonwhites.
- 53 percent of those with an annual household income of $75,000 or greater, compared to 23 percent of people with an annual household income under $30,000.
- 48 percent of people who identified themselves as Republicans, compared to 36 percent of Democrats and 40 percent of independents.
Fraud analysts suggested some of those differences may be related to more frequent card use and a higher volume of transactions among the more affluent. "The more money you spend and the more transactions you make, the higher the chance that you'll get caught in a breach or be subject to an alert," Ruden said. "If you don't have money to spend, you have a lot less exposure."
The poll was performed by Princeton Survey Research Associates International on behalf of CreditCards.com. It was conducted between April 30 and May 3, 2015. It involved 1,000 American consumers who were at least 18 years old. Some 500 of the respondents were contacted by landline telephone and 500 by cellphone. The margin of error is 3.6 percent for the full sample.
- As data breaches increase, here's how to cut your identity fraud risk – As data breaches increase, it is easier to cut the risk that your card data and other personal info will be stolen. Dark web scans, free credit reports and virtual card numbers can ease your anxiety about identity theft ...
- Protect your card details, identity from being doxxed – Even if you’re not in the public eye, just the fact that you have a digital footprint means you and your sensitive financial information could be exposed to the growing doxxing epidemic ...
- How to protect your cards and accounts online – As we shop more online and pay bills via our computers and phones, how can we protect our financial transactions? It all starts with a secure network and then following some steps to reduce the chance a fraudster can steal your card and personal info ...