SPEAKER_01 0:00

Welcome to this episode of Defense Chat with Jason and Aiden. Let's jump right in to make the payment made. Good morning, Jason. Happy Wednesday. And as you can see, the significant other finally forced me to cut the forest I was growing on top of my head. So you do not have to look at that anymore.

SPEAKER_00 0:33

Yeah, I'm sure she didn't want to be seen in public with you in Vegas, which by the way, how was your trip? Did you make your annual donation to the Las Vegas strip?

SPEAKER_01 0:42

I did. I did. I definitely did a little bit of donating to Vegas this weekend and plan to get back out there soon and get some of it back. Well, you'll have to keep me posted on how that goes. I will. All right, Jason, let's jump into it. First, mobile banking madness, how fraudsters are taking advantage of the shift.

SPEAKER_00 0:59

Next, chargeback fears fuel frustration. Recovering merchants face funding challenges.

SPEAKER_01 1:05

And last, interchange increases the impact to merchants and T Triple Ps. With mobile banking on the rise, the FBI is warning consumers to be safe when using mobile banking platforms, as some may have malicious intent. Jason, in 2018 alone, there were 65,000 fake applications detected in the major app stores, making this the fastest growing sector of smartphone-based fraud. And since January, 75% of Americans have used mobile banking to cash checks and transfer funds. 36% of Americans say they plan to use apps to conduct banking activities, and 20% say they will be using banking branches less often, making this threat even more harmful.

SPEAKER_00 1:45

Yeah, Hayden, it's certainly an attack factor that's on the rise. Anytime there's a shift in consumer behavior or new technology solutions, the fraudsters are always there to prey on the weak. These types of scams have been around forever, but they have been more aggressive during the COVID crisis and the shift to online banking. Less tech savvy customers that are embracing digital solutions for the first time are not always aware of the risk. And I think it's important that financial institutions that are building these types of applications focus on security awareness training for their customers. It's very common in the acquiring and issuing space for internal security awareness training on phishing scams and other types of fraudulent attack vectors, but I feel like banks aren't doing a good job educating their customers in what to look for. And I feel like a big part of the reason is that financial institutions know that they're not responsible for card not present fraud, but that it's ultimately going to hit the merchant. So they're less concerned. I would love to see chargeback rules start to change to put more pressure on issuers.

SPEAKER_01 2:50

Well, it looks like these customers provide their banking information into fake sites while remaining unaware that their information is even being compromised. Jason, is there anything you can do as a consumer to prevent yourself from accidentally using one of these fake sites?

SPEAKER_00 3:05

Yeah, Hayden, there's a couple simple things that any consumer can do, regardless of your technical capabilities. First, when you're installing any type of financial application, make sure that the publisher of the application is the actual business you think it is and not some third party. Second, if you receive an email that looks like it's from your bank, don't use the links in the email. But instead, directly open up the app or go directly to the website and log in. This will prevent common phishing attacks. Next, never enter your PIN number on a website. No bank will ever ask for that piece of information as part of validating your account. And last, if you receive a phone call or SMS from somebody claiming to be your bank, hang up and call them back at the number on the back of your card. This will prevent somebody from spoofing the bank's phone number and ultimately getting you to reveal your banking credentials or card information to a scammer.

SPEAKER_01 4:05

Jason, as we all know, due to the global pandemic, small businesses are hurting. For one small business in particular, Blue Bonnet Photography, they have recently faced a challenge with San Francisco-based e-payments company Square. Square started holding a whopping 30% for every transaction for four months in order to protect the merchant and themselves from unexpected loss.

SPEAKER_00 4:25

Yeah, Hayden, we touched on this topic briefly last week, and unfortunately, I think this is a trend we're going to continue to see rise, especially in delayed delivery environments. One of the things that I think banks and T Triple Ps are seriously concerned about is the recent spike in cases and the possible future shutdowns that will cause more cancellation of services that are scheduled for the future. I'm fully for protecting the payments ecosystem, but we also need to help focus on merchants' recovery. Issuing banks need to do more. They've made it so easy for consumers to initiate a chargeback. There used to be a day where the issuer would conference the customer with the merchant to try to resolve the dispute and find a common ground. Those days are long gone, and now it's as simple as the consumer logging in, clicking a dispute button, and oftentimes never even reaching out to the merchant to try to resolve the situation.

SPEAKER_01 5:20

Well, Square told the merchant the reason for the 30% hold was based on the industry's history of payment disputes, as well as the merchant's short history with Square. But in the three years Blue Bonnet has been with Square, there has never once been a disputed transaction.

SPEAKER_00 5:35

I think more and more merchants are going to experience this type of delay in funding. Banks and TPCPs like Square are always revising their risk policies. And rightfully so, based on current industry trends. This is nothing new. I've seen banks and TPPs take losses from a particular industry and turn around and terminate all merchants on their books with the same MCC code because they don't understand the risk of the industry. For each type of business, the banks and T Triple Ps need to understand the risk profile of the transaction and understand the merchants' refund policies and terms and conditions. With refund volume and chargeback volume being higher than it's ever been in traditionally low-risk businesses, everybody is scrambling to figure out what these new risk profiles look like and how to prevent losses. And I think we need to find the delicate balance between protecting the integrity of the card networks and the ecosystem while facilitating the recovery of the economy.

SPEAKER_01 6:35

Well, it's not just Square. Other epayments companies have been putting plans into place to protect themselves from chargebacks as well. The companies PayPal, Stripe, and WorldPay have implemented additional waiting times to access funds deposited into their accounts. These new guidelines are being put into place due to a report that showed from mid-March to late April, credit card holders disputed three times the amount of transactions as they did before the global pandemic.

SPEAKER_00 7:00

I think what's important to remember here, Hayden, is that these are merchants that have historically not had chargeback and refund issues. Part of the problem, as I mentioned earlier, is that issuing banks have made it too easy for cardholders to dispute transactions. I understand that consumers are frustrated, but before disputing a transaction, they should be working with the merchants to find a resolution. The vast majority of merchants that are being affected by this shift in risk policies are good merchants. And given the opportunity, I believe they will work with their customers to keep them happy. What's really unfortunate about this whole scenario is that in addition to the lost revenue, merchants also pay significant chargeback fees. And this increase in their expenses will only stifle their ability to recover.

SPEAKER_01 7:47

While we are talking about increases, Jason, what can you tell me about Visa's new interchange program and why it's up 85 basis points compared to some of the old rates?

SPEAKER_00 7:56

Well, Hayden, I actually like it. I like the simplicity of it. The interchange tables that are published by the card networks today are way too complex. So the move to simplification is good. And if you look at the underlying interchange categories that Visa has consolidated and increased the rates on, it applies to transactions that inherently carry higher risk due to some characteristics about the transaction. Now it would have been nice if they lowered some of the low risk categories, but we'll have to keep our fingers crossed for that. Hopefully, these rate increases will make the supply chain and merchants look more closely at these transactions that are downgrading and fix the underlying issues, thus decreasing the risk profile of the transaction.

SPEAKER_01 8:40

I understand that sometimes transactions don't meet the information requirements needed or something else goes wrong and a transaction becomes downgraded. And as a result, they end up paying more for a transaction. But what are some of the common causes for these transactions to be downgraded?

SPEAKER_00 8:56

Hayden, there's a handful of common mistakes and issues with transactions that cause them to be downgraded. One of the biggest ones is transactions not settling within the required time frames. The card networks expect when you authorize a transaction that it's going to show up in settlement within a couple business days. And if it doesn't, it's going to result in a downgrade. The second biggest theme is transactions submitted with missing data. The card networks are looking for a certain data set to be included on each transaction. And if there's something missing in that transaction, it has a greater chance of resulting in a chargeback, thus increasing the risk of the transaction. Lastly, discrepancies in the authorization and settlement amount will also cause a transaction to downgrade. The good news is 99% of the reasons that a transaction downgrades are fixable.

SPEAKER_01 9:48

MasterCard has also recently adjusted their interchange fees for standard interchange downgrades. With Visa and MasterCard now charging even more for transaction downgrades, what can you do as a T Triple P to help merchants to avoid common interchange downgrades?

SPEAKER_00 10:04

Well, first, Hayden, what's great about downgrade reasons is that all these scenarios can be monitored for. And it's something that the T TPPs should be doing anyway from a risk monitoring perspective. I think now with the interchange rate increases, it's going to become an even bigger priority, especially for the T Triple Ps that are offering flat rate pricing programs because it's ultimately going to eat into their revenue. And as we emerge from the COVID crisis, merchants certainly aren't going to be happy with a rate increase. So it's something that is going to have to get fixed. There's a handful of underlying causes that usually have to do with faulty gateway configuration, hardware settings, or damaged hardware. Batch times are not set, track and chip data is not being properly read. There are already requirements in place for EMV fallback reporting. However, nothing exists like that today for Magstripe. So starting to monitor the integrity of transactions at the transactional level is going to allow T Triple Ps and merchants to isolate the reasons that these transactions are downgrading. The other factor is I think a lot of it is educational. Merchants don't understand how the characteristics of a transaction impact interchange. One of the common themes that I see in e-commerce merchants or merchants that are dealing in card not present spaces is they don't collect AVS data, address verification data with the transaction because they want to have a simpler checkout experience. But what they don't understand is that by not providing AVS data along with the transaction, they're ultimately paying more for that transaction as it's resulting in a downgrade.

SPEAKER_01 11:44

Yeah, Jason, I have seen lots of e-commerce sites that only ask for a card number, expiration date, and shipping address, but never a billing address. All right, Jason, it is time to make payments. Makes sense. Give me those takeaways.

SPEAKER_00 11:58

Banks, we need to implement security awareness training campaigns for consumers, especially those that are not tech savvy. Issuers, protecting the consumer is important, but it's become too easy for a consumer to dispute a transaction without ever talking to the merchant. Triple Ps. Start looking at your downgrades and working with your merchants to resolve them. Or be prepared for a hit to your bottom line and decrease merchant satisfaction.

SPEAKER_01 12:24

Thanks for joining us today. And if you've got a topic you would like us to discuss, follow and message us on social media at SenseChat. And as always, we would love your feedback. Aiden out.