Upload
others
View
1
Download
0
Embed Size (px)
Citation preview
Introduction
Travel and Tourism Certificate from SAIT
Travel Agent for short time
WestJet for over 11 years
Fraud Investigator since 2007
Fraud prevention / detection
Chargebacks
Internal investigations
Respond to police requests
Fraud Awareness Sessions available
1WestJet Airlines - Fraud Awareness
2WestJet Airlines - Fraud Awareness
3WestJet Airlines - Fraud Awareness
Pre Sabre we were using a pieced together fraud solution leveraging Navitaire reservation system and our in-house developer. This was not scalable and not overly effective.
To help matters, we housed all data within excel spreadsheets making searches, links and comparisons time consuming and inaccurate. Further, the managing of the spreadsheets was practically a full time job!
At least 40 Cross train agents reviewing fraud queues while performing other duties. This wasn’t the focus and often took the back seat. Also, because there were so many working on it – it didn’t provide an opportunity for any one person to become really good at it.
We were starting to get more serious with our online fraud protection – and implemented 3DSecure. The web was where the fraud was happening.
4WestJet Airlines - Fraud Awareness
What a difference a dedicated group of people make when managing fraud. Took over all fraud screening, processing chargebacks and escalated calls from victims of fraud.
We also migrated our manual paper chargeback process to an online tool. Allowing for a more streamlined approached to processing chargebacks.
In Late 2009 – WestJet migrated from Navataire to Sabre as our Reservation system.
- discovered the in-house solution we’d used to date was no longer an option
- Sabre could not replicate what we had
- needed to go looking for a Third Party Fraud prevention platform.
- cut over to Sabre and had no fraud prevention tools.
- to help mitigate what we could while sourcing a Fraud platform provider, we continued with 3DS online, introduced the CVN for MC and Visa and required the addition of captcha for Amex bookings made online.
5WestJet Airlines - Fraud Awareness
Almost Present Day – started to feel like we were really getting somewhere where Fraud Prevention was concerned.
- took over 6 months to get the Fraud Prevention platform in place. - - - only Web bookings were being screened, big win at the time
-web bookings were where the Fraudsters were targeting.
- all of the manual excel spreadsheets were loaded into our platform and eliminated a significant amount of manual work and maintenance.
Today:
- we are still a small team (3 Analysts and me)
- our platform has gone through a number of face lifts through the years
- we now route our Web, TA web and Call Centre bookings. (not GDS or WVI)
- we focus a significant amount of attention around ensuring our Frontlines know as much about fraud as possible, how it impacts their job and how it impacts WJ
- we utilized a variety of ADDITIONAL tools to improve our Fraud Strategy, such as various validations sites and Accertify’s Managed services team.
6WestJet Airlines - Fraud Awareness
7WestJet Airlines - Fraud Awareness
Friendly – forget the transaction, don’t recognize the name of the merchant, duplicate
booking
Amateur – personal satisfaction, dissatisfied with service, squeaky wheel
Organized crime – linked to gangs, drugs, guns, violent crimes, career criminals
8WestJet Airlines - Fraud Awareness
Card present
9WestJet Airlines - Fraud Awareness
Card present
10WestJet Airlines - Fraud Awareness
Evidence card was present
11WestJet Airlines - Fraud Awareness
Dumpster diving, collusive employee, person of trust
12WestJet Airlines - Fraud Awareness
Mag strip
Chip and Pin
European cards have photo
Chip credit cards can store encrypted confidential information, which significantly helps to
protect the card against counterfeit fraud. A chip transaction generates a unique
transaction and because each transaction generates a different ID, this makes the
counterfeit production of the card more difficult. It does not use any additional personal
data.
13WestJet Airlines - Fraud Awareness
Card not present transactions:
Online
Phone
14WestJet Airlines - Fraud Awareness
Victims frequently ask:
How did this happen?
How/where was my card compromised?
15WestJet Airlines - Fraud Awareness
The profile of a payment card fraudster is not exclusive - it could be anyone. There is a high level of
anonymity related to skimming, which makes it more appealing and one of the most popular options among
today’s criminals. It is a quick and easy way to gather large amounts of valuable banking information from a
variety of people. Most criminals look for the path of least resistance when committing fraud and skimming
is a preferred method because it is often difficult to detect once a skimming attack has occurred.
***Small businesses / storefront / face to face****
Inspect your POS equipment regularly, including serial numbers, wires and cables. If any equipment looks
unfamiliar, appears altered or is missing, immediately notify Merchant Services or service provider..
Check ceilings, walls or shelves near PIN pads for holes that could conceal a small camera.
Install your debit terminal so that customers have enough room to comfortably shield the PIN pad when
entering their number, thereby limiting the most common way of stealing a cardholder’s PIN: “shoulder
surfing.”
Make sure that any security cameras on your premises don’t capture the PIN the customer is entering.
What to do if you discover your Point-of-Sale terminal has been compromised:
1. Contact police immediately.
2. STOP using the terminal.
3. Ensure employees and customers avoid physical contact with the potentially compromised unit and
surrounding area, as not to tamper with a possible police investigation.
4. Contact your service provider
16WestJet Airlines - Fraud Awareness
Cards start out cheap and go up as the value of the card increases
Some include CVV
Valuable cards – security code, billing address, higher credit limit.
17WestJet Airlines - Fraud Awareness
18WestJet Airlines - Fraud Awareness
19WestJet Airlines - Fraud Awareness
20WestJet Airlines - Fraud Awareness
How to spot a counterfeit card:
Payment card:
-Numbers on the physical card do not match the authorization/receipt
for the transaction. The data contained in the mag stripe of the card
doesn’t match what is embossed on the front of the card.
-Card should be embossed on both sides (reverse on back) not just raised
on the front.
-Must have security code(CVN/CVV for VI and MC is on the back, CID for
Amex is on the front)
-Most cards will have the chip technology (unless pre-paid)
-Look for holograms
Photo ID:
- Drivers license drop test: drop a driver’s license on a counter at an
21WestJet Airlines - Fraud Awareness
angle to hit a corner. If it sounds slightly metallic it’s legit. If it sounds like
a flat plastic (like a credit or debit card) the ID may be counterfeit. True
Driver’s licenses are made from layers of carbon fiber not plastic.
WestJet Airlines - Fraud Awareness 21
22WestJet Airlines - Fraud Awareness
Imbedded low frequency signal
Used at Tap n’ Go equipped Merchants
Low limit transactions – under $50-100
Hard to counterfeit
Can be disabled by card holder
23WestJet Airlines - Fraud Awareness
Some wallet’s or purses will provide some protection.
Costco provides the passport envelope for all passport photos they produce.
Can obtain cc envelops from various financial institutions.
24WestJet Airlines - Fraud Awareness
Rule of thumb: if the purchase is under $20, use cash.
Bank of Canada polymer bills difficult to manufacture.
25WestJet Airlines - Fraud Awareness
BUYER BEWARE!!! NO GUARANTEES, NO WARRANTEES, NO SELLER CERTIFICATION.
26WestJet Airlines - Fraud Awareness
With payment card fraud in the travel industry there are two main
scenarios:
The person traveling is a victim of a scam – they gave money to a friend
of a friend thinking they were getting a good deal.
The person traveling is the fraudster or knows about the fraud and wants
to travel anyway.
Regardless of the scenario, the indicators of fraud could be the same.
The difference is how they are treated once the fraud is identified. Non-
accusatory stance for victims but finding facts (how did they book, how
much did they pay, who did they pay, how did they pay, how do they
know the person who booked their trip, etc). Most instances victims had
a feeling the deal was too good to be true.
Fraudsters are treated with more of an interrogation style, aggressive, no
27WestJet Airlines - Fraud Awareness
bull sh!t, accuse all you want. They will hang up or walk away anyway.
WestJet Airlines - Fraud Awareness 27
28WestJet Airlines - Fraud Awareness
Caller claims wallet lost/stolen
Doesn’t have the CVN as they are using a relatives card
Caller can’t remember the full name of the guest or the phone number
Claims they are a returning guest but you have no history of them
Might establish a positive history to build the counselors trust and then break bad.
29WestJet Airlines - Fraud Awareness
Should be asking for the cardholder name, billing address and contact number bank has on
file for the cardholder FOR EACH CREDIT CARD ATTEMPTED.
Complete name, address and phone verifications for every high risk transaction (see
indicators). Use 411.com reverse address look up to identify the credit card holder’s actual
phone number.
30WestJet Airlines - Fraud Awareness
International IPA – free look up tools online include:
Networksolutions.com “Whois”
Findip-address.com
Geoiptool.com
31WestJet Airlines - Fraud Awareness
Guest is Traveling YUL-YYZ but CC billing address in New York, phone number in Arizona
Departing from MBJ, Canadian billing address, phone number in Mexico
Departing from YUL, IPA located in YVR, Phone number in the US
All US credit cards on high risk transactions should be verified….many credit card victims
are American.
32WestJet Airlines - Fraud Awareness
The biggest obstacle we face is finding a balance between fraud prevention and guest
experience.
How to ask probing questions without being intrusive?
How to employ automated fraud detection solutions without inflating abandonment rates
of valued guests.
As individuals, we need to get better at identifying “red flags” and knowing when
something is too good to be true; as organizations we should take a strategic approach to
fraud management, to understand the biggest risks and eradicate them. If we don’t, the
fraudsters win every time.
Creating new distribution channels should go through rigorous risk assessment.
TA Web / Soft Voyage screen scrapers.
33WestJet Airlines - Fraud Awareness
Automated AVS – fast match, high level, very fickle (exact match)
Mandatory CVN required for all online purchases
System limitations: (min 3 day advance purchase, mandatory billing address, cardholder
name mandatory)
Device ID recognition tools. Mobile payment solutions (Jumio).
Anti-Fraud Centre recently made us aware of verification services they are interested in
offering travel industry merchants.
Anyone interested can reach Jeff Thomson at the CAFC:
Jeff Thomson, i/c Criminal Intelligence & Analytical Unit
Canadian Anti-Fraud Centre / Le centre Antifraude du Canada
Royal Canadian Mounted police / Gendarmerie Royale du Canada
Dir/Tl:(705) 494-3630 Fax/Tlc (705) 494-4755
Part of their strategy is to develop the CAFC to be focal point for Canadian merchants to
report incidents of CNP fraud
They will verify name, address, phone number and email address with the issuing bank
along with a verification with the actual card member. The CAFC will report back with
findings usually within 24 hours. If the transaction is confirmed fraud the CAFC will ensure
34WestJet Airlines - Fraud Awareness
the issuing bank cancels the account.
WestJet Airlines - Fraud Awareness 34
35WestJet Airlines - Fraud Awareness
Negative tables – bad guy info, hundreds of thousands of lines of data.
Positive table – frequent flyer, positive travel history
Rules based scoring - looks at multiple attributes within a PNR associates level of risk, sorts
into queues for analyst review
Example: less than 24 hours, pax name not equal card holder, email is high risk, depart
country code not equal to billing country code
American Express Risk Management – verifies address, phone, email, last change dates
Shared databases – all Accertify clients contribute to the shared database, Southwest,
JetBlue, Greyhound, BA, American Airlines… list is long.
Linked search – multiple search criteria shows all linked orders in one screen
Reporting – used for monthly status reports, identifying new fraud schemes
Third party paid services – Ethoca alerts, Emailage, Spokeo, Threat Matrix, Perseuss
When an enterprise has 100’s if not 1000’s of daily transactions an automated tool should
be explored for fraud screening.
36WestJet Airlines - Fraud Awareness
Incentive program – BT $50 each month, resulted in > $60,000 prevented fraud in 2013.
Everyone is excited to help.
37WestJet Airlines - Fraud Awareness
WestJet Fraud Investigation team – business hours, here to help, offer advice or assistance
whenever possible.
Roadmap
We are always looking for ways to improve our Fraud Prevention Strategy, some of the
things we have on deck for 2014 and beyond are:
- linking in Chargebacks to our prevention platform
- continuous review of the rules we’re using and the analyzing the reporting
- adding in Device Identification as another layer to the scoring of our transactions to
better detect that clean looking fraud
- continuous review of the different validation services available for our team to leverage.
- have ALL WJ booking channels flowing through our platform.
38WestJet Airlines - Fraud Awareness
39WestJet Airlines - Fraud Awareness
Fraudsters are always looking for new people/systems to Target. What makes Travel
Agencies a target?
We see a similar shift here at WJ where we’ve plugged up the Web pretty well and the
target of fraud is now in our Call Centre. This is because:
Legitimate and honest - And most guests are. We’re finding more and more the fraudsters
are becoming more believable and have more legitimate facts to provide. The fraud is
looking cleaner
Excellent Customer Service - Just like at WJ, it’s our focus to provide World Class Guest
Experience, that’s a fine balance between asking more probing questions if you sense
something suspicious. Who wants to be known as the company who makes it difficult to
book/deal with?
Human Lie Detectors – it’s easy to miss the clues of fraud if you’re not exposed to it
everyday. We see it happen with our frontlines, which is why the focus on Fraud
Awareness.
Websites – no need to speak with anyone who could possibly ask more questions. Not all
websites are stacked with security features (CVN, 3DS etc) Can book and fly practically
undetected. Besides, the tug of war between the right mix of security without
compromising conversion.
40WestJet Airlines - Fraud Awareness
When a fraudster purchases a ticket with a stolen credit card, WestJet loses the revenue
from the ticket. CASM
In addition to giving the fare back to the credit card company, we pay fees for processing,
reversing the payments as well as the dispute.
On top of the money we pay to credit card companies, we lose the opportunity to sell the
fraudulent ticket to a “real” paying guest.
All of these costs quickly add up, but the true expense to WestJet goes beyond the money.
Brand
Guest loyalty
Shareholder confidence
Reputation / guest loyalty – credit card victims less likely to book with WestJet if their card
was used without their consent to purchase a WestJet ticket.
Who pays for fraud? Merchants but mainly CONSUMERS
41WestJet Airlines - Fraud Awareness
Chargeback process is incredibly time consuming
Not an agile process… hard to stop once initiated
CNP transactions require several types of evidence
Win rate for disputing chargebacks is low – working on this
Card issuers typically side with the card member
WestJet processes hundreds of chargebacks per month
42WestJet Airlines - Fraud Awareness
43WestJet Airlines - Fraud Awareness
44WestJet Airlines - Fraud Awareness
45WestJet Airlines - Fraud Awareness