Credit card fraud

This article is about all types of Credit card fraud. For organised trade and laundering of credit card information, see Carding (fraud).

Credit card fraud is a wide-ranging term for theft and fraud committed using or involving a payment card, such as a credit card or debit card, as a fraudulent source of funds in a transaction. The purpose may be to obtain goods without paying, or to obtain unauthorized funds from an account. Credit card fraud is also an adjunct to identity theft. According to the United States Federal Trade Commission, while identity theft had been holding steady for the last few years, it saw a 21 percent increase in 2008. However, credit card fraud, that crime which most people associate with ID theft, decreased as a percentage of all ID theft complaints for the sixth year in a row.[1]

Although incidence of credit card fraud is limited to about 0.1% of all card transactions, this has resulted in huge financial losses as the fraudulent transactions have been large value transactions. In 1999, out of 12 billion transactions made annually, approximately 10 million—or one out of every 1200 transactions—turned out to be fraudulent.[2] Also, 0.04% (4 out of every 10,000) of all monthly active accounts were fraudulent. Even with tremendous volume and value increase in credit card transactions since then, these proportions have stayed the same or have decreased due to sophisticated fraud detection and prevention systems. Today's fraud detection systems are designed to prevent one twelfth of one percent of all transactions processed which still translates into billions of dollars in losses.[2]

In the decade to 2008, general credit card losses have been 7 basis points or lower (i.e. losses of $0.07 or less per $100 of transactions).[3] In 2007, fraud in the United Kingdom was estimated at £535 million.[4]

Initiation of a card fraud

Card fraud begins either with the theft of the physical card or with the compromise of data associated with the account, including the card account number or other information that would routinely and necessarily be available to a merchant during a legitimate transaction. The compromise can occur by many common routes and can usually be conducted without tipping off the card holder, the merchant or the issuer, at least until the account is ultimately used for fraud. A simple example is that of a store clerk copying sales receipts for later use. The rapid growth of credit card use on the Internet has made database security lapses particularly costly; in some cases, millions[5] of accounts have been compromised.

Stolen cards can be reported quickly by cardholders, but a compromised account can be hoarded by a thief for weeks or months before any fraudulent use, making it difficult to identify the source of the compromise. The cardholder may not discover fraudulent use until receiving a billing statement, which may be delivered infrequently. Cardholders can mitigate against this fraud risk by checking their account frequently to ensure constant awareness in case there are any suspicious, unknown transactions or activities.

Stolen cards

When a credit card is lost or stolen, it may be used for illegal purchases until the holder notifies the issuing bank and the bank puts a block on the account. Most banks have free 24-hour telephone numbers to encourage prompt reporting. Still, it is possible for a thief to make unauthorized purchases on a card before the card is cancelled. Without other security measures, a thief could potentially purchase thousands of dollars in merchandise or services before the cardholder or the card issuer realizes that the card has been compromised.

The only common security measure on all cards is a signature panel, but, depending on its exact design, a signature may be relatively easy to forge. Some merchants will demand to see a picture ID, such as a driver's license, to verify the identity of the purchaser, and some credit cards include the holder's picture on the card itself. In some jurisdictions, it is illegal for merchants to demand card holder identification. Self-serve payment systems (gas stations, kiosks, etc.) are common targets for stolen cards, as there is no way to verify the card holder's identity. There is also a new law that has been implemented that identification or a signature is only required for purchases above $50, unless stated in the policy of the merchant. This new law makes it easier for credit card theft to take place as well because it is not making it necessary for a form of identification to be presented, so as long as the fraud is done at what is considered to be a small amount, little to no action is taken by the merchant to prevent it.

A common countermeasure is to require the user to key in some identifying information, such as the user's ZIP or postal code. This method may deter casual theft of a card found alone, but if the card holder's wallet is stolen, it may be trivial for the thief to deduce the information by looking at other items in the wallet. For instance, a U.S. driver license commonly has the holder's home address and ZIP code printed on it. Visa Inc. offers merchants lower rates on transactions if the customer provides a ZIP code.[6]

In Europe, most cards are equipped with an EMV chip which requires a 4 to 6 digit PIN to be entered into the merchant's terminal before payment will be authorised. However, a PIN isn't required for online transactions, and is often not required for transactions using the magnetic strip. However magnetic strip transactions are banned under the EMV system (which requires the PIN). In many/most European countries, if you don't have a card with a chip, you will usually be asked for photo-ID - e.g. national ID card, passport, etc. at the point of sale. Many self-service machines (e.g. ticket machines at railway stations, and self-service check-in at airports) require a PIN and chip in EMV-land (i.e. which is most of Europe, Asia, Middle East etc.).

Requiring a customer's ZIP code is illegal in California, where the state's 1971 law prohibits merchants from requesting or requiring a card-holder's "personal identification information" as a condition of accepting the card for payment. The California Supreme Court has ruled that the ZIP code qualifies as personal identification information because it is part of the cardholder's address. Companies face fines of $250–1000 for each violation.[6] Requiring a "personal identification number" (PIN) may also be a violation.

Card issuers have several countermeasures, including sophisticated software that can, prior to an authorized transaction, estimate the probability of fraud. For example, a large transaction occurring a great distance from the cardholder's home might seem suspicious. The merchant may be instructed to call the card issuer for verification, or to decline the transaction, or even to hold the card and refuse to return it to the customer. The customer must contact the issuer and prove who they are to get their card back (if it is not fraud and they are actually buying a product).

In Australia, there is a service called "Paypass" or more colloquially known as "tap and go". This is where a person can purchase goods or services and can just tap the credit (or debit) card on the card reader. If the transaction is less than Aud$100.00, no PIN or signature is required. A stolen credit or debit card could be used for a significant amount of these transactions before the true owner can have the account cancelled.

Compromised accounts

Card information is stored in a number of formats. Card numbers – formally the Primary Account Number (PAN) – are often embossed or imprinted on the card, and a magnetic stripe on the back contains the data in machine readable format. Fields can vary, but the most common include:

Card not present transaction

The mail and the Internet are major routes for fraud against merchants who sell and ship products, and affects legitimate mail-order and Internet merchants. If the card is not physically present (called CNP, card not present) the merchant must rely on the holder (or someone purporting to be so) presenting the information indirectly, whether by mail, telephone or over the Internet. While there are safeguards to this,[7] it is still more risky than presenting in person, and indeed card issuers tend to charge a greater transaction rate for CNP, because of the greater risk.

It is difficult for a merchant to verify that the actual cardholder is indeed authorising the purchase. Shipping companies can guarantee delivery to a location, but they are not required to check identification and they are usually not involved in processing payments for the merchandise. A common recent preventive measure for merchants is to allow shipment only to an address approved by the cardholder, and merchant banking systems offer simple methods of verifying this information. Before this and similar countermeasures were introduced, mail order carding was rampant as early as 1992.[8] A carder would obtain the credit card information for a local resident and then intercept delivery of the illegitimately purchased merchandise at the shipping address, often by staking out the porch of the residence.

Small transactions generally undergo less scrutiny, and are less likely to be investigated by either the card issuer or the merchant. CNP merchants must take extra precaution against fraud exposure and associated losses, and they pay higher rates for the privilege of accepting cards. Fraudsters bet on the fact that many fraud prevention features are not used for small transactions.

Merchant associations have developed some prevention measures, such as single use card numbers, but these have not met with much success. Customers expect to be able to use their credit card without any hassles, and have little incentive to pursue additional security due to laws limiting customer liability in the event of fraud. Merchants can implement these prevention measures but risk losing business if the customer chooses not to use them.

Identity theft

Identity theft can be divided into two broad categories: application fraud and account takeover.

Application fraud

Application fraud takes place when a person uses stolen or fake documents to open an account in another person's name. Criminals may steal documents such as utility bills and bank statements to build up useful personal information. Alternatively, they may create fake documents. With this information, they could open a credit card account or Ioan account in the victim's name, and then fully draw it.

Skimming

"Skimmer (device)" redirects here. For other uses, see Skimmer (disambiguation).

Skimming is the theft of payment card information used in an otherwise legitimate transaction. The thief can procure a victim's card number using basic methods such as photocopying receipts or more advanced methods such as using a small electronic device (skimmer) to swipe and store hundreds of victims’ card numbers. Common scenarios for skimming are restaurants or bars where the skimmer has possession of the victim's payment card out of their immediate view.[9] The thief may also use a small keypad to unobtrusively transcribe the 3 or 4 digit Card Security Code, which is not present on the magnetic strip. Call centers are another area where skimming can easily occur.[10] Skimming can also occur at merchants such as gas stations when a third-party card-reading device is installed either outside or inside a fuel dispenser or other card-swiping terminal. This device allows a thief to capture a customer’s card information, including their PIN, with each card swipe.[11]

Instances of skimming have been reported where the perpetrator has put over the card slot of an ATM (automated teller machine) a device that reads the magnetic strip as the user unknowingly passes their card through it.[12] These devices are often used in conjunction with a miniature camera (inconspicuously attached to the ATM) to read the user's PIN at the same time.[13][14] This method is being used in many parts of the world, including South America, Argentina,[15] and Europe. Another technique used is a keypad overlay that matches up with the buttons of the legitimate keypad below it and presses them when operated, but records or wirelessly transmits the keylog of the PIN entered. The device or group of devices illicitly installed on an ATM are also colloquially known as a "skimmer". Recently made ATMs now often run a picture of what the slot and keypad are supposed to look like as a background, so that consumers can identify foreign devices attached.

Skimming is difficult for the typical cardholder to detect, but given a large enough sample, it is fairly easy for the card issuer to detect. The issuer collects a list of all the cardholders who have complained about fraudulent transactions, and then uses data mining to discover relationships among them and the merchants they use. For example, if many of the cardholders use a particular merchant, that merchant can be directly investigated. Sophisticated algorithms can also search for patterns of fraud. Merchants must ensure the physical security of their terminals, and penalties for merchants can be severe if they are compromised, ranging from large fines by the issuer to complete exclusion from the system, which can be a death blow to businesses such as restaurants where credit card transactions are the norm.

Checker

Checker is a term used for a process to verify the validity of stolen card data.[16] The thief presents the card information on a website that has real-time transaction processing. If the card is processed successfully, the thief knows that the card is still good. The specific item purchased is immaterial, and the thief does not need to purchase an actual product; a web site subscription or charitable donation would be sufficient. The purchase is usually for a small monetary amount, both to avoid using the card's credit limit, and also to avoid attracting the card issuer's attention. A website known to be susceptible to carding is known as a cardable website.

In the past, carders used computer programs called "generators" to produce a sequence of credit card numbers, and then test them to see which were valid accounts. Another variation would be to take false card numbers to a location that does not immediately process card numbers, such as a trade show or special event. However, this process is no longer viable due to widespread requirement by internet credit card processing systems for additional data such as the billing address, the 3 to 4 digit Card Security Code and/or the card's expiration date, as well as the more prevalent use of wireless card scanners that can process transactions right away. Nowadays, carding is more typically used to verify credit card data obtained directly from the victims by skimming or phishing.

A set of credit card details that has been verified in this way is known in fraud circles as a phish. A carder will typically sell data files of the phish to other individuals who will carry out the actual fraud. Market price for a phish ranges from US$1.00 to US$50.00 depending on the type of card, freshness of the data and credit status of the victim.

BIN attack

Credit cards are produced in BIN ranges. Where an issuer does not use random generation of the card number, it is possible for an attacker to obtain one good card number and generate valid card numbers by changing the last four numbers using a generator. The expiry date of these card IDs would most likely be the same as the good card.

Phishing

Scammers may use a variety of schemes to lure victims into giving them their card information through tricks such as websites pretending to be of a bank or payment system. Telephone phishing can also be employed, in which a call center is set up to pretend to be associated with a banking organization.

Balance transfer checks

Some promotional offers include active balance transfer checks which may be tied directly to a credit card account. These are often sent unsolicited, and may occur as often as once per month by some financial institutions. In cases where checks are stolen from a victim's mailbox they can be used at point of sales locations thereby leaving the victim responsible for the losses. They are one path at times used by fraudsters.

Unexpected repeat billing

When a card holder buys something from a vendor and expects the card to be charged only once, a vendor may charge the card a small amount multiple times at infrequent intervals such as monthly or annually until the card expires. The vendor may state in the fine print that the customer is now a "member" and the membership will be renewed periodically unless the card holder notifies the vendor in accordance with a cancellation procedure in the "membership agreement" which the card holder agreed to when they made the initial purchase. Because the periodic charges are unexpected, infrequent, and small, most card holders will not notice the charges. If a card holder complains to the bank that the charges were unauthorized, the bank will notify the vendor of the disputed charges and the vendor will respond that the card holder never cancelled the "membership" which the card holder agreed to. Since most card holders have no idea what the cancellation procedure is and the vendor will reveal it only to new customers, the bank will not reverse the charges, but instead will offer to cancel the credit card and reissue it with a different account number or expiration date. Unexpected repeat billing is in a gray area of the law, depending on whether the customer legitimately agreed to the charges.

Online bill paying or internet purchases utilizing a bank account are a source for repeat billing known as "recurring bank charges". These are standing orders or banker's orders from a customer to honor and pay a certain amount every month to the payee. With E-commerce, especially in the United States, a vendor or payee can receive payment by direct debit through an Automated Clearing House (ACH). While many payments or purchases are valid, and the customer has intentions to pay the bill monthly, some are known as Rogue Automatic Payments.[17] Such an order can be authorized by giving a payee permission to submit agreed upon charges for a service or product using an electronic or digital signature. There may be a small section sometimes at the very bottom of a website containing a box and information usually called the "terms and conditions". Among other things these limit a customer’s ability to sue in the event of a dispute or may limit recourse to arbitration. By placing a mark in the box the customer agrees the terms and conditions that may include authorization to be billed monthly for a certain time period. Sometimes, or in the case of a site with other than honorable intentions, the box will already be marked. If the user or future payee does not read far enough down the page of the terms and submits the transaction then a monthly recurring charge will result. A large percentage of consumers do not read the terms, or just glances over them so the marked box may go unnoticed. A Findlaw survey from 2011 and one from 2015 produced similar results that 54% of online users say they either quickly skim or ignore any user agreements, and only 22% read every word and understand it thoroughly. This is even though online commerce rose from 200 billion to 300 billion dollars a year.[18] The company provides a link to free information on consumer protection while online shopping.

Profits, losses and punishment

United States

The Department of Justice has announced in September 2014 that it will seek to impose a tougher law to combat overseas credit card trafficking. Authorities say the current statute is too weak because it allows people in other countries to avoid prosecution if they stay outside the United States when buying and selling the data and don't pass their illicit business through the U.S. The Department of Justice asks Congress to amend the current law that would make it illegal for an international criminal to possess, buy or sell a stolen credit card issued by a U.S. bank independent of geographic location.[19]

Cardholder liability

In the US, federal law limits the liability of card holders to $50 in the event of theft of the actual credit card, regardless of the amount charged on the card, if reported within 60 days of receiving the statement.[20] In practice many issuers will waive this small payment and simply remove the fraudulent charges from the customer's account if the customer signs an affidavit confirming that the charges are indeed fraudulent. If the physical card is not lost or stolen, but rather just the credit card account number itself is stolen, then Federal Law guarantees card holders have zero liability to the credit card issuer.[21]

Merchants

The merchants and the financial institutions bear the loss. The merchant loses the value of any goods or services sold, and any associated fees. If the financial institution does not have a charge-back right then the financial institution bears the loss and the merchant does not suffer at all. These losses incline merchants to be cautious and often they ban legitimate transactions and lose potential revenues. Online merchants can choose to apply for additional services that credit card companies offer, such as Verified by Visa and MasterCard SecureCode. However, these are complicated and awkward to do or use for consumers so there is a trade-off of making a sale easy and making it secure.

The liability for the fraud is determined by the details of the transaction. If the merchant retrieved all the necessary pieces of information and followed all of the rules and regulations the financial institution would bear the liability for the fraud. If the merchant did not get all of the necessary information they would be required to return the funds to the financial institution. This is all determined through the credit card processory.

United Kingdom

In the UK, credit cards are regulated by the Consumer Credit Act 1974 (amended 2006). This provides a number of protections and requirements.

Any misuse of the card, unless deliberately criminal on the part of the cardholder, must be refunded by the merchant or card issuer.


Credit card companies

To prevent being "charged back" for fraud transactions, merchants can sign up for services offered by Visa and MasterCard called Verified by Visa and MasterCard SecureCode, under the umbrella term 3-D Secure. This requires consumers to add additional information to confirm a transaction.

Often enough online merchants do not take adequate measures to protect their websites from fraud attacks, for example by being blind to sequencing. In contrast to more automated product transactions, a clerk overseeing "card present" authorization requests must approve the customer's removal of the goods from the premises in real time.

Credit card merchant associations, like Visa and MasterCard, receive profits from transaction fees, charging between 0% and 3.25% of the purchase price plus a per transaction fee of between 0.00 USD and 40.00 USD.[22][23] Cash costs more to bank up, so it is worthwhile for merchants to take cards. Issuers are thus motivated to pursue policies which increase the money transferred by their systems. Many merchants believe this pursuit of revenue reduces the incentive for credit card issuers to adopt procedures to reduce crime, particularly because the cost of investigating a fraud is usually higher than the cost of just writing it off. These costs are passed on to the merchants as "chargebacks". This can result in substantial additional costs: not only has the merchant been defrauded for the amount of the transaction, he is also obliged to pay the chargeback fee, and to add insult to injury the transaction fees still stand.. Additionally merchants may lose their merchant account if their percent of chargeback to overall turnover exceeds some value related to their type of product or service sold.

Merchants have started to request changes in state and federal laws to protect themselves and their consumers from fraud, but the credit card industry has opposed many of the requests. In many cases, merchants have little ability to fight fraud, and must simply accept a proportion of fraud as a cost of doing business.

Because all card-accepting merchants and card-carrying customers are bound by civil contract law there are few criminal laws covering the fraud. Payment transfer associations enact changes to regulations, and the three parties— the issuer, the consumer, and the merchant— are all generally bound to the conditions, by a self-acceptance term in the contract that it can be changed.

Merchants

The merchant loses the payment, the fees for processing the payment, any currency conversion commissions, and the amount of the chargeback penalty. For obvious reasons, many merchants take steps to avoid chargebacks—such as not accepting suspicious transactions. This may spawn collateral damage, where the merchant additionally loses legitimate sales by incorrectly blocking legitimate transactions. Mail Order/Telephone Order (MOTO) merchants are implementing Agent-assisted automation which allows the call center agent to collect the credit card number and other personally identifiable information without ever seeing or hearing it. This greatly reduces the probability of chargebacks and increases the likelihood that fraudulent chargebacks will be successfully overturned.[7]

Famous credit fraud attacks

Between July 2005 and mid-January 2007, a breach of systems at TJX Companies exposed data from more than 45.6 million credit cards. Albert Gonzalez is accused of being the ringleader of the group responsible for the thefts.

In August 2009 Gonzalez was also indicted for the biggest known credit card theft to date — information from more than 130 million credit and debit cards was stolen at Heartland Payment Systems, retailers 7-Eleven and Hannaford Brothers, and two unidentified companies.[24]

In 2012, about 40 million sets of payment card information were compromised by a hack of Adobe Systems.[25]

In July 2013, press reports indicated four Russians and a Ukrainian were indicted in New Jersey for what was called “the largest hacking and data breach scheme ever prosecuted in the United States.” [26]

Between 27 November 2013 and 15 December 2013 a breach of systems at Target Corporation exposed data from about 40 million credit cards. The information stolen included names, account number, expiry date and Card security code.[27]

From 16 July to 30 October 2013, a hacking attack compromised about a million sets of payment card data stored on computers at Neiman-Marcus.[25][28]

On September 8, 2014, The Home Depot confirmed that their payment systems were compromised. They later released a statement saying that the hackers obtained a total of 56 million credit card numbers as a result of the breach.

Countermeasures

Countermeasures to combat credit card fraud include the following.

By merchants:

By card issuers:

By Governmental and Regulatory Bodies:

By cardholders:

Additional technological features:

See also

References

  1. ↑ "Consumer Sentinel Network Data Book: January - December 2008" (PDF). Federal Trade Commission. 26 February 2009. Retrieved 21 February 2010.
  2. 1 2 Hassibi PhD, Khosrow (2000). Chapter 9 on "Detecting Payment Card Fraud with Neural Networks in book "Business Applications of Neural Networks". Singapore-New Jersey-London-Hong Kong: World Scientific. pp. 141–158. ISBN 978-9810240899.
  3. ↑ Paterson, Ken (December 2008). "Credit Card Issuer Fraud Management, Report Highlights" (PDF). Mercator Advisory Group. Archived from the original (PDF) on 29 December 2009.
  4. ↑ "Plastic card fraud goes back up". BBC. 12 March 2008. Retrieved 14 October 2013.
  5. ↑ "Court filings double estimate of TJX breach". 2007.
  6. 1 2 "Zip Codes Draw Fire", Wall Street Journal, 22 February 2011, page C7
  7. 1 2 Adsit, Dennis (21 February 2011). "Error-proofing strategies for managing call center fraud". isixsigma.com.
  8. ↑
  9. ↑ Inside Job/Restaurant card skimming. Journal Register.
  10. ↑ Little, Allan (19 March 2009). "Overseas credit card scam exposed". bbc.co.uk.com.
  11. ↑ NACS Magazine – Skimmming. nacsonline.com
  12. ↑ All About Skimmers Krebs on security
  13. ↑ ATM Camera Snopes.com
  14. ↑ "Manipulated ATMs". The H. 2007. Archived from the original on 26 July 2013.
  15. ↑ Clarín
  16. ↑ Krebs, Brian (4 June 2014). "Peek Inside a Professional Carding Shop". Retrieved 8 August 2015.
  17. ↑ "Rogue automatic payments- Retrieved 2016-02-07
  18. ↑ Findlaw- Retrieved 2016-02-07
  19. ↑ Tucker, Eric. "Prosecutors target credit card thieves overseas". AP. Retrieved 13 September 2014.
  20. ↑ Section 901 of title IX of the Act of May 29, 1968 (Pub. L. No. 90-321), as added by title XX of the Act of November 10, 1978 (Pub. L. No. 95-630; 92 Stat. 3728), effective May 10, 1980
  21. ↑ "Lost or Stolen Credit, ATM, and Debit Cards". Ftc.gov. Retrieved 2 August 2014.
  22. ↑ Mastercard Interchange Rates
  23. ↑ Visa Interchange Rates
  24. ↑ http://www.theregister.co.uk/2009/08/17/heartland_payment_suspect/
  25. 1 2 Skimming Off the Top; Why America has such a high rate of payment-card fraud, 15 February 2014, The Economist
  26. ↑ Russian hackers charged in 'biggest' data breach case, 160mn credit card numbers stolen, 25 July 2013, Catherine Benson, Reuters
  27. ↑ The Wall Street Journal http://online.wsj.com/news/articles/SB10001424052702304367204579267992268980478. Missing or empty |title= (help)
  28. ↑ Neiman Marcus Data Breach FAQ: What to Do Now, by Paul Wagenseil, 27 January 2014, Tom's guide
  29. 1 2 Hassibi PhD, Khosrow. Detecting Payment Card Fraud with Neural Networks in the book titled "Business Applications of Neural Networks". World Scientific. Retrieved 10 April 2013.
  30. ↑ IBM RiskTech. "Risk — Smarter Risk Management for Financial Services". Risk — Smarter Risk Management for Financial Services. Retrieved 14 July 2011.
  31. ↑ Richardson, Robert J. "Monitoring Sale Transactions for Illegal Activity" (PDF). Monitoring Sale Transactions for Illegal Activity. Retrieved 14 July 2011.
  32. ↑ FraudLabs. "10 Measures to Reduce Credit Card Fraud". 10 Measures to Reduce Credit Card Fraud for Internet Merchants. FraudLabs. Retrieved 14 July 2011.
  33. ↑ Alhothaily, Abdulrahman; Alrawais, Arwa; Cheng, Xiuzhen; Bie, Rongfang (2014). "Towards More Secure Cardholder Verification in Payment Systems" 8491: 356–367. doi:10.1007/978-3-319-07782-6_33. ISSN 0302-9743.
  34. ↑ BankInfoSecurity. "FFIEC: Out-of-Band Authentication". FFIEC: Out-of-Band Authentication. BankInfoSecurity. Retrieved 14 July 2011.
  35. ↑ Early Warning Systems. "Early Warning Systems". Early Warning Systems. Early Warning Systems. Retrieved 14 July 2011.
  36. ↑ Financial Services - Information Sharing and Analysis Center (FS-ISAC). "Financial Services - Information Sharing and Analysis Center". Financial Services - Information Sharing and Analysis Center. FS-ISAC. Retrieved 14 July 2011.
  37. ↑ FFIEC. "IT Booklets » Information Security » Introduction » Overview". FFIEC IT Examination Handbook - Credit Cards. FFIEC. Retrieved 14 July 2011.
  38. ↑ FFIEC. "IT Booklets » Retail Payment Systems » Retail Payment Systems Risk Management » Retail Payment Instrument Specific Risk Management Controls". FFIEC IT Examination Handbook - Credit Cards. FFIEC. Retrieved 14 July 2011.
  39. ↑ Avoiding Credit and Charge Card Fraud

External links

This article is issued from Wikipedia - version of the Wednesday, April 27, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.