NESTA Crime Online - University of Brighton Repository

Credit card fraud takes place mostly online. The categories of credit card fraud that
show the fastest growth include a substantial online component. This is reflected in the
increase of card-not-present fraud (CNP), counterfeit cards 37 and card ID theft, since
these types of fraud are more likely to occur online. Such methods are becoming more
important than the use of lost or stolen cards, or theft from the mail. 38
Figure 2 shows that these three categories of credit card fraud have proliferated in the
last decade, reflecting the rise in online transactions. Fifty-four per cent of card fraud
was on CNP operations, the fastest growing form of credit card fraud, with average
growth rates of 40 per cent per year from 1997 to 2007. APACS estimated that in the
UK, the share of Internet/e-commerce fraud on CNP activities was about 73 per cent of
the total in 2006 (£154.5 million). This figure rose by 32 per cent from 2005, when
Internet losses were £117 million and accounted for 65 per cent of CNP losses. 39 Using
fraudulent credit card data for online purchases can be easy and fast, as a final sale
does not require the card or the cardholder to be present. Online purchases can later be
sold for cash. 40
Fraud based on counterfeit cards temporarily fell from 2004 to 2006, perhaps due to the
introduction of chip and pin technology, but it picked up in 2006 to 2007 – at a 46 per
cent growth rate as cybercriminals discovered ways of outsmarting and circumventing
these preventative technologies. Chip and pin technology was described as an
‘extremely secure’ method of payment by representatives of banks and retailers. 41
37 This category can involve undertaking old style fraud, by skimming (ATM skimming, manipulated Pin Entry
Devices or a range of other more sophisticated techniques).
38 CNP fraud involves the use of stolen card details to pay for goods and services over the Internet. Card ID
theft occurs when a criminal uses a fraudulently obtained card or card details, along with stolen personal
information, to open or take over a card account in someone else’s name. Counterfeit card fraud involves
copying the information of the magnetic stripe in the card to forge a fake card that can be later used in ATMs
or to make purchases. As defined by APACS (2008): “Fraud: The Facts 2008”.
39 APACS, “Fraud: the facts” (2008).
40 For more information on this aspect see the section of this report on cybercrime value chains.
41 Sandra Quinn, director of corporate communications for APACS in 2005 noted that: "We don't think they can
use fake machines because the machines themselves are engineered to read the chip so they must be reading
the chip very carefully”; “Chip and pin security warning”, BBC News, available at
http://news.bbc.co.uk/1/hi/business/4108433.stm. This was reiterated during a recent interview with a senior
APACS staff member in 2008.
Page 18