Current Trends in Chargebacks from Internet Sales

1. Current Trends in Chargebacks from Internet Sales A look at key indicators and future ideas Bob O’Neill, Payment Program Manager Merchant Risk Council

2. Chargebacks – Why Me?

3. Perspective ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

4. Perspective ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

5. Chargeback Metrics and TrendsAirlines • What should I be looking at? • How does fraud prevention relate to chargebacks? • What can I do with them? • Why can’t the issuers help me out? • What is the MRC doing to help? ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

6. Time Higher net return $ Increased Complexity Malicious individuals continue to evolve schemes in an effort to obtain greater anonymity and higher return on investment with less risk Bad C2C Networks Malware /Sniffers Online Ad Fraud Complexity Re-Shipping fraud Triangulation Shipping fraud Friendly Fraud Good Source: 2008 PCI SSC Community Meeting

7. What should I be looking at? • Chargeback losses as a % of total online booking sales • % of bookings that turn out to be fraudulent • What else should I be looking at? • Loss of sales due to tight fraud screening controls • Recovery of past chargebacks (wins) • Credits to customers due to customer service issues • Compare to other e-commerce vertical trends ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

8. Current Chargeback Benchmarks • Chargeback metrics • Cybersource Airline Online Fraud Report • Overall – 1.5% of Online bookings are lost to payment fraud – but the range is .7% to 3.3% • T&E – 60% Friendly fraud. General merch. 30-35% • Cost of managing to this level of CB’s • Staffing cost for manual review grows at the same rate of bookings • Adding new screening tools takes time to implement, can be high cost of entry and take time to tune • Airlines with longer history have better overall chargeback metrics • Reject due to suspected fraud 1.9 bookings for each fraudulent booking ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

9. CB’s what do I do with them? • “Friendly Fraud” makes up 53% to 66% of fraud codes in the T&E space • Remainder is true fraud and not win-able • 53% to 63% is the highest attainable win rate • +AVS & Descrip. of service min. req. per rules • Win rates from 5-10% on average • +CID result code win rate increases to 10-20% ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

10. Post charge review • Determine which are missed fraud and which are friendly fraud • Provides fraud system fine tuning insight • Provide CH name verification against 3rd party service – win rate increases 17-25% • CH & traveler at same address win rate increases 14-22% • Plus additional information (ipgeo, repeat traveler) win rate increases 21-32% • Contact and validate travel with CH, sign auth form charge is valid, increase win rate 2-4% ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

11. CB’s • Remaining friendly fraud CB’s not won, refer to collections, possible 5-30% collectable • If you do everything possible and have all the data points the maximum available win rate could be as high as 45% of all fraud received ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

12. Media Attention ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

13. Past year trend • Friendly Fraud ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

14. Can the issuers help? • The solution is not passing the loss back and forth • Consumers like to use credit cards online for the protection they offer • For issuers online transactions are 5-7 times more likely to be fraud • Tools for merchants and issues are limited • Solution: Work Together and share more data ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

15. MRC Merchant Issuer Forum • Designed to address a long term approach to online CC fraud and chargebacks • Near real time multi-point views of transaction fraud • Learning the unique attributes of e-Commerce verticals • Networking and sharing current information and trends ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

16. We have learned that there are resource and legal challenges to getting pilots and tests underway but we have a few pointers • Start small and gather learnings from current process first and foremost • You do not need to do large retro data studies in order to get learnings and instant value • In order to get over legal hurdles you need to focus on what you are doing today. • Don’t try and get approval for large data exchanges if you can test out manually thru processes and data that is already being shared today. • Leverage and build off of that versus creating something totally new • Participants are eager to share but may be limited in disclosing who they are partnering with. • We need to leverage the MRC to anonymize the results so that the group can learn from the pilots and get more folks interested by sharing the case studies

17. Order cancellation, order declined due to fraud is one of the biggest opportunities the working group can tackle • Issuer approves but merchant declines and or stops order due to fraud concerns • Issuer is blind to this decision which impacts fraud models, customer confusion • Merchant aborts/denies order due to fraud triggers prior to submitting to issuer for auth - Same as above plus does not prevent fraud at other merchants • Issuer approves but creates a case and verifies with the customer that the auth is not authorized • Merchant is blind to the fraud claim and continues to fulfill the order • Identify merchants interested in testing and match up to an issuer that is willing to test. • Keys • Volume-Is there enough transactions from this particular merchant and issuer to have a large enough sample? • Timing-How quickly can issuer identify fraud and notify merchant, and how quickly can merchant notify issuer • Channel-How to notify and through what vehicle (phone, web portal, secure email) • Tracking-Identify and track key metrics for evaluation and success

18. Preferred verification / fraud escalation is an area that can lead to incremental fraud savings for both merchants and issuers • Centralized merchant verifications-Set up criteria where issuer will accept call from particular merchants for certain high risk situations-premium customers, high risk transactions, or organized type of activity • Most merchants are already calling issuers so this is not an incremental call but more about getting the call to the right place • Identify merchants interested in testing and match up to an issuer that is willing to test. • Issuers need to identify where and how these merchant verification calls are handled today and leverage that process and build off of it. • Keys to consider - Is there enough volume of transactions from this particular merchant and issuer to have a large enough sample? • Identify and track the key metrics for evaluation and success.

19. Initial results from the “airline” preferred merchant verification initiative are impressive We receive calls from eight different airlines so far. We have dedicated contacts with two of the eight airlines Merchant Participation We have received a total of 55 calls from the eight airlines. 54 of the 55 transactions were fraudulent for a 98% hit rate Call Volume Approximately $127,000 in fraudulent airline transactions have been prevented through this program. Dollar Value US Air Hawaii Air Southwest Air Alaska Air United Continental Air American Air Delta Air Merchant Airlines Bold indicates dedicated contact All data above was captured from May 1 to January 15th

20. AVS has created challenges from a customer experience perspective • Auth comes to issuer for zip verification and auth approval • Issuer approves the auth but provides zip mismatch response • Merchant declines the transaction due to zip mismatch • Customer calls issuer because card was declined • Customer wants to know why we declined • Issuer sees approval on our system • Customer caught in the middle

21. How can we take the merchant issuer fraud forum to the next level? • Hot topics, fraud trends and more on-going sharing of issues • This not all about large data sharing projects • How we can learn each other business better and the day to day challenges from a fraud risk perspective

22. What are the other most logical tests/pilots we could explore? • Address verification expansion-Address matches but has been changes in last 30 days, and or other account updates in last 30 days • -Negative data, black list sharing

23. MRC Advocacy ProgramVISA Misuse of Authorization Fee ARC PROPRIETARY AND CONFIDENTIAL. This document includes confidential information that is proprietary to Airlines Reporting Corporation (ARC). Disclosure of this document or any information contained herein to third parties is prohibited without the prior written consent of an authorized ARC officer. Obsolete versions of this document should be destroyed in a manner to prevent compromise of the information, e.g., shredding.

24. Questions?Thank You Bob O’Neill, Payments Program Manager Merchant Risk Council, www.merchantriskcouncil.org bob@merchantriskcouncil.org 206-364-2789 x115