Skip to main content

More on PCI: The Costs of Credit Card Fraud

Posted by: admin 14 years, 9 months ago

For all the circus atmosphere of the PCI debate at Shmoo, I got the feeling that most everyone agreed:  PCI is getting the worse security offenders up to speed.  There is no guarantee that they are 'doing it right', but most are doing it better.  If the payment system had been designed correctly, then all of this effort to secure payment data would not be necessary.  Sadly, it is too late to fix this because of cost.  Oh, wait. Stop. Actually, that last point was somewhat contentious.

It's time to discuss the "4,000,000 band-aids vs. Just doing it right" debate point from Great (and Ongoing) PCI-DSS debate.  @mycurial made the point that if payment processing was designed correctly, then all this security infrastructure would not be needed.  Why not make the change? Cost, was one answer.  The key questions here are 1. How much? 2. To whom?  Visa apparently does not release these numbers, luckily, by using a complex statistical analysis function known as 'subtraction' I have come up with an estimate. 

According to the 2009 LexisNexis® True Cost of Fraud Study (Watch out! PDF!, but worth it!) the annual costs breakdown as follows:  $4.8 billion for Consumers, $11 billion for Financial Institutions and $100 billion for merchants.  But that's not all:

Factoring in the additional cost of lost/stolen merchandise, U.S.
retail merchants are suffering a total industry-wide fraud loss of
$191 billion

The study claims that 16% of the $191 billion is in fees to "financial institutions". It doesn't specify whether that included the Brands (I assume it does).  So, just using these numbers, it would appear that FIs net $19.5 billion from fraudulent transactions.  I guess one person's costs are always someone else's revenues. 

Current rating: 1

Recent Posts

Archive

2024
2022
2021
2019
2018
2017
2016
2015
2014
2013
2012
2011
2010
2009
2008

Categories

Tags

Authors

Feeds

RSS / Atom