How do Banks Conduct Credit Card Fraud Investigations? Who Sets the Rules for Fraud Claims?
A credit card fraud investigation should be a collaborative process of considering facts and making a reasonable judgment on whether the cardholder or the merchant is to blame. Too often, however, it can start to feel like merchants and cardholders are in conflict with one another, with both sides providing facts to support their case.
But that raises the question, who gets to decide which facts are most important? What standards are in place to govern credit card fraud investigations? And, most importantly, how do banks conduct this process to ensure that decisions are fair and accurate?
What You Need to Know First
Understanding which incidents qualify for investigation as fraud can be confusing. Part of the problem is that the parties involved in this process are not necessarily on the same page regarding fraud. The average consumer knows very little about the ins and outs of credit card fraud; in fact, most don’t even know the difference between their bank and the card network. This can lead to miscommunication and other problems.
As we discussed in a recent blog post, not all fraud activity falls under the mantle of payment fraud. Threats like synthetic fraud and business email compromise (BEC) may be tied to payment fraud, but other threats like friendly fraud and family fraud also exist. In these cases, the customer is engaging in abuse which they (intentionally or unintentionally) try to pass off as third-party criminal activity. This can only be revealed during the credit card fraud investigation process, though.
We should also clarify that credit card companies like Visa and Mastercard don’t typically get involved in these investigations. They set the rules, but most payment disputes resulting from alleged fraud are handled by the cardholder’s issuing bank. Even among disputes that progress to the chargeback phase, only about 2% of cases will require the card network’s direct involvement (a process called arbitration).
With all that in mind, let’s examine how the payment fraud investigation process actually works. We’ll begin with how the process is handled on the bank’s end.
It Doesn’t Take a Super-Sleuth to Stop Fraud & Chargebacks.
All you need is the right tools and data. Click here to learn more.
The Fraud Investigation Process
When a cardholder disputes a charge, the issuer is expected to examine the details of the case and make a fair, impartial judgment to determine liability. The card networks have extensive and complex guidelines for this, and these rules determine how banks investigate disputes for the relevant card brand.
1. The customer makes a complaint:
The buyer might claim that the merchandise never arrived, or didn’t live up to expectations. The buyer could also claim the transaction was not authorized.
2. The bank gathers evidence:
The bank examines relevant information about the transaction to determine fault. (This can be done automatically through programs like Visa Merchant Purchase Inquiry or Mastercom Eliminator).
3. The bank examines the transaction:
The bank is responsible for reviewing the transaction data as it related to the customer’s claim, then evaluating whether the claim is reasonable.
4. The bank makes a decision:
The issuer decides to either reject the inquiry or file a chargeback on the customer’s behalf.
To illustrate, let’s look at how this process would work with a cardholder and issuer both based in the US (regulations in other countries may vary). Once the bank receives the cardholder’s inquiry, Federal Trade Commission (FTC) rules give them 30 days to acknowledge the customer’s claim. In an effort to provide better service to customers, though, banks will generally move quickly on disputes.
If the bank determines that the transaction in question was a fraudulent charge, they may choose to contact the authorities. If there are signs suggesting a larger pattern—especially one that crosses state lines—the US Federal Bureau of Investigation (FBI) could get involved. In most cases, though, the bank will handle the situation themselves, through their internal fraud team.
What Evidence Can the Bank Use?
There are many different pieces of evidence on which the issuer can base a decision as part of the credit card fraud investigation process. This may include:
From where did the buyer place the order? Did it match the cardholder’s location at that time?
When did the buyer conduct the transaction? Was it a reasonable time of day given the cardholder’s location?
Did the buyer’s IP address match that of the cardholder? If not, this may suggest that the purchase was fraudulent.
Is the cardholder enrolled in Verified by Visa, Mastercard SecureCode, or some other deployment of 3-D Secure? Was the technology used during the transaction?
Does the purchase seem unusual given the customer’s typical pattern of behavior? Is it something they’ve purchased before?
Was this a one-off incident, or was there a batch of unauthorized transactions tied to the cardholder’s account?
These are just a few examples. Ultimately, the evidence the issuer examines will vary based on the cardholder’s claim.
The bank might also send the merchant an inquiry for more information as part of the investigation process. The merchant should be on the lookout for these information requests, as a timely response could mean the difference between preventing a chargeback on one hand, or suffering lost revenue and paying costly chargeback fees on the other.
What Does the Bank Do in Cases of Fraud?
In cases of fraud, the cardholder’s liability is limited by law to $50 for a credit card transaction. For a debit card, the fraud liability limit is $500 or less depending on when it is discovered and reported. Of course, many banks choose to offer “zero-liability” cards to cardholders, meaning the bank protects the cardholder from any loss from fraud.
If the bank determines the claim of fraud is legitimate, they will advise the customer to immediately contact the three credit reporting bureaus (Equifax, Experian, and TransUnion). The cardholder can request an immediate credit freeze, which will prevent potential damage to the customer’s credit rating.
As for the transaction, the bank may either:
- Decide the merchant is at least partially responsible, and file a chargeback to claw back the funds. While this is happening, the money is tied up; neither the merchant, the bank, nor the cardholder has access to the funds.
- Reimburse the customer and simply write off the loss. This is common practice if the dollar value of the transaction does not justify the costs associated with the chargeback process.
While the bank wants to move fast, it can take up to 90 days to investigate the charge and complete an initial chargeback; the process can take even longer if the merchant decides to fight the dispute. This is called representment: the merchant literally “re-presents” the transaction to the issuer, along with evidence to support their claim that the transaction was legitimate, and should be upheld.
With representment, the bank must repeat their investigation, taking any additional evidence into account. All totaled, it’s not uncommon for the chargeback process to take six months or more to resolve.
The 2021 Chargeback Field Report
The 2021 Chargeback Field Report is now available. Based on a survey of over 400 US and UK merchants, the report presents a comprehensive, cross-vertical look at the current state of chargebacks and chargeback management.Free Download
Resolving Claims Outside the Dispute Process
Of course, even if the bank conducts a thorough credit card fraud investigation, they may still reach the wrong conclusion. Our data suggest that 60-80% of all chargebacks may be cases of friendly fraud, not criminal fraud. For instance, this may happen if a cardholder signs up for a free trial, but fails to cancel before regular billing kicks in. An unsupervised child completing an in-app purchase on a parent’s mobile device would be another example.
These are forms of chargeback abuse. Regardless whether it's intentional or not, these chargeback scams carry consequences for everyone:
lose revenue and merchandise and pay added fees and penalties. They see higher operating costs and may lose the ability to process card payments in the long term.
ace higher operating costs as they’re forced to devote more resources to investigating disputes. This can slow down other profit-generating departments within the organization.
can have their money tied up for weeks or months due to the chargeback process. This inability to access funds during this time could cause hardships.
It’s best for everyone if the cardholder directly contacts the merchant before filing a chargeback. The two parties may be able to collaboratively resolve the situation and avoid a dispute. This would be a “win-win” scenario for everyone: the cardholder could see faster resolution, while banks and merchants are spared the cost of the dispute process.
We recommend that cardholders only turn to the bank as a last resort. They should always try to resolve concerns through the merchant first if possible. For merchants, we strongly encourage adherence to customer service best practices to ensure every customer walks away satisfied.
Q: How does a credit card company investigate fraud?
A: Most payment card fraud investigations are actually handled by the cardholder’s issuing bank, rather than a card network like Visa or Mastercard. Generally speaking, after a customer makes a complaint, the bank will gather any relevant information and examine the transaction details closely. The bank then makes a decision based on the evidence available.
Q: How long does a bank fraud investigation take?
A: An initial, preliminary investigation can be conducted in a matter of days. However, if the process develops into a chargeback, the merchant may opt to challenge the customer’s claim. In some cases, this process can drag on for weeks, or even months, before the dispute is finally resolved.
Q: Who pays when a credit card is used fraudulently?
A: If a merchant accepts a fraudulent transaction, that merchant will probably be held liable for the resulting fraud. However, it’s common practice among issuing banks to simply “write off” some low-value transactions, as the cost of the chargeback process would not justify such action.
Q: Can credit card transactions be traced to identify fraudsters?
A: It’s possible to track down fraudsters based on their activity, but again, whether or not this will be done varies based on the situation. Law enforcement agencies like the FBI might get involved if there is evidence suggesting a large, coordinated operation to conduct fraud. For one-off cases, though, it’s unlikely that law enforcement will be able to identify a culprit, and the bank doesn’t have the resources to track down fraudsters individually.
Q: What evidence can the bank use as part of a credit card fraud investigation?
A: The bank can examine a variety of different types of evidence-based on the cardholder’s claim. Some commonly-cited evidence includes geolocation data, timestamps, IP addresses, 3-D Secure data, and behavioral indicators, just to name a few.