An Investigation of the Causes and Consequences of Card Not Present
Total Page:16
File Type:pdf, Size:1020Kb
$QLQYHVWLJDWLRQRIWKHFDXVHVDQGFRQVHTXHQFHV RIFDUGQRWSUHVHQWIUDXGLWVLPSDFWDQG VROXWLRQ .LQJVOH\&KLEX]RU$JXRUX $WKHVLVVXEPLWWHGLQSDUWLDOIXOILOPHQWRIWKHUHTXLUHPHQWVRIWKH 8QLYHUVLW\RI(DVW/RQGRQIRUWKHGHJUHHRI 'RFWRURI,QIRUPDWLRQ6HFXULW\ 6HSWHPEHU Abstract The boom of electronic commerce technologies in recent years has drastically increased the demand for an effective electronic method to pay or be paid. The currently predominant method is online card payment, in which the cardholder is not present at the point of sale. However this method is accompanied by huge vulnerabilities and also serves as a low-risk avenue for fraudsters to steal card details with the intent to defraud online merchants. These merchants are those who mostly bear the overall risk and consequences because they cannot provide a document signed by the legitimate cardholder. Several attempts and proposals have been introduced to solve this problem. However, many have failed to be adopted, while those that have been adopted have not been able to adequately solve the problem. The card payment industry is fully aware of the problem and its consequences, but it has abdicated responsibility for fraud in this type of transaction, and declines to guarantee the “card-not-present” fraud solutions that have been proposed during the past ten years. Instead, the industry has chosen only to accept responsibility for fraud arising from the “card present” environment, which is of low risk because it uses chip-and-pin technology. As a result, many merchants have withdrawn from online business for fear of losses, while consumers are sometimes turning back to alternative payment and traditional “bricks-and-mortar”-style shopping, for fear of identity theft. In light of these problems and challenges, this research adopted a practice approach to investigate the causes and consequences of card-not-present fraud, the associated infiltration techniques, and the impact on the development of e-commerce, in order to unveil and establish an understanding of the background and characteristics of card-not- present fraud, its causes, its penetration techniques and aftermath. This research examined the result of the investigation, and proposes a feasible solution known as 3W-ADA Sentry System, built out of the framework of analytic geometry to counter threats of card-not-present fraud and related identity theft by introducing a non- electronic and low-cost dynamic tokenization process for card-not-present authentication. This proposal could eventually help to restore the security of online card payment authentication, restore the trust of participants, and improve the development of electronic commerce. However, due to limitations inherent in this research, it provides instead ii | P a g e recommendations concerning the additional work that would be required to turn the 3W- ADA Sentry into an Association or Scheme to promote its global adoption and its compatibility with the infrastructures and systems of relevant organisations. iii | P a g e 'HFODUDWLRQ ,KHUHE\FHUWLI\WKDWWKLVWKHVLVFRQVWLWXWHVP\RZQZRUNWKDWZKHUHWKHODQJXDJHRIRWKHUV LVVHWIRUWKTXRWDWLRQPDUNVVRLQGLFDWHDQGWKDWDSSURSULDWHFUHGLWLVJLYHQZKHUH,KDYH XVHGWKHODQJXDJHLGHDVH[SUHVVLRQVRUZULWLQJVRIDQRWKHU ,GHFODUHWKDWWKHWKHVLVGHVFULEHVRULJLQDOZRUNWKDWKDVQRWSUHYLRXVO\EHHQSUHVHQWHGIRU WKHDZDUGRIDQ\RWKHUGHJUHHRIDQ\LQVWLWXWLRQ 6LJQHGBBBBBBBBBBBBBBBBBBBBBBBBBB .LQJVOH\&KLEX]RU$JXRUX LY_3DJH Acknowledgement Firstly, I thank almighty GOD for his mercies, and wisdom, and for giving me the ability to embark upon, and successfully conclude, this project. I would also like to express my deep appreciation to my supervisor - Prof. Hamid Jahankhani, Dr. Sin Wee Lee and Dr Al-Nemrat Ameer - for their firm support, enthusiasm and persistent supervision throughout the research period. Without their valuable expertise, tolerance and guidance, this thesis would not have been possible. I also convey my gratitude to the Board and Management of Paymenex Limited and Paymenex Regional Administrators worldwide for their unflinching financial support for the overall cost of this research degree program, and for their feedback in evaluating the solution produced by this research. My appreciation and love also extends to the entire Aguoru family for their love, inspiration, care and positive encouragement throughout my research period. Glory be to God Almighty, Amen! v | P a g e Publications INVESTIGATION OF THE CAUSES AND CONSEQUENCES OF CARD-NOT- PRESENT FRAUD, ITS IMPACT AND SOLUTION 7th annual event of the Advances in Computing and Technology Conference (AC&T) 2012. vi | P a g e Table of Contents ABSTRACT --------------------------------------------------------------------------------------- II DECLARATION -------------------------------------------------------------------------------- IV ACKNOWLEDGEMENT ---------------------------------------------------------------------- V PUBLICATIONS -------------------------------------------------------------------------------- VI TABLE OF CONTENTS --------------------------------------------------------------------- VII LIST OF FIGURES -------------------------------------------------------------------------- XVII LIST OF TABLES ----------------------------------------------------------------------------- XX GLOSSARY TABLE ------------------------------------------------------------------------ XXII 1. PART 1 - INTRODUCTION-------------------------------------------------------------- 1 1.1 Introduction ---------------------------------------------------------------------------------- 1 1.2 Problem statement -------------------------------------------------------------------------- 2 1.2.1 About the sponsor ----------------------------------------------------------------------- 2 1.2.2 Background to the problem------------------------------------------------------------ 3 1.3 Research question, purpose and scope -------------------------------------------------- 4 1.3.1 Research question ----------------------------------------------------------------------- 5 1.3.2 The research purpose ------------------------------------------------------------------- 5 1.3.3 The research scope ---------------------------------------------------------------------- 5 1.4 The research motivation ------------------------------------------------------------------- 6 vii | P a g e 1.4.1 Primary motivations -------------------------------------------------------------------- 6 1.4.2 Secondary motivation ------------------------------------------------------------------ 8 1.5 Related work and research ---------------------------------------------------------------- 8 1.5.1 Findings of related research ----------------------------------------------------------- 8 1.5.2 Solutions from related research ------------------------------------------------------- 9 1.6 Contribution to knowledge -------------------------------------------------------------- 11 1.6.1 Presentation of a philosophy of identity theft and card-not-present fraud ---- 11 1.6.2 Development of an academic framework for future research ------------------ 11 1.6.3 Introduction of a non-electronic and low-cost CNP fraud solution ----------- 12 1.6.3.1 Variation between existing solutions and the proposed new solution --- 13 1.6.3.2 Static vs. dynamic authentication data --------------------------------------- 15 1.6.3.3 Security of card and personal information in a CNP environment ------ 15 1.6.3.4 Benefits of replacing existing solutions with 3W-ADA Sentry ---------- 16 1.7 The research approach and context --------------------------------------------------- 18 1.7.1 Investigation --------------------------------------------------------------------------- 18 1.7.2 Evaluation ------------------------------------------------------------------------------ 18 1.7.3 Solution -------------------------------------------------------------------------------- 18 1.8 Research Structure ------------------------------------------------------------------------ 21 2. PART 2 – BACKGROUND AND LITERATURE REVIEW-------------------- 23 2.1 Introduction -------------------------------------------------------------------------------- 23 viii | P a g e 2.2 Information --------------------------------------------------------------------------------- 25 2.2.1 Value of information ----------------------------------------------------------------- 25 2.2.2 Information Security and Assurance ----------------------------------------------- 26 2.2.3 Trust ------------------------------------------------------------------------------------ 28 2.2.4 Research insight of Information and Trust in electronic commerce ----------- 29 2.3 Background to Electronic Commerce (E-Commerce) ----------------------------- 30 2.3.1 The trend of electronic commerce -------------------------------------------------- 30 2.3.2 Types of electronic commerce ------------------------------------------------------ 31 2.3.3 Key essentials of electronic commerce -------------------------------------------- 32 2.3.3.1 Business Model and Workflow Management System --------------------- 33 2.3.3.2 Shopping Cart and Content Management System ------------------------- 33 2.4 The B2C e-commerce transaction flowchart ---------------------------------------- 34 2.5 Electronic commerce: pros and cons to businesses--------------------------------- 38 2.6 The electronic commerce pros and cons to consumers ---------------------------- 39 2.7 Electronic Commerce payment systems ----------------------------------------------