Risk Assessment: Smartcard fraud scam

GLASGOW, SCOTLAND, January 04, 2011 (Press-News.org) Risk Assessment Department of Computer and Information Sciences, University of Strathclyde and Associates. Security is a balance between confidentiality, authentication and integrity versus convenience, cost and reliability. Figure 4 illustrates the balance that must be struck by stakeholders when implementing technical solutions to counter security vulnerabilities,

Abstract. The introduction of smartcard technologies has reduced the incidence
of card fraud in the UK, but there are still significant losses from fraudulent
card use. In this paper we detail the context of smartcard introduction and describe
the types of fraud that remain a threat to cardholders and other stakeholders
in the card system. We conclude with a risk analysis from the cardholder's
perspective and recommend greater cardholder awareness of such
risks. Susan Burns, George R. S. Weir
Department of Computer and Information Sciences, University of Strathclyde,
Glasgow G1 1XH, UK

Risk Assessment. Department of Computer and Information Sciences, University of Strathclyde and Associates. Security is a balance between confidentiality, authentication and integrity versus convenience, cost and reliability. Figure 4 illustrates the balance that must be struck by stakeholders when implementing technical solutions to counter security vulnerabilities, essentially this boils down to cost versus benefits.

This generic approach can be applied to security measures for smart card payments,
whereby:
• Cost is the amount it costs the card issuer and card scheme to support the plastic
card payments, including the cost of implementing changes to the system e.g.
longer keys or moving to online authentication to validate all card transactions;
• Performance considers convenience and reliability e.g. avoiding reputational
damage or inconvenience for customers or retailers;
• Risk is remaining level of risk which the security measures have not fully mitigated.
This could be financial loss, additional costs, loss of market share, reputational
damage, corporate embarrassment, legal or regulatory investigation or risk
to personal safety.
The potential loss or exposure from a given risk can be reduced through assessing and
management of the risk (Figure 5). Effective risk reduction methods may leave an
element of residual risk, but will bring benefits, although these may not always be financial, e.g., they could be reputational benefits.

A risk map is a technique to analyse and illustrate risks, likely causal events and potential
impacts [10]. The links shown are not always exhaustive but demonstrate the
potentially wide ranging impacts of each risk and support analysis of outcomes and
mitigation actions. As a tool, they also allow flexibility to consider how the impact of
one risk, e.g., card stolen, can be compounded by the occurrence of other risks, such
as the PIN having been obtained.
Figure 6 illustrates a risk map analysis for the cardholder, based upon four primary
risk conditions, card obtained by fraudsters, card details obtained by fraudsters, PIN
obtained by fraudsters, and PIN forgotten by cardholder. The associated cardholder
events represent the contexts in which the risks are created, and the impact arising
from these circumstances is also indicated.
For the cardholder, the key risks centre on the components for which the cardholder
is responsible, namely the smartcard, the PIN and documents such as statements
and receipts that contain card details. The events include some that are within
the cardholder's control, e.g., keeping a note of the PIN number, but others such as a compromised terminal are beyond cardholder control.

Summary and Conclusions. Risk Assessment Department of Computer and Information Sciences, University of Strathclyde and Associates. The introduction of smartcards to the UK marketplace has had a significant effect in reducing the incidence of card fraud, but further steps are required to prevent continued instances of fraud. A key step in this direction is to clarify the roles, responsibilities and risks faced by the different stakeholders in the card process. Furthermore, 'awareness raising' in which cardholders become more conscious of their risks and responsibilities may afford the best defence against consumer fraud. Our analysis of the card process, stakeholders and cardholder risks may contribute to this awareness.

Strathclyde is a great place to study and enjoy life at the same time. And this is where you can find out everything about us - from how we teach, to what's on in Glasgow and how to get around. We want to help you make the most of your time here, so we hope you'll come back to these pages to get all the latest news about what's happening on campus and in and around the city.