Introduction Reducing Payment-Card Fraud

Section 1: Foundation of the Study

Media reports on payment-card data breaches lead consumers to believe retail

companies should provide secure transactions without the fear of thieves obtaining the

cardholders’ data (Chang, Venkatasubramanian, West, & Lee, 2013). However, retailers

and bankers face the problem of theft of customer information during transmissions of

payment-card data every day (Chang et al., 2013). More than 15 million people have

their identity stolen through card readers and automated teller machines annually (Chang

et al., 2013). According to the Trustwave Global Security Report (Trustwave, 2016),

retail businesses accounted for 60% of the payment-card data breaches. Thieves obtain

information from the stripe on the back of the customer’s card using skimming

techniques (Fossi et al., 2009). Since the advent of e-commerce web sites, data breaches

and identity theft have increased (Hoffman, 2013). The purpose of this qualitative single

case study was to explore strategies business owners use to minimize payment-card

fraud.

Background of the Problem

Identity theft involves taking on another person’s identity for financial gain (Tan,

Guo, Cahalane, & Cheng, 2016). Tan et al. (2016) stated that retailers lose an estimated

$3.5 billion in lost revenue due to financial card transaction fraud. Payment acceptors’

network security infrastructures are not up to date, which allows criminals to capture card

information. While the dollar amounts retailers lose is significant, the victims and the

card issuers experience a variety of adverse effects (Cross & Kelly, 2016).

The effect on the victims includes physical health and well-being, financial

trauma, depression, and psychological traumas (Cross & Kelly, 2016). However,

globally, card issuers look for new methods to detect fraud and reduce organizational

costs, both fiscally and reputationally (Cross & Kelly, 2016). Canadian, European, and

United States card issuers have implemented the chip and pin technology, but card issuers

in the European Union and the United States still experience fraudulent data breaches

(Canadian Bankers Association, 2014).

Payment-card fraud is one of the most significant threats to business on a national

and international basis (Gold, 2014). Customers of major retailers, banks, and hospitality

services face the possibility of fraudulent card activity (Berezina, Cobanoglu, Miller, &

Kwansa, 2010) when presenting their card to pay for services or merchandise at brick and

mortar or online retailers. However, incidents of a data breach and payment-card fraud

have occurred at the merchant level at businesses such as Target, Sally’s Beauty Supply

(a nationwide beauty supply company), Home Depot, and Neiman Marcus that are

changing the customers’ feelings of security (Hardekopf, 2015).

Problem Statement

Critical public data in the United States are vulnerable to theft, creating severe

financial and legal implications for payment-card acceptors (Sen & Borle, 2015). The

cost of identity theft to online and brick and mortar retailers was approximately $16.31

billion in 2014 (Vona, 2015). The general business problem was that payment-card

acceptors and processors do not incorporate strategic systems to prevent card fraud and

identity theft at the card processing organization. The specific business problem was that

some international card processing organization managers lack strategies to minimize

payment-card fraud.

Purpose Statement

The purpose of this qualitative single case study was to explore strategies

international card processing organizations use to minimize payment-card fraud. The

targeted population was five to eight data security specialists working for an international

card processing organization in the southeast United States who have successfully

prevented data breaches and payment-card fraud. The implication for positive social

change included the potential for lowering the number of data breaches and payment-card

fraud instances, which could provide customers with confidence in using their payment

cards, reduce fraud losses, and thereby improve the economy.

Nature of the Study

Researchers may choose from three methods: quantitative, qualitative, and mixed

method. Qualitative researchers collect data by exploring documents, observing, and

interviewing interview participants (Marshall, Cardon, Poddar, & Fontenot, 2013). A

quantitative researcher may target the amount of data, allowing for a broad cross-section

and a large volume of numerical data to analyze (Vaitkevicius & Kazokiene, 2013).

Quantitative researchers use close-ended questions to test hypotheses and do not allow

for added probing (Vaitkevicius & Kazokiene, 2013). Mixed-method research may

enhance the gain made by both methods; however, mixed-method research needs

considerable investigative skills and creates additional time and information refining

(Venkatesh, Brown, & Bala, 2013). The use of a qualitative research method enabled the

collection of rich and thick data to discover the successful strategies that security

specialists in international card processing organizations in the Southeast United States

use to prevent data breaches and payment-card fraud.

Under consideration were three qualitative design strategies (a) single case, (b)

phenomenology, and (c) ethnography. The single qualitative case study approach offers

abundant opportunities to the researcher for learning and provided the ability to inform or

generate theory (Hart, 2013). A single case study design was chosen to focus on the issue

of payment card fraud reduction. Case study researchers focus on exploring a specific

phenomenon thoroughly, using a representative or typical case (Yin, 2014).

Phenomenological research entails collecting data about the human experience, with an

emphasis on subjectivity (Moustakas, 1994). By contrast, the narrative itself is the object

of interest to narrative researchers (Yin, 2014).

As the purpose of this study was to explore strategies business owners can

institute to minimize payment-card fraud, the single case study design was most

appropriate. A phenomenological design was not suitable for this study because the goal

was not to explore participant’s lived experiences (Moustakas, 1994). An ethnographic

study was not suitable for this study because the purpose of the study did not require field

observations; also, the time required to conduct an ethnographic study would have been

prohibitive.

Research Question

The goal of the study was to address one primary research question:

RQ1: What strategies do international card processing organization managers use to

minimize payment-card fraud?

Interview Questions

The following conceptualized interview questions aided in data collection:

1. What opportunities still exist for a person to commit payment-card fraud at the

card processing level?

2. What legal strategies do you see organizations taking to protect themselves

from monetary loss from data breaches?

3. What plans do you have to implement payment-card security?

4. How has your organization increased security to reduce those opportunities?

5. There are separate ways for card acceptors to combat fraud. What technology

tools has your organization implemented?

6. What strategies have you implemented or planning to make your payment-card

protection strategy stronger and yet less costly for your company?

7. How useful are the tools and strategies your organization has implemented?

8. What changes in the PCI-DSS standards need to be added that could increase

security?

9. What steps can payment-card acceptors take to increase security for accepting

payment cards?

10. If you implemented fraud-detection practices, what problems did you meet

during the conversion?

11. What else can you add about strategies that the payment-card acceptors could

implement to reduce and eliminate fraud and identity theft?

Conceptual Framework

The theory that served as the conceptual framework for this study was the fraud

theory, which was proposed by Cressey in the 1950s (Cressey, 1954). Cressey (1954)

developed the fraud theory to describe (a) why people commit fraud, (b) the

rationalization people use for having committed fraud, and (c) the financial need of

individuals who commit fraud. Fleming, Hermanson, Kranacher, and Riley (2016)

further defined Cressey’s fraud theory stating that people commit fraud because of (a)

opportunities, (b) rationalizations, and (c) peer pressure. The critical concepts of fraud

theory include fraud risk assessment, rationalizing the act, and the person’s motivation to

commit fraud. As applied to this study, fraud theory was right for the study because it

allowed the participants to effectively explore perceptions and experiences regarding

strategies to reduce payment-card fraud opportunities.

Operational Definitions

Botnet: Botnets are a network formed of hosts controlled remotely by a bot-

master to spread malicious viruses to a network (Narang, Hota, & Sencar, 2016).

Card not present: Card not present transactions are transactions performed when

the cardholder is not present such as Internet, mail-order, or telephone purchases (Sahin,

Bulkan, & Duman, 2013).

Card present: Card present is the offense of using a payment-card to buy

something with the knowledge that the forged or stolen payment-card has been revoked

or canceled or the card’s use is unauthorized (Card Present, 2014).

Denial of service: Denial of service refers to botnet attacks on Internet servers

through remote command to perform malicious attacks by the bot-master and denies

service to other servers (Wang, Lin, Cheng, & Chen, 2017).

Identity theft: Identity theft is the act of stealing a person’s identity for unlawful

gains (McNally, 2008).

Malware POS–point of sale: POS malware is a powerful software used to

illegally obtain payment-card datum (Steer, 2014).

Phishing: Phishing refers to attaching fake information websites using e-mails to

obtain a person’s personal data (Kim, Sefcik, & Bradway, 2016).

Vishing: Vishing refers to phone deception requiring phone answerers to enter

their payment-card or checking account information by the phone keypad to clear up

some financial problem (Mugari, Gona, Maunga, & Chiyambiro, 2016).

Assumptions, Limitations, and Delimitations

Assumptions

Assumptions are the elements the researcher assumes to be true without evidence

(Ellis & Levy, 2009). Three assumptions were the basis of the study. The first

assumption was that the participants would supply honest and detailed descriptions in

response to the interview questions. The second assumption was the qualitative single

case study was the best design to address the research question and to collect that data,

that the senior managers would provide access to the supporting documents and data.

The last assumption was that the participants were knowledgeable and willing to impart

information about how the company currently handles payment-card fraud.

Limitations

Limitations are internal threats to any study’s validity (Ellis & Levy, 2009). The

first limitation of the study was the willingness of the senior managers to take part in the

study. Because the study was conducted at a single company in the southeastern United

States, the strategies for card fraud detection may not be representative of other payment

card processing organizations located in the United States. The results of the study are

limited by the willingness of the participants to share their knowledge and organization

documents, the thoroughness of their responses, and the ability to recruit a sufficient

number of participants to achieve data saturation.

Delimitations

Delimitations are the stated boundaries of the study (Ellis & Levy, 2009). The

delimitations set the scholarly tone of the research and define what the research leaves

out (Ellis & Levy, 2009). The participants were data-security specialists at an

international payment-card processing organization in Georgia. Only data-security

specialists with a minimum of a bachelor’s degree and a minimum of 10 years of

experience in their respective fields took part in the study.

Significance of the Study

The results of the study may provide data-security experts with answers on how to

prevent payment-card fraud. The results of the study may create incentives for business

owners to follow payment-card industry data-security standard (PCI-DSS)

recommendations. The PCI-DSS incentives include (a) reduced liability, (b) reduced

revenue loss, (c) potential reduction in costs to consumers for products or services, (d)

increased consumer confidence leading to increased tax bases, (e) increased tax bases that

may lead to infrastructure improvements and (f) and an increased workforce. The

findings of this study may also add value to businesses by enhancing card acceptors’ and

processors’ ability to increase card security and reduce fraud opportunities.

Contribution to Business Practice

The results of this study have a practical business application. The results of the

study may increase business leaders’ awareness of the strategies needed to reduce

payment-card fraud opportunities. The results of this study could serve as a guide for

senior card processing organizations’ managers and card acceptors to reduce card fraud

by obtaining the knowledge of how to reduce fraud opportunities. Card acceptors may

increase POS security through enhanced technological advances that may result in a

reduction in payment-card fraud.

Implications for Social Change

The results of this study may have implications for social change. One

implication for positive social change is that the findings of this study may provide

practical strategies for card processing organizations’ senior managers to reduce card

fraud opportunities. The results might supply strategies to motivate card acceptors to

increase payment-card security; thereby, increasing consumer confidence in the card

acceptors’ ability to provide secure transactions. Increasing confidence in payment-card

security in retail businesses may enable the leaders of retail organizations to prepare for

and deter the malware and viral attacks on the POS systems; thereby, deterring payment-

card fraud and identity theft. The results of the study may influence the belief of

payment-card acceptors globally, both directly and indirectly.

A Review of the Professional and Academic Literature

Payment-card fraud and data breaches occur daily in diverse types of businesses.

Card transaction processors meet fraudulent transactions daily due to card acceptors not

having the appropriate strategies to detect fraud. Suman (2014) presented an overview of

distinct types of business fraud to include (a) payment-card, (b) telecommunication, (c)

data breach, (d) bankruptcy fraud, (e) theft counterfeit, and (f) application fraud. Suman

defined payment-card fraud as online and offline unauthorized usage of another person’s

card.

A data breach is the act of entering without warrant or invitation to another

computer system or network. Theft counterfeit fraud is the same type of fraud where the

person uses another’s card without permission (Suman, 2014). Application fraud is the

act of applying for credit or employment in another person’s name and using that

person’s credentials (Suman, 2014). The three types of fraud defined by Suman (2014)

examined in this study are (a) payment-card fraud, (b) identity theft, and (c) data breaches

resulting in payment-card information theft.

The comprehensive literature review includes an exploration of relevant topics to

supply a scholarly background that supports the need to address the problem of payment-

card fraud elimination. The literature review includes the topics of (a) fraud theory, (b)

fraud triangle theory, (c) identity theft, (d) payment-card fraud detection, and (e)

payment-card fraud elimination models. Search keywords used included (a) credit card

fraud, (b) identity theft, (c) credit card fraud elimination, (d) credit card fraud detection,

(e) fraud theory, and (f) fraud triangle theories. Other keyword searches included

computer crimes, swindling, Internet fraud, and economic crime.

The sources were articles in peer-reviewed journals from Walden University

Library and Google Scholar using EBSCOhost, ProQuest, Science Direct, and Thoreau.

The resulting review provided useful data to respond to the research question with

primary sources published from 2014 to 2018 to ensure this study had a supported

research method and design. Of the more than 150 sources; 90% are within the last 5

years.

The focus of this qualitative case study was to examine the strategies card

processing companies use to determine fraudulent card transactions. Fraud theory and

the fraud diamond were the foundation for determining card fraud. Omar, Nawawi, and

Puteh Salin (2016) discussed fraud theory as the theory that pertains to American card

fraud. The review includes global and American sources for card fraud detection. The

primary focus; however, was on American card-fraud and data breaches.

Fraud Theory and the Fraud Diamond

Cressey developed fraud theory in 1950 and revised the theory in 1954. Fraud

theory offers researchers and business leaders three potential reasons for a person to

commit fraud (a) opportunity, (b) rationalization and, (c) financial gain (Cressey, 1950).

Tan et al. (2016) defined fraud as involving the use of fabricated identity for financial

gain. Fraud theory is the foundation for the fraud triangle theory. Fraud theory, which is

relevant to payment-card fraud, enables corporate auditors to determine fraudulent

financial transactions in corporate America (Omar et al., 2016).

Fleming et al. (2016) proposed three reasons people commit fraud (a) financial

problems, (b) opportunity, or (c) rationalization (i.e., company owes them something in

the individual’s mind). Omar et al. (2016) noted that financial distress, as perceived by

the individual, is one of the leading causes of fraud. The perpetrator may be unwilling to

discuss financial problems and may have a powerful sense of ego, preventing that person

from discussing why he or she felt compelled to commit the fraudulent act (Fleming et

al., 2016). Personal financial problems lead people to commit fraud without considering

the consequences.

Fleming et al. (2016) discussed how fraudsters justify committing fraud through

(a) a moral justification, (b) feeling the organization owes them something, and (c)

rationalization. Fleming et al. reported that fraudsters justify committing fraudulent acts

as part of their moral comfort zone. Fraudsters rationalize the theft by claiming the

business owes them for poor working conditions (Omar et al., 2016). The fraudster

rationalizes his actions because he feels the company owes him either for his demanding

work or through managerial changes.

Omar et al. (2016) stated that the person committing the fraudulent act has a slim

chance of capture. The person committing fraud may use the payment-card for several

small purchases or one large luxury purchase (Fleming et al., 2016). The completion of

fraudulent purchases occurs before the victim tries to use their account to make a

purchase. Payment-card fraudsters realize the act of committing fraud needs both ability

and the belief that he or she may not be caught (Craig & Piquero, 2016; Omar et al.,

2016).

In summary, the purpose of this study was to explore strategies that business

owners and card processors use to reduce or end payment-card fraud. Fraud theory

provides a foundation for understanding why and how thieves commit fraud. Finding

opportunities for a person to commit fraud is the first step in reducing or eliminating

payment-card fraud. Cressey (1950, 1954) expanded on fraud theory by creating the

fraud triangle theory, which is covered in the next section.

Fraud Triangle Theory

Cressey (1950, 1954) and Fleming et al. (2016) explained the fraud triangle as (a)

opportunity, (b) rationalization, and (c) financial pressure. Business owners, managers,

and card acceptors focus on the opportunities for a person to commit card fraud. Omar et

al. (2016) analyzed the fraud triangle as a model for assessing the risk of fraud

opportunities, but the triangle is only one aspect of the risk assessment plan. Identifying

fraud risk is a significant part of assurance services. Fleming et al. stated the triangle of

fraud action includes (a) the act, (b) concealment, and (c) conversion. The act of

committing fraud is the execution and method of fraud. The concealment constitutes

hiding the action, and conversion represents the process of turning the ill-gotten gains

into something tangible by the criminal.

Cressey (1950, 1954) created the fraud triangle theory after interviewing 250

prisoners in 1950. Cressey (1950) defined the fraud triangle by the reason’s fraudsters

commit fraudulent acts. Abdullahi and Mansor (2015) discussed Cressey’s fraud

diamond. The fraud diamond, according to Abdullahi and Mansor included pressure,

opportunity, and rationalization. The perceived pressures, incentives, and motives refer

to factors that lead to unethical behaviors. Abdullahi and Mansor stated every fraud

perpetrator faces some form of pressure to commit fraud. The opportunity presents itself

through the lack of controls (internal and external in an organization), and unethical

employees may seize the opportunity to commit the felonious act (Abdullahi & Mansor,

2015). The rationale for a person to commit fraud refers to the justification and excuses

to commit the unethical behavior (Abdullahi & Mansor, 2015). Figure 1 portrays

Cressey’s Fraud Triangle with Kassem and Higson’s updated version of 2012.

Abdullahi and Mansor (2015) discussed the pressure a potential fraudster feels to

commit the act. The pressures (i.e., motives) to commit fraud become the heat source for

the act (Abdullahi & Mansor, 2015). Pressures may include ways to pay for a more

opulent lifestyle, employment pressures, or the organization’s fiscal interests (Abdullahi

& Mansor, 2015). More pressures may be external (a) business financial stability, (b)

high management turnover rate, or (c) lack of segregation of duties (Abdullahi & Mansor,

2015).

Figure 1. Kassem and Higson’s (2012) new fraud triangle model.

Note: Kassem and Higson’s new fraud triangle model is an expansion to

Cressey’s Fraud Triangle notating (a) motivation, (b) capability, (c) opportunity, and (d)

personal integrity. Adapted from: “The new fraud triangle model” by R. Kassem and R.

[MICE

M ]

[F Scale]

F 's

D ]

W. Higson, 2012, Journal of Emerging Trends in Economics and Management Science,

3(3), p. 194. Reprinted with permission from Kassem.

Although Abdullahi and Mansor (2015) portrayed the new fraud triangle in their

study, Lokanan (2015) challenged the fraud triangle and the usefulness of the triangle.

Lokanan stated the fraud triangle should not be a single reliable model for anti-fraud

professionals. Lokanan argued that the fraud triangle is a theoretical anchor, and the

fraud triangle endorses a body of knowledge that lacks objective criteria. The body of

knowledge basis comes from the individual’s moral makeup and ethical background.

Lokanan referred to Fleming et al.’s 2016 study as a foundational framework of the new

fraud triangle.

Boyle, DeZoort, and Hermanson (2015) evaluated the use of alternative fraud

model practices affecting professional audit standards. Boyle et al.’s analysis focused on

the auditor's approach to fraud, including how the auditor used the fraud triangle and the

effectiveness of the clients’ anti-fraud measures. Boyle et al. listed anti-fraud measures

(a) deterrence, (b) prevention, (c) detection, and (d) procedures. Fraud deterrence

measures involve the controls and probability of fraudulent activity. Fraud prevention

measures include audits, data security, and monitoring activity (Boyle et al., 2015).

Fraud detection organizations follow PCI-DSS rules and regulations (Boyle et al., 2015;

Willey & White, 2013). Fraud deterrence procedures involve eliminating that may cause

fraud in comparison to prevention identifying and stopping existing fraud activity (Boyle

et al., 2015).

The measures described by Boyle et al. (2015) follow Cressey’s 1950 fraud

triangle model and make a distinction. The distinction discussed by Boyle et al. indicated

a company may have healthy internal fraud controls and yet the criminal may not have a

strong perception of the controls. Cressey’s fraud triangle, or fraud diamond, consider

business, personal, and peer pressure reasons for one to commit fraudulent acts.

Azrina and Ling Lai (2014) defined the fraud diamond as opportunity, motivation,

capability, and rationalization. Dilla, Harrison, Mennecke, and Janvrin (2013) described

how the fraud diamond aspect of the fraud triangle applies to the virtual world. The

virtual four-sided diamond includes (a) opportunity, (b) motivation, (c) business record-

keeping and (d) virtual laboratories for risk assessment. The four sides of the diamond

represent the criminals’ capacities in the virtual world (Dilla et al., 2013). Mui and

Mailley (2015) discussed the comparison of the fraud triangle and the fraud diamond.

The fraud diamond shares the same characteristics with one difference – why the person

commits fraud.

The fraud diamond described by Mui and Mailley (2015) includes (a) opportunity,

(b) motivation, (c) rationalization, and (d) reason for the person to commit. The societal

factors include philosophical and religious tradition, culture, social norms, and the rule of

law, socio-economic conditions, and political status - relate to the environment where the

perpetrator resides and have an effect on the disposition of the perpetrator (Mui &

Mailley, 2015). The difference between the fraud diamond and the fraud triangle

described by Mui and Mailley is societal factors. Auditors and fraud prevention

personnel use both the triangle and the diamond to understand why a person commits

fraud.

Figure 2. Dilla et al. depiction of fraud diamond (2013).

Note: Adapted from “The assets are virtual, but the behavior is real: An analysis of fraud

in virtual worlds and its implications for the real world”. By Dilla et al. 2013, Journal of

Information Systems, 27, 131-158. Reprint with permission from the authors.

In summary, payment-card fraud occurs through opportunity according to the

information provided in fraud and fraud triangle theories (Schuchter & Levi, 2015). The

person committing the fraudulent transaction feels perceived pressure due to the

opportunity and motivation (Schuchter & Levi, 2015). Schuchter and Levi (2015)

explained opportunity allows the thief to decide to commit fraud because of the absence

of transparency as well as the lack of discipline. The lack of transparency from the

thief’s perspective comes from the absence of compliance or managerial accounting

(Schuchter & Levi, 2015). Lack of discipline and irresponsible corporate governance

within the organization leads to a lack of audit controls, thus encouraging the crime

(Schuchter & Levi, 2015). Fraud and fraud triangle theories supply insight into the

fraudster's reasoning for committing fraud and identity theft. These insights supply a

foundation for understanding how to prevent fraud and identity theft.

Cressey’s 1973 fraud triangle theory examined the motivation for someone to

commit fraud; the triangle includes (a) pressure, (b) opportunity, and (c) rationalization

(Dorminey, Scott Fleming, Kranacher, & Riley, 2012). However, Dorminey et al. (2012)

believed that the Fraud Triangle was only one crucial part of finding the risk of

opportunities. Dorminey et al. stated that fraudsters’ motivation might be expanded and

identified with acronym MICE: money, ideology, coercion, and entitlement, or ego. In

addition, McMahon, Pence, Bressler, and Bressler (2016), Wolf et al. (2015), and

Beasley, Carcello, Hermanson, and Lapides (2000) identified a fourth critical element

which they thought should be added to Cressey’s Fraud Triangle. McMahon et al., Wolf

et al., and Beasley et al. believed that capability was equally as important as the first three

factors. Adding capability to the fraud triangle could aid in fraud prevention and

detection.

Identity Theft

In this section of the review, consideration was made to studies on identity theft

and payment-card fraud to define how identity theft affects payment-card fraud. Card

processing organizations use the information located on a person’s card to determine

issuer and obtain approvals for purchases. Marcum, Higgins, Ricketts, and Wolfe (2015)

determined how students in a rural North Carolina high school stole people’s identity

through (a) assuming someone else’s appearance and (b) obtaining the victim’s personal

information. Impersonation of a person is not as simple as stealing a person’s social

security number or other personal information. Consumers should watch card usage via

the issuer's website (if available) and track credit reports to ensure report accuracy.

Modi, Wiles, and Mishra (2015) and Bai and Chen (2013) reported the magnetic

stripe payment cards allow criminals to commit banking fraud and identity theft.

Magnetic stripe payment cards are easy to clone (Modi et al., 2015). Modi et al.

explained the data recorded on the magnetic stripe are (a) cardholder name; (b) address;

on payment cards have two to three tracks. Most payment cards use tracks one and two.

Track one’s format contains cardholder information and name and personal information

(Appendix A). The data on track one for financial products have proprietary issuer data.

Track 2 does not include the cardholders’ names. However, track two does have similar

information written in ANSI code to track one (Appendix B).

The cloning of a person’s payment-card affords the criminal opportunities to

commit banking fraud (Modi et al., 2015). Modi et al. (2015) described third-party and

offshore payment-card processors' lack of enough security and inability for authorities to

apprehend card thieves. Third-party transactions have the potential for failure because of

the lack of data-security (Modi et al., 2015). The lack of safety increases failure costs at

the third-party processor. Failure costs lead to increased shareholder losses (Modi et al.,

2015) for the organization where a data breach has occurred.

Modi et al. (2015) performed the study using a sample of 146 customer

information security breaches. Modi et al. concluded that the increase in cost to

shareholders leads to decreased returns. The quantitative study by Modi et al. included

samples of sensitive personal data and propensity scores for evaluating changing

concerns. Propensity scores are quantitative risk measurements used to determine

potential fraud (Turner, 2014). Changing concerns describe the mistakes within the fraud

activity formula (Modi et al., 2015). Modi et al. described the propensity score and the

changed curve as flags created within the card processing system flagging potential fraud

transactions.

Bai and Chen (2013) posited that immoral persons contact bank customers using

e-mail to obtain personal information. The e-mail appears as an official notice from the

bank, within the body of the e-mail, the fraudster requests certain information such as the

customer’s card number and cell phone number. Once the cardholder supplies the

information, the fraudster closes out the client's cell phone, obtains a new card, and

immediately overdraws the card (Bai & Chen, 2013). Additionally, the fraudster may use

TeamViewer to remote into a person’s computer and obtain information using key

loggers. Keylogger software captures a PC user’s keystrokes and provides the logger

with the unsuspecting person’s personal information such as passwords and logins.

Kahn and Linares-Zegarra (2016) researched how consumer behavior pertains to

identity theft and fraud. Components of the Kahn and Linares-Zegarra study included

physical prevention, account monitoring, agency control, password security, and risky

consumer behaviors. Kahn and Linares-Zegarra found that users do not think about the

actions or reactions of identity theft because of the lack of consumer education in the

defense against identity theft and fraud. Kahn and Linares-Zegarra referred to the

defense against identity theft through consumer education. Consumer education includes

payment-card protection, account monitoring, password security, and avoiding risky card

behavior (i.e., leaving cards and personal information unattended) (Clough, 2015; Kahn

& Linares-Zegarra, 2016). Societal education about payment-card and identity theft lead

the researcher into physical prevention.

Clough (2015) found that consumer naiveté is the leading cause of identity theft.

Clough defined three segments of identity theft: financial, criminal, and identity cloning.

Financial theft occurs when a thief portrays the victim to obtain credit from a financial

institution. Criminal theft happens when the criminal identifies him or herself as another

person to commit a crime, obtain special permits, or commit acts of terrorism. Identity

cloning occurs when the thief uses another person’s identity to assume his or her identity

in daily life to obtain new phone or wireless accounts, utility services, or other credit-

related services. Clough stated that identity theft occurs both offline and online. Victims

of identity and card fraud come from all backgrounds, races, and sexual orientations.

Police officers and courts alike need to understand the definition of fraud and identity

theft.

The courts address identity theft as an injury-in-fact as described in Article III,

standing principals of the United States Constitution (Martecchini, 2016). Article III of

the United States Constitution requires plaintiffs to “show concrete and particularized

injury that is fairly traceable to the challenged conduct and likely to be redressed by a

favorable judicial decision” (Martecchini, 2016, p. 1475). The victim of identity theft

must show the justice system's proof of injury. The 7th Circuit Court of Appeals found

customers whose breached payment-card data were at risk of identity theft and increased

risk for fraudulent charges. Reynes and Randa (2017) described the victims of identity

theft and payment card fraud as female, elderly, economic background, and race. The

victim must decide to report the crime to the police.

Legal action on the municipal level is not enough to fight identity theft. Konradt,

Schilling, and Werners (2016) stated that phishing is growing exponentially and has

become a societal issue. Konradt et al. explained that online identity theft is hard to

prove due to a lack of physical evidence. Physical evidence may include transcripts of

computer chats, online purchase transaction records, or applying for credit in another

person’s name (Konradt et al., 2016). With the development of WIFI, people have come

to expect absolute security at locations with publicly available WIFI connections.

Virtual identity locks prevent a person(s) from stealing online identities (Konradt

et al., 2016). Konradt et al. (2016) defined virtual identities as assuming someone’s (a)

name, (b) image, (c) e-mail, or (d) or other personal data to use by the person committing

fraud. Additionally, Konradt et al. stated the person or persons who use another person’s

information deceives employers, credit grantors, and non-business-related persons.

Knight and Saxby (2014) discussed how identity deception is a broader cause than

identity theft as one of the many classes of identity crime. Identity deception allows

someone to assume another person or business’ identity (Knight & Saxby, 2014).

Police and judges define identity theft as the theft or assumption of a pre-existing

identity with or without consent and in the case of an individual living or deceased. The

United States government defines identity theft through the Identity Theft and

Assumption Deterrence Act (Federal Trade Commission, 1998). The Act’s introduction

mitigates the economic cost to victims, both entity and individual. The consequences of

identity theft include fines and or jail as a deterrent to future perpetrators (Knight &

Saxby, 2014). The drafters of the Identity Theft and Assumption Deterrence Act identify

identity theft as a federal crime with 15 years’ imprisonment and $250,000 in fines.

Figure 3. Conceptual model of identity definitions (Jamieson et al., 2012).

Note: Adapted from: “Addressing identity crime in crime management

information systems: Definitions, classification, and empirics”. Computer Law and

Security Review, 28, 381-395. Reprinted with permission by authors.

Knight and Saxby (2014) stated that government officials need a dependable

identity-crime management program. Knight and Saxby posited the evolution of identity

crimes provides ideas for new research into technological advances and new government

regulations. Each state government has (a) a different definition, and (b) different

judicial conviction outcomes (Knight & Saxby, 2014). Knight and Saxby posited state

legislators should work together to have standard identity theft definition and common

judicial outcomes. The variances in identity theft convictions are state law dependent.

In summary, identity theft and payment-card fraud provide opportunities for

fraudsters to defraud victims and organizations. When a thief captures a victim’s

payment-card information, the thief is capturing the information in the magnetic stripe’s

track 01. The captured data provide personal information such as the victim’s name,

address, social security number, and phone number(s). The fraudster, in turn, uses the

obtained information to open new accounts in the victim’s name but does not use the

person’s phone number. The victim discovers they have been a victim of identity theft

when they go to open a new line of credit or make a large purchase and learn of unpaid

accounts.

PCI-DSS

In this section, a review of the security requirements established by PCI-DSS for

card processors and acceptors is provided. PCI-DSS Data-Security standards set the

minimum-security standards for payment-card acceptors and processors (Fernandes,

2015; Willey & White, 2013). The standards are recommended worldwide to reduce

fiscal business loss from card fraud. Card providers and acceptors worldwide have

accepted PCI-DSS compliance (Fernandes, 2015) as a guideline to reducing data

breaches and card fraud. The requirements provide the foundation for protecting

customer information from misuse. PCI-DSS, as of 2015, has 12 security requirements

for protecting cardholder information (Fernandes, 2015; Willey & White, 2013). All

businesses that accept or issue cards and process or transmit card data has to adhere to the

PCI-DSS requirements (Fernandes, 2015).

P. Harvey (2013) and Fernandes (2015) described the requirements created by

PCI-DSS as network personnel, quickly identifying who, what, when, and whether

specific files were accessed. Fernandes stated in the write-up of his study that PCI-DSS

compliance is necessary for all businesses that accept payment cards. PCI-DSS

compliance offers the cardholder a sense of security for businesses maintaining card data

(Fernandes, 2015; Harvey, 2013).

PCI-DSS Regulations provide a written outline for organizations to increase

network security, enhance business reputation and brand value, and decrease the chance

of data breach (Fernandes, 2015). Compliance with PCI-DSS requirements means

monitoring log files and critical files in real-time with automation (Fernandes, 2015).

Automation offers the business enhanced payment-card security. However, Rees (2014)

provided business leaders with another methodology for data breach cleanup and

recovery. Rees discussed the controversial PCI-DSS requirements for taking card

payments.

P. Harvey (2013) and Fernandes (2015) explained the 2014-15 PCI-DSS

requirements for payment-card acceptors to secure cardholders’ data. The

recommendations are the most challenging too secure and protect customers’ card

information. The requirements track and monitor network resources and cardholder

information and deploy detection mechanisms to alert network security professionals to

intrusions (Fernandes, 2015). Rees (2014) reviewed the design of PCI-DSS to protect

cardholders’ information. No business wants to be the subject of a data breach where

multiple people’s information has been stolen.

Rees (2014) described that the cleanup costs and fines are devastating and long-

term costs in damage to the organization’s reputation. When properly maintained, the

PCI-DSS requirements reduce the chances of a damaging data breach. Rees discussed

that if the worst happens to an organization, the company would still have the security

policies and procedures to address the security event and mitigate the issue through

effective countermeasures.

Business leaders often state the PCI-DSS requirements are hard and expensive to

meet (Rees, 2014). The requirements can be complicated or straightforward as the

security analysts for the organization want to interpret them. The cost is expensive for

the purchase of infrastructure equipment (Rees, 2014). However, the equipment cost

may not be as expensive as the fines and loss of business revenue. Business leaders

argue that PCI-DSS requirements are not legal (Rees, 2014). The requirements indicated

by Rees (2014) protect businesses of any size from data breaches or card fraud.

Rees (2014) stated that the requirements do not have to be difficult, and the

implementation of security equipment expensive. The components are challenging; Rees

suggested using PCI-DSS approved vendors for network and equipment scanning. The

recommendation made by Rees is to choose QSA approved PCI-DSS consultants with

broad experience. Although Rees made recommendations for qualified consultants,

Murdoch and Anderson (2014) discussed the risk of Europay, Mastercard, and Visa’s

(EMV) chip and pin cards in Europe, which included the magnetic stripe and the chip on

a cheap card.

Fraudsters could still easily clone the cards and capture the user's PIN. As the

technology improved, the chip and pin cards introduced more serious fraud problems

through tampering with the pin (Murdoch & Anderson, 2014). Although the terminals

for the cards were certified tamper-proof, the machines were not.

Severe flaws in the machine (e.g., non-tamper proof) slowed the certification

process (Murdoch & Anderson, 2014). Additional areas for an attack on the chip and pin

card in the early days was the relay attack during transaction processing (Murdoch &

Anderson, 2014). The relay attack exploits the card authentication process of the

merchant’s terminal (Murdoch & Anderson, 2014). However, the card presenter did not

know which terminal was processing the purchase.

Academia and corporate America look at corporate greed and fraud in different

lights. Payment-card fraud determination follows PCI-DSS rules and regulations

(Maroun & Atkins, 2014). Rule interpretation by data-security professionals and

business leaders follow multiple paths. The implementation of the rules may be as

straightforward or as complicated as management determines the need (Maroun &

Atkins, 2014). The PCI-DSS rules are a guide to data-security for card acceptors

(Maroun & Atkins, 2014).

Ganesan (2016) explained the PCI-DSS requirement for password protection for

enterprise-wide protection. Network users tend to record their passwords in unsecured

spreadsheets. Ganesan posited password management solutions could provide a middle

ground between sensitive systems access and potential data breaches. The password

system provides a level of security and provides a technological scan of all Active

Directory linked systems for security (Ganesan, 2016).

The weak point for password-protected systems is the hardcoded default

passwords for the enterprise. Hackers gain access to the default password script; they

may be able to decode and wreak havoc on the network (Ganesan, 2016). Ganesan

(2016) found that web browsers and websites requiring passwords do not have

accountability or trace features on information sharing, among others (human

vulnerability).

In summary, PCI-DSS guidelines provide business leaders with minimum-

security suggestions for the prevention of data breach and or payment-card fraud

detection. The PCI-DSS recommendations for card acceptors included information for

data retention, password strengths, network security protocols, and on-line card

acceptance rules and regulations for data encryption. Rees (2014) stated that the

implementation of data-security does not have to be expensive or complicated. The PCI-

DSS guidelines best implementation uses QSAs with broad knowledge in the PCI-DSS

implementations. The challenge for any QSA or business comes from securing

customer’s data and card information.

Data Breach

Since the advent of e-commerce web sites, data breaches, and identity theft have

increased (Hoffman, 2013). Small (2014) discussed the risk factors and the vulnerability

to data breaches. The server is the most vulnerable location for a data breach to occur

(Small, 2014). Although the server is vulnerable, the end-user and or the cardholder have

responsibility for ensuring data safety.

Data-security includes end-users changing passwords and cardholders, ensuring

their cards are safe and secure when not in use (Gold, 2014). Breach containment

involves identifying the problem and performing the necessary steps to stop the

discovered breach (Gold, 2014; Small, 2014). To evaluate risk, security specialists

should determine if a data breach has compromised the system or data, and then they

must estimate costs for breach cleanup.

Leaders must notify customers of the breach and any payment-card users of the

potential for fraud activity on the customers’ cards (Small, 2014). In addition to the

reactive steps, leaders must take proactive steps to prepare for potential future data

breaches through updated spyware, phishing programs, and anti-virus software (Gold,

2014; Small, 2014). Hardware personnel must inspect card readers for potential

problems.

The POS breaches at major retailers such as Home Depot and Target involved

data breaches caused by BlackPOS malware, enabling fraudsters to collect more than 70

million payment-card numbers (Caldwell, 2014). BlackPOS malware spread

incrementally through the POS systems collecting customer data. Caldwell (2014)

indicated that TrendMicro’s POS anti-malware software was not working fast enough to

detect the Trojan. Caldwell stated the anti-malware and anti-virus software on the Target

POS system detection failed and caused the data breach at Target.

Caldwell (2014) suggested if the malware and anti-virus servers worked at

maximum speed, the potential for trapping and cleaning the malware would increase and

decrease the effect of the infection. Caldwell suggested that POS system administrators

should remotely shut down the terminal and reimage the machine after intrusion detection

to eliminate additional infections. Caldwell’s research focused on Europay, MasterCard,

and Visa (EMV) chip and pin technology.

Card issuers expect to see a reduction in data breaches because of increased

security. Caldwell (2014) posited mag-stripe technology is attractive to fraudsters

because of the ease of cloning payment cards. Chip and pin are harder to clone and is

less attractive to fraudsters (Caldwell, 2014). EMV technology has become a global

standard for payment-card issuers (Caldwell, 2014). EMV, or chip and pin technology,

uses a microchip technology at the acceptor’s checkout location.

Caldwell (2014) stated throughout the transaction process, EMV transactions use

encryption. The EMV card machine may use the mag-stripe if the merchant uses the

tampered with chip Ireader (Caldwell, 2014). Mag-stripe cards are susceptible to

cloning, which enables criminals to obtain customer data. Card acceptors’ equipment

needs upgrading to read the new chip and pin cards, which the card companies’ issue

(Caldwell, 2014). After 2 years of equipment and software upgrades, some small

retailers are not accepting chip cards because of the cost of new card-reading equipment.

In summary, data breaches attack the server, which is the most vulnerable location

in the network for card transactions (Gold, 2014; Small, 2014). The server vulnerability

to malware and virus attacks leave card acceptors and data-security personnel to create

new security policies for network access and card fraud detection (Small, 2014). The

advent of the chip and signature card has reduced brick and mortar card fraud; online

card fraud continues to increase because of card-not-present (Caldwell, 2014).

Dark Web

The dark web or deep web contains content that has not been indexed by popular

search engines like Google or Yahoo (Finklea, 2017). Finklea (2017) posited that the

dark web is used for both legal and illegal activities. The legal activities, as described by

Finklea, include Intranet sites at businesses and government installations. Illegal

activities involve identity theft, payment card information theft, and disrupting supply

chains (Finklea, 2017; Wilson, 2019).

Supply chain disruption occurs when a person or persons launch ransomware or

malware attacks (Wilson, 2019). Ransomware (software) attack attacks a computer and

demands the person or organization to pay a ransom to release the files (Cabaj,

Gregorczyk, & Mazurczyk, 2018). The payment may be in bitcoin or a request for the

local country’s currency (Bancroft & Reid, 2016). The victim of the ransom does not

have to pay the ransom to have the files released. The victim may reset their computer

system to a time before the attack.

The dark web relies on anonymity (Bancroft & Reid, 2016). The anonymity of

the users and the servers conceal the illicit activity. The original idea for the dark web

created by the United States Navy was for open lines of communications (Bancroft &

Reid, 2016). However, as the web developed with more layers, criminals and others

discovered the dark web became a communication avenue without fear of persecution.

Although the dark web has multiple uses for illegal activities, fraudsters can buy and sell

information. The victim's personal information is broken down into name, address, social

security number, card numbers, and income brackets (Finklea, 2017). The fraudster can

sell each data cell (Finklea, 2017). The sale of personal information provides the

opportunity for identity theft and payment card fraud.

Payment-Card Fraud Detection

Fraud is an unauthorized activity-taking place in electronic payment systems

(Vaishali, 2014). Card processors and issuers work together using various detection

techniques (Gold, 2014). The techniques involve software and physical card traits (Gold,

2014). Additionally, Gold (2014) described the shift in card usage from credit to debit

cards as one of the results of card fraud. Europe was one of the first areas to issue

prepaid debit cards using chip and pin technology (Gold, 2014). Gold explained chip and

pin technology employed in Europe reduced card fraud. However, thieves can still

emulate the card and obtain a falsified chip (Gold, 2014).

The attacks on smart cards with chip and pin technology forced Visa and

MasterCard to enable chip and pin payment architecture in support of encrypted storage

of the four-character PIN on the card (Gold, 2014). Gold (2014) revealed how a retailer’s

PIN reader might be hacked to view the POS system. Retailer’s point of sale (POS)

systems are vulnerable to attack by malware. Malware has the capability of disabling the

POS system’s chip and pin reader and forcing the mag-stripe reader into use (Caldwell,

2014; Gold, 2014). Malware or RAM scraper software exploits the data from the

retailer’s POS terminal and transmits it back to the hacker’s computer (Caldwell, 2014).

Manworren, Letwat, and Daily (2016) described how malware attaches to customer data

and transmits back to hackers. The malware process captures the customer’s card

information and stores the information on the commandeered server (Manworren et al.,

2016). Manworren et al. examined how secure Target’s security analysts considered the

network.

Plachkinova and Maurer (2018) posited that the Target network is technologically

a leader in the industry with security. The Target system had one flaw: third-party

contractors’ logins did not have the appropriate rights to block the person(s) out of the

payment-card system (Manworren et al., 2016). Malware introduction came through the

contractor’s access to hack the Target system (Manworren et al., 2016). The malware

attack allowed hackers to obtain millions of customers’ information before analysts

realized the infection (Plachkinova & Maurer, 2018). The lack of responding to malware

notifications cost Target Corporation, both its reputation and customers (Manworren et

al., 2016).

Card acceptors and system administrators tend not to keep up with security

patches and anti-virus software updates (Small, 2014). The lack of applied security

patches to the operating system or other installed software either enables unauthorized

access to the network through malware or means (Manworren et al., 2016). Small (2014)

also discussed the need for changing people’s perception of information security, creating

data stewardship, educating, teaching, and mentoring. Small also discussed the need for

rewarding those individuals who are data-security conscious and sanction those people

who break the data-security rules.

Payment-card fraud detection systems and methodologies vary widely between

banks, card processors, and retailers. Data-security analysts need to be prepared for data

breaches and should have a plan in place for security breaches. Malware and phishing

programs open the door for potential data breaches. The data collected in a breach

provide information about customers' and customers' card numbers. Fraudsters and or

hackers obtaining the information may open new accounts in an unsuspecting person’s

name and ruin that person’s credit. The success or failure of the IT department depends

upon security policies and procedures. Collectively, safety is every employee’s

responsibility. IT security should be about flexibility, not rigidity (Khanna, 2013).

Dal Pozzolo, Caelen, Le Borgne, Waterschoot, and Bontempi (2014) discussed

the current systems technology for detecting fraudulent financial transactions using fraud

management in financial data streams. The application’s use allows for policy constructs

created by human programmers (Dal Pozzolo et al., 2014). Fraud-detection software

evaluation allows for a comparison of the old system with potential new software (Dal

Pozzolo et al., 2014). Dal Pozzolo et al. introduced a hybrid-fraud detection model for e-

commerce and payment-card fraud. The hybrid detection model demonstrates an

increased detection of allowed connections and charges and decreased fraud instances

(Dal Pozzolo et al., 2014).

West and Bhattacharya (2016) discussed various fraud detection systems. West

and Bhattacharya focused on computational intelligence (CI) and data mining methods

for detecting financial fraud. CI includes logistic regression analysis, neural networks,

and support vector machines (West & Bhattacharya, 2016). West and Bhattacharya used

three standards for determining the performance of each method: accuracy, sensitivity,

and specificity. Accuracy measures the ratio of successfully detected fraud transactions

compared to unsuccessful detection.

Sensitivity compares the number of items correctly identified as a fraud in

comparison to false positives. Specificity refers to the same concepts for legitimate

transactions (West & Bhattacharya, 2016). Fraud detection is generally viewed as a data

mining classification problem, where the objective is to determine if the transaction is

fraudulent or legitimate. Fraud detection involves monitoring user behavior using the

software to detect fraudulent activity effectively.

Consequences of Payment Card Fraud and Data Breaches

Fraud detection software helps data security analysts and card security analysts to

determine if transactions are fraudulent. Consequences of fraudulent transactions may

lead to consumer embarrassment for purchases. Businesses such as Home Depot, Yahoo,

and Target face similar embarrassment but on a larger scale. Businesses face lawsuits,

financial losses, and congressional actions (West & Bhattacharya, 2016; Whitler &

Farris, 2017). Consequences for commercial organizations vary by state. Home Depot,

for example, governed by the states of Georgia, Indiana, and California, faced United

States congressional actions (Bergman, 2015; Manion, 2015). Sanctions by federal, state,

and local laws determine stock prices, consumer trust, and vendor trust. The fallout from

data breaches and fraud for consumers and businesses are economic hardships and less

access to credit.

Although creditworthiness is one outcome, loss of trust and reputation play a

significant role in public opinion. Trust is a fundamental or crucial element (Simon &

Cagle, 2017) for corporations, governments, and individuals. Simon and Cagle (2017)

defined reputation as the amount of regard that stakeholders and consumers place in a

company. Reputation plays a primary role in customer satisfaction for the business

(Bergman, 2015; Simon & Cagle, 2017). An organization that loses both trust and

reputation may not survive the publicized negative information.

The negative effect of consumer notifications of a data breach has led the way for

the United States Congress to develop new requirements for cybersecurity (Bergman,

2015). Congressional leaders are focusing on requirements for full disclosures and

responsible disclosures for data breaches and the effect on the consumer market

(Bergman, 2015). These are just a few of the consequences’ consumers and businesses

alike face when data breaches and card fraud occur.

Payment-Card Fraud Elimination Models (Software)

Payment-card fraud elimination models used through 2019 provide a background

understanding of the models used by a business. Researchers have offered a variety of

potential solutions to payment-card fraud. Additionally, banks and card processors

developed methodologies to detect card fraud (West & Bhattacharya, 2016). The

methodologies discussed included (a) support vector machines, (b) decision tree

algorithms, and (c) hidden Markov models to suggest a few (West & Bhattacharya,

2016). Organizational leaders may use a mix of human and software and or hardware to

detect fraudulent usage. The mix of human and software detection processes fail due to

human error (West & Bhattacharya, 2016).

Clustering. X-Means clustering models detect an unsupervised learning

algorithm, which solves a well-known clustering model (Chang & Chang, 2014). The

statistical study performed by J.-S. Chang and Chang (2014) focused on fraudulent

behavior to determine status transitions. J.-S. Chang and Chang identified four

fraudulent behavioral means to determine different fraud schemes. The fraud schemes

identified by J.-S. Chang and Chang described (a) direct attacks, (b) quick profit, (c)

luxury purchases, and (d) price varied purchases. J.-S. Chang and Chang used multiple

statistical methods to determine fraudulent transactions.

Direct attack or aggressive fraudsters apply straight tricks to obtain higher ratings

within the hacker community (Chang & Chang, 2014). J.-S. Chang and Chang (2014)

posited quick profit fraudsters are the classical person looking to make a quick monetary

gain. Luxury purchase fraudsters only pay attention to the high dollar items such as

artwork or high-end vehicles (Chang & Chang, 2014). The price varied fraud described

by J.-S. Chang and Chang involve low price quick move items that most consumers do

not notice.

The quantitative methods discussed by J.-S. Chang and Chang (2014) included X-

means algorithms (a variance of K-means). The X-means cluster development

automatically calculates the number of clusters to fit the data set. The X-means formula

as applied by J.-S. Chang and Chang traced fraudulent behavior to determine the

appropriate fraud profile of the fraudsters. Card fraudsters do not always rely on their

initial behavior (Chang & Chang, 2014) because a fraudster changes their behavior to

avoid detection.

Vaishali (2014) offered K-means clustering as one potential way to eliminate

payment-card fraud. Vaishali described hierarchical agglomerative methods [two groups

of clusters determining bottom-up data], partitioning methods [data grouping related to

data mining], single link method [merging two small like data groups]. Additionally, the

methods Vaishali described include the complete link method [merging sets of data], and

group average method [compromise of single and complete link methods]. K-means is

an unsupervised technique for data mining.

The unsupervised technique is useful when there is no prior knowledge about the

observation (Vaishali, 2014). K-means is a straightforward and efficient method for

clustering data. K-Means clustering is popular because of (a) ease of implementation; (b)

versatile implementation, functionality, and termination criteria; (c) time complexity and

storage; and (d) random data shuffling (Vaishali, 2014).

Vaishali (2014) stated that fraud could not have 100% detection using the K-

means method. The plan identifies safe transactions as fraud and fraud transactions as

safe transactions. The additional problematic area addressed is the lack of available data

due to confidentiality issues that give little chance to share real data sets and assess

existing techniques. Vaishali discussed several learning methods for payment-card fraud

detection systems, methods including statistical models, static approaches, and K-means.

The results are not always accurate as payment cardholders spending patterns dictate the

use of the algorithms

(Vaishali, 2014).

Clustering is not always an accurate algorithm to detect payment-card fraud. X-

means (K-means variant) works with the dataset to determine card fraud. K-means is an

unsupervised method of determining card fraud. The card-fraud predictions used by

clustering methodologies may provide false positives for fraud transactions based on the

customer’s usage patterns.

Neural networks. Neural networks are popular with business leaders for

payment-card fraud detection (Halvaiee & Akbari, 2014). Neural networks consist of a

set of artificial neurons. The neural network mimics the human brain through customer

spending pattern recognition (Halvaiee & Akbari, 2014). The neural network has the

capability of predicting future values or events based on customer card usage.

Halvaiee and Akbari (2014) posited current fraud detection methods that are using

signatures as time-consuming. Mobile fraud, according to Halvaiee and Akbari, uses

artificial neural networks. Artificial neural networks predict card users’ behavior and

compare the usage to current usage behavior patterns. Halvaiee and Akbari posited

payment-card fraud detection requires a high rate of transaction detection while keeping

false alarm rates low.

Van Vlasselaer et al. (2015) discussed a different approach to the use of neural

networks to detect card fraud. The approach Van Vlasselaer et al. discussed involved the

use of time-stamped, labeled transactions, and machine-learned transaction history for

fraud detection. The time-stamped transactions use a sliding window of time to

determine non-fraudulent charges. Van Vlasselaer et al. time windows include short

term, medium, and or long-term, and customer transaction history. The proposed method

uses real-time card transactions.

The approach Van Vlasselaer et al. (2015) incorporated combines both real-time

and network-based attributes. The approach uses the regency-frequency-monetary value

(RFM) network (Van Vlasselaer et al., 2015) using the cardholder’s past transaction

history. A regency-frequency-monetary value network approach to fraud detection uses a

time range for the transaction, usage frequency, and dollar amounts spent on the card.

Regency-frequency-monetary value, according to Van Vlasselaer et al., also used

geographical data and demographic information for determining transaction normalcy.

In summary, neural networks learn to capture and represent complex relationships

using cardholder's past transactions. Neural networks represent the human brain through

artificial intelligence and the ability to learn. The advantage of neural networks is the

ability to represent linear and nonlinear relationships from the data model.

Artificial intelligence. Halvaiee and Akbari (2014) reviewed the use of artificial

intelligence (AI) to determine payment-card fraud. AI’s design operates similarly to the

human brain. Halvaiee and Akbari stated that the AI system detects fraud by using

record processes and determines adverse transaction records using customer-spending

patterns.

Halvaiee and Akbari (2014) focused on the Artificial Immune Recognition

System (AIRS), a classification algorithm system. AIRS features include self-regulation,

performance, generalization, and parameter adjustment. Halvaiee and Akbari described

AIRS using generalization through data reduction to increase the detection of fraud

transactions.

Halvaiee and Akbari (2014) posited AIRS knows the cardholders’ spending

patterns and determines the difference between right and fraudulent transactions. AIRS

detects and learns new methods of misuse using the customer’s payment-card usage. The

system acts as the human body in detecting viral spending conditions and fighting off

those questionable spending habits (Halvaiee & Akbari, 2014) that are multiple charges

in a brief period at the same merchant.

West and Bhattacharya (2016) performed a data mining study of artificial

intelligence to detect payment-card fraud. The data mining process used visualization

methodology to present clear and understandable observation results (West &

Bhattacharya, 2016). West and Bhattacharya posited the rules for the system classifies

data into understandable formats for the human mind to grasp. The rule should capture

fraudulent transactions; however, no system is infallible (West & Bhattacharya, 2016).

West and Bhattacharya (2016) posited the problems with the rule-based system

are the test data sets based on actual data; the problem is incurred when the system has

already learned the customer's spending habits. The focus of the study covered detection

methods (a) data mining, (b) performance metrics, and (c) algorithms. Performance

metrics assisted Jarrod et al., with a quantitative study to balance the positive and

negative ratios (West & Bhattacharya, 2016).

Artificial intelligence uses the same process as neural networks. AI systems trap

the positive and negative attributes, using algorithms as previously demonstrated. The

problems encountered by West and Bhattacharya (2016) involved the test data set as a

live data set. West and Bhattacharya stated the metrics for fraud determination systems

need to use live data to determine if the transactions flagged are good or bad.

M.A.S.T. Rosaci and Sarne (2014) discussed how e-Commerce plays a role in

online shopping and card-not-present fraud transactions. The technology used for social

media commerce and e-Commerce sites, including local brick and mortar merchants with

websites, use similar fraud detection models. Rosaci and Sarne discussed the aspects of

e-commerce (EC) playing a pivotal role in card not present shopping on the web. The

transactions described by Rosaci and Sarne are Business to Customer (B2C). The

technology allows the customer to enter his or her card number into a website to purchase

goods or services. The customer may not know if the page is fraudulent, as the page may

look legitimate.

Rosaci and Sarne (2014) described the need for payment-card-not-present security

using multi-agent technology. The potential fraud detection system supports several

aspects of Business-to-Customer EC activities (Rosaci & Sarne, 2014). A multi-agent

system for traders (M.A.S.T.) detects fraud transactions through a personalized approach.

M.A.S.T. is a set of XML-based personal agents designed to assist the customer and

business in managing personal consumer profiles.

The e-payment model avoids transferring sensitive data through the reinforcement

of trust between merchants and customers (Rosaci & Sarne, 2014). The standards

allowed by PCI-DSS do not have a set time to expire the card information (Rosaci &

Sarne, 2014). However, to increase customer information security, M.A.S.T. offers the

card acceptor a reduced time for data to live for payment-card authorization (Rosaci &

Sarne, 2014).

M.A.S.T. uses XML protocols providing sensitive data to the acceptor and the

financial institution to approve or deny the transaction. M.A.S.T. agents build, update,

and exploit user information to offer customer orientations by weighting shopping habits.

M.A.S.T. needs additional tweaking to improve performance and reliability. M.A.S.T. is

coded software with the potential for malware attacks (Rosaci & Sarne, 2014).

Although payment-card fraud and identity theft occur in multiple ways, card

issuers, processors, and acceptors implemented quantitative or algorithmic solutions.

Additional solutions card approvers and acceptors have implemented computer hardware

such as Cisco firewalls, and vector decision machines (Rosaci & Sarne, 2014). Card

acceptors and processors in 2015 and prior years have used quantitative and algorithmic

software solutions with little result in a reduction of fraudulent transactions (Rosaci &

Sarne, 2014). Sahin et al. (2013) offered a quantitative software method for deciding if

transactions are fraudulent.

Sahin et al. (2013) discussed the bias in selecting new fraud detection systems by

comparing the old and new systems. The old systems have the customer data, and

spending habits established, and the new system would need to learn the customer’s

habits. The bias arises from the fact that the old system would terminate the transaction

account when fraud would occur, but the proposed new system would not learn the

customers' spending habits. Sahin et al. performed a statistical study to determine the

acceptability of the proposed new system(s).

Sahin et al. (2013) discussed how the determination process involved that the

biases of the multinomial estimators. The lower the ratio, the less likely the transaction

may be fraudulent (Sahin et al., 2013). The probabilities discussed by Sahin et al. include

costs to the business and the consumer. The costs to the firm may not be apparent to the

bank or the consumer when a fraudulent transaction is detected (Sahin et al., 2013).

Different definitions apply to the costs of doing business; such definitions include

recovery costs to both parties involved. Sahin et al. (2013) discussed fraud as a

documented problem in a wide range of fields. In summarization, a multi-agent system

for traders relies on artificial decision-making. Multi-agent systems offer reinforced

learning mechanisms. The mechanisms used to motivate people to address issues

involved in the techniques for machine learning.

Hidden Markov model. Mishra, Panda, and Mishra (2013), and Vojir, Matas,

and Noskova (2016) described the hidden Markov model as a finite set of states linked by

a probability distribution. Mishra et al. stated the distributions control the set of

probabilities called transition probabilities. State-dependent determines the outcome or

observation generated by a probability distribution. Mishra et al. described the outcome

as only visible to an external observer and, therefore, the hidden states.

Ekinci, Lentin, Uray, and Ulengin (2014) and Vojir et al. (2016) described the

hidden Markov model to detect fraudulent payment-card transactions. The model uses

algorithms to detect fraud. The algorithms learn the consumers’ purchasing habits,

calculate the probability, and constructs training sequences. The detection phase

generates observation symbols, form new sequences by adding to existing sequences,

calculates the probability differences and tests if both are the, same the transaction equals

normal else the transaction equals fraud.

Van Vlasselaer et al. (2015) indicated that security is one key area where

researchers are focusing on their studies. Van Vlasselaer et al. posited that network -

intrusion detection systems attempt to detect attacks through network and analysis of the

information from various areas to identify intrusions. Cardholder’s usage patterns

determine intrusion (false usage) or if an acceptable cardholder transaction. The patterns

indicate to the issuer how the person uses his or her card. The hidden Markov model is

an anomalous detection system. Van Vlasselaer et al. stated that usage patterns help

issuers develop immune systems to attack.

Payment-card processing using mobile technology opens the door for

criminalistic activity, according to Yelland (2013). Ortiz-Yepes’ (2014) cell phone

technology uses Near Field Communication (NFC) to transmit card information between

the acceptor, processor, and the bank and back to the acceptor. NFC technology has a

significant flaw concerning data transmission between the card and the phone. The

smartphone link allows fraudsters the capability to connect to the phone and obtain the

data through wireless transmissions (Ortiz-Yepes, 2014).

Yelland (2013) discussed how fraudsters hack cell phone service because of

mobile phone security weaknesses. One-way Yelland discussed was for 3-way calls

multiplying into multiple calls from the originating phone to one of the high-cost phone

services for international calls. Ortiz-Yepes (2014) identified Near Field Communication

(NFC) technology for mobile to accept payment cards. NFC routes card information via

a contactless card terminal application.

Cagalj, Perkovic, Bugaric, and Li (2015) supported smartphone technology as

continuously evolving. The newer cell phones come programmed with Near Field

Communication (NFC). Cagalj et al. explained that smartphone usage included financial

transactions through mobile banking applications. The applications are vulnerable to

mafia fraud attacks.

Cagalj et al. (2015) explained mafia fraud attacks using the example of a folded

piece of paper (fortune cookie) to capture the unsuspecting cardholder’s data. Cagalj et

al. stated that the criminal uses the unrelayable transmission information to trap the data

provided by the smartphone user when using NFC transactions. Cagalj et al.’s report

portray to the reader transaction timing and potential areas for data capture by criminals.

Cagalj et al. defined one process to delay transaction times to reduce fraud by using

force.

Halvaiee and Akbari (2014) discussed using AI to determine payment-card fraud.

The study focused on increased detection speed 25% more than current AI speeds.

Artificial Immune Systems (AIS) model immolates the human immune system. AIS

detect fraud using record processes and determine adverse record methods (Halvaiee &

Akbari, 2014). Halvaiee and Akbari reported how the AIS system recognizes the

cardholder’s spending patterns by determining the difference between good and lousy

card transactions. AIS detects and learns new methods of payment-card misuse. The

system acts as the human body in detecting viral conditions and fighting off those

conditions (Halvaiee & Akbari, 2014).

Potential 2015 and earlier payment fraud-detection systems used multiple types of

processing equipment and algorithms. Gold (2014) and Wolf et al. (2015) provided a

definition of supervised machine learning for card fraud detection. Carneiro, Figueira,

and Costa (2017) discussed the supervised machine learning system for detecting credit

card fraud. The supervised machine characterizes the card user's spending habits

(profile). Carneiro et al. study offered the reader information on support vector machine

(SVM) model usage of multiple kernels involvement that includes several fields of user

profile information instead of spending habits.

The simulation used by Gold (2014) and Wolf et al. (2015) indicated

improvement in the actual identification of fraud. Gold and Wolf et al.’s test data

showed decreases in false positive and false negative identification of fraud charges.

Gold and Wolf et al. used three different fraud probabilities: Quadratic, linear, and RBF,

from 0.30 to 0.50, changing the data size from 30 to 100. The RBF kernel outperformed

the linear and quadratic kernel in all fields.

Gold (2014) and Wolf et al. (2015) concluded that machine learning algorithms

were able to detect the user to root attack categories significantly. Gold and Wolf et al.

stated no procedure devised for kernel delimitation to obtain the best kernel functions.

The study opened the door to additional research areas using different classifiers for the

SVM. The information presented by Carneiro et al. (2017) provided the foundation for

the potential solution to credit-card fraud detection systems.

Richhariyva and Singh (2014) evaluated emerging card fraud challenges and

resolutions. Richhariyva and Singh found growth in fraud sophistication and scope

paralleled improvements in detection systems. New fraud detection systems are costly,

as card fraud continues to rise; the progress to stay ahead of fraudsters continues to lag

(Richhariyva & Singh, 2014).

Richhariyva and Singh (2014) posited the growth in card fraud continues, and

banks and other issuers need to stay ahead of the curve. Technology and enterprise-

oriented data-security analysts work on user and enterprise profiles, branding, outliers,

and internal controls to ensure customer resolution to data breaches (Richhariyva &

Singh, 2014). Seeja and Zareapoor (2014) recommended an intelligent card-fraud

detection system.

The hidden Markov model (HMM) is scalable to large transaction data sets and

processes transactions faster. The HMM uses cardholders’ usage habits to apply the

knowledge learned to determine if the transactions are fraudulent or correct. Dal Pozzolo

et al. (2014) discussed software systems technology for detecting fraudulent financial

transactions using fraud management in financial data streams. The application’s use

allows for policy constructs created by human programmers (Dal Pozzolo et al., 2014).

Fraud-detection software evaluation, as discussed by Dal Pozzolo et al. (2014),

allows for a comparison of the old system with potential new software. Dal Pozzolo et al.

introduced a hybrid-fraud detection model for EC and payment-card fraud. The hybrid

detection model demonstrates an increased detection of allowed connections and charges

and decreased fraud instances (Dal Pozzolo et al., 2014).

West and Bhattacharya (2016) focused on CI and data mining methods for

detecting financial fraud. CI includes logistic regression analysis, neural networks, and

support vector machines (West & Bhattacharya, 2016). West and Bhattacharya used

three standards for determining the performance of each method: accuracy, sensitivity,

and specificity.

Bhatia, Bajaj, and Hazari (2016) and Kabir, Onik, and Samad (2017) analyzed

payment-card fraud detection using different techniques: HMM, neural networks,

Bayesian learning, support vector machines, K-nearest neighbor, and Dempster Shafer

theory. Bhatia et al. performed a fusion approach to Dempster Shafer using Bayesian

learning. The process fuses cardholder usage and Bayesian learning.

The process combines predetermined suspicion levels and actual patterns to

determine if the transaction is legitimate (Bhatia et al. 2016). The process, as described

by Bhatia et al. (2016) and Kabir et al. (2017), is highly accurate and quick to process;

however, the cost is prohibitive, and processing speed is slow. Card issuers, acceptors,

and processors use the processes to determine fraud or stolen identities, card issuers and

processors follow PCI-DSS recommendations for Chip and PIN cards.

Chip and PIN Payment Cards

The chip and pin cards use computer chip or smart card technology to improve the

card issuer’s capability to authenticate a customer’s transaction (Sullivan, 2013).

Sullivan (2013) stated that the chip card uses a secure code authentication process known

as dynamic data authentication. The chip and pin cards are harder and more expensive to

duplicate, additionally, and the chip offers enhanced protection to the cardholder’s

information (Sullivan, 2013). The chip card generates additional transaction code

sequences for similar computer network users, changing their password at regular

intervals (Sullivan, 2013).

F. Wang, Chang, and Lyu (2015) proposed an additional security measure to

include a onetime transaction authentication code. The proposed transaction code, per F.

Wang et al., deletes itself after the transaction completes as either approved or denied

transaction. The introduction of additional security measures introduced by F. Wang et

al. uses facial recognition software for consumer and issuer protections.

Sullivan (2013) posited fraudsters who duplicate chip cards use the duplicated

card for card-not-present transactions. The card information, according to Sullivan, is

obtained through phishing and malicious EC site. Transactions made in-person using

chip and pin, or a fraudster and pictures may intercept QR coded cards (identifying

picture of the cardholder changed to match the person presenting the card (Wang et al.,

2015).

Payment-card fraud detection is a costly problem for card acceptors. The cost of

false-positive affects the merchant and the bank issuing the card. However, if the

processor and the issuer fail to detect the fraud, the transaction cost is lost, the effect to

the merchant can be very high (Bahnsen, Aouada, Stojanovic, & Ottersten, 2016).).

Collectively safety is every employee’s responsibility. IT security should be about

flexibility, not rigidity (Khanna, 2013).

The plethora of research studies forms the fundamental focus of the study

involving the effects of identity theft and data breaches, public perception, and the

organization’s reputation. Reviewed literature examined (a) the role of software, (b)

fraud detection methodologies, and (c) new technology such as chip cards with limited

results in reducing payment-card fraud. The PCI-DSS recommendations offer business

leaders and data-security professionals a framework for developing secure networks and

transaction processing guidelines (Clapper & Richmond, 2016; Fernandes, 2015).

Payment-card transaction processing follows the PCI-DSS guidelines. Payment-

card fraud has multiple software algorithms available for detecting fraud such as Markov

Model, Fischer Algorithm, and artificial intelligence packages (Gold, 2014; Manworren

et al., 2016). The results of the review lead to conclusive arguments for the urgent need

to explore anti-fraud strategies to minimize the rising trend of payment-card fraud and

identity theft, among other challenges of network security, transaction processing, and

card issuers struggles to develop processes for identifying fraudulent transactions.

Transition

Section 1 contained a discussion on the need to investigate payment-card fraud

and avenues for reducing or eliminating fraud. The focus of the research problem is on

payment-card fraud and identity theft. United States Government Accountability Office

(2014) posited data breaches increased for banks and governmental agencies to 255,666

in 2013. A background discussion provided information about data breaches, payment-

card fraud, and identity theft in the United States retail arena. Little research is available

about the influence of fraud prevention elimination (Jha & Westland, 2013).

This section also contains a discussion of the purpose of the research study, along

with the research method, the nature of the study, the geographic location of the study,

and literary review. The literary analysis included the evolution of payment-card fraud,

identity theft, and data breaches. Also discussed are the current fraud detection and data

breach methodologies.

The literature review also involved reviewing data on retail payment-card and

global card fraud systems. Section 1 included a discussion of the assumptions,

limitations, and delimitations of the study. Section 2 contains the details of the project,

such as the role of the researcher, participants, data collection method, population and

sampling, research method, and design. Section 3 includes the findings of the study.

Additionally, Section 3 covers the implication of social change and recommendations for

action and further research.

Section 2: The Project

In Section 2, the role of the researcher is defined; the purpose of the research is

described, the approach and criteria for selecting prospective study participants are

outlined. Also, in this section will be a brief examination of research methods, study

design methodologies, and the rationale for selecting a qualitative method with multiple

case design for this study. Also covered are the considerations for ethical parameters and

principals applicable to this study. In addition, the section contains the outline of

population sampling, followed by a review of the methods for collecting, organizing, and

analyzing the study data. Section 2 concludes with a discussion of the approach to ensure

the reliability and validity of the research and steps for minimizing potential biases and

assuring credibility and confirmability of the study.