By: Andrew Gulledge
Bridgekeeper: “What is the air-speed velocity of an unladen swallow?”
King Arthur: “What do you mean? An African or European swallow?”
Here are some additional reasons why the concept of an “average fraud rate” is too complex to be meaningful.
Different levels of authentication strength
Even if you have two companies from the same industry, with the same customer base, the same fraudsters, the same natural fraud rate, counting fraud the same way, using the same basic authentication strategies, they still might have vastly different fraud rates. Let’s say Company A has a knowledge-based authentication strategy configured to give them a 95% pass rate, while Company B is set up to get a 70% pass rate. All else being equal, we would expect Company A to have a higher fraud rate, by virtue of having a less stringent fraud prevention strategy. If you lower the bar you’ll definitely have fewer false positives, but you’ll also have more frauds getting through. An “average fraud rate” is therefore highly dependent on the specific configuration of your fraud prevention tools.
Natural instability of fraud behavior
Fraud behavior can be volatile. For openers, one fraudster seldom equals one fraud attempt. Fraudsters often use the same techniques to defraud multiple consumers and companies, sometimes generating multiple transactions for each. You might have, for example, a hundred fraud attempts from the same computer-tanned jackass. Whatever the true ratio of fraud attempts to fraudsters is, you can be confident that your total number of frauds is unlikely to be representative of an equal number of unique fraudsters. What this means is that the fraud behavior is even more volatile than your general consumer behavior, including general fraud trends such as seasonality. This volatility, in and of itself, correlates to a greater degree of variance in fraud rates, further depleting the value of an “average fraud rate” metric.
Limited fraud data
It’s also worth noting that we only know which of our authentication transactions end up being frauds when our clients tell us after the fact. While plenty of folks do send us known fraud data (thus opening up the possibility of invaluable analysis and consulting), many of our clients do not. Therefore even if all of the aforementioned complexity were not the case, we would still be limited in our ability to provide global benchmarks such as an “average fraud rate.”
Therefore, what?
This is not to say that there is no such thing as a true average fraud rate, particularly at the industry level. But you should take any claims of an authoritative average with a grain of salt. At the very least, fraud rates are a volatile thing with a great deal of variance from one case to the next. It is much more important to know YOUR average fraud rate, than THE average fraud rate. You can estimate your natural fraud rate through a champion/challenger process, or even by letting the floodgates open for a few days (or however long it takes to gather a meaningful sample of known frauds), then letting the frauds bake out over time. You can compare the strategy fraud rates and false positive ratios of two (or more) competing fraud prevention strategies. You can track your own fraud rates and fraud trends over time.
There are plenty of things you can do to create standardize metrics of fraud incidence, but good heavens for the next person to ask me what our average fraud rate is, the answer is “No.”
