Will the Recent Ticketmaster Data Breach Drive More Fraud for Banks and Credit Unions?

Add these action items to your card fraud checklist to strengthen your defense.

The hacker group ShinyHunters allegedly breached Ticketmaster’s data in late May 2024, including credit and debit card information for over 560 million consumers worldwide. That’s more than 2.5 times the prior largest breach of Experian a decade ago.

So, what will happen to U.S.-based consumers whose card information was compromised? Depending on how recent the cards were issued and their balances, they will sell for $8 to $20 per card on the dark web.

This equates to even more fraud losses for banks and credit unions, which have already been hit hard across all payment channels this year. Cornerstone benchmarks of more than 200 institutions reveal that the median fraud loss is 0.035% of purchase volume for debit cards and 0.042% of purchase volume for credit cards. These numbers nearly double for the low performers.

Check fraud is up 171% year over year based on a recent Actimize study. Account takeover fraud accounts for 12% of losses according to Alloy’s 2024 State of Fraud Benchmark Report. (The AFP Payments Fraud survey is a fantastic resource to see where banks and credit unions struggle to contain fraud – I like this free version.)

An industry veteran shared that we used to see 12.2 basis points (bps) of fraud loss for cards, half of which we could pin back on the merchants. Now, with card not present (CNP) transactions dominating the mix, we are up to over 15 bps of card losses and only recovering 5 to 6 bps of that given the merchant protections in CNP transactions.

Couple these fraud losses with lower interchange revenue income from cards and it spells trouble for banks and credit unions.

So, what can financial institutions do considering these issues and the recent breach? Here are a few items to put on your card fraud checklist:

1. Search your card transactions for the last 12 months for “Ticketmaster” in the merchant description. Fraud detection systems like Verafin, Actimize and Abrigo often allow keyword searches for specific merchants.
2. Monitor for $0.99-$9.99 test transactions on your cards. Yes, you will see quite a few false positives for things like in-game and Apple Store purchases, but fraudsters wanting to buy cards from the dark web often want to pulse check to see if the cards are still valid. These pulse checks are for low dollar amounts that go unnoticed as consumers review their accounts. Remember, the most common card fraud topology is test card transaction followed by big item purchase. Fraudsters can flip the large screen TV pretty quickly for the cash out.
3. Set up weekly meetings with outsourced card fraud teams at your processor to review rules and ensure you are blocking any recent schemes. You pay these processors to monitor every transaction, so make them earn that revenue by forcing them to share what they see and apply the prevention rules for your institution.
4. Subscribe to dark web monitoring services like Q6 Cyber and ZeroFox to receive daily or weekly updates of any new cards from your BINs for sale on the various online marketplaces. These services are affordable and utilize both software and humans to validate the recency of information for sale. Don’t rely on CAN/CAM alerts from Visa and Mastercard, which are often too late for card compromise.
5. Consider taking dispute processing in house. If you also utilize your card processor for processing your Reg E debit card and Reg Z credit card disputes, you could be paying $28 to $35 per dispute with little to show for recoveries. Many software providers like Q2, FINBOA, Quavo, FIntegrate and Advantage Payment Services have made taking the dispute tracking and recovery process in house much more appealing with lower costs per dispute and higher recovery rates.

The latest breach of Ticketmaster adds to the significant fraud challenges that banks and credit unions are facing. What other tips do you GonzoBankers have for our institutions to combat this problem? Let us know in the comments below!

---

John Meyer is a senior director at Cornerstone Advisors. Follow John on LinkedIn.