Controlling Fraud Risk Exposure and Loss

1. Controlling Fraud Risk Exposure and Loss Sherri Goodman Director of Fraud Operations September 22, 2005

2. Agenda • Overview of Fraud Types • Identity Fraud • Transactional Fraud • Primary Fraud Loss Control Strategies • Prevention • Detection • Recovery • Partnerships • Fraud Risk Management Mission • Fraudster Trends and Emerging Threats • Overall Financial Impact and Trend • Q & A

3. Credit card fraud comes in two types based on how it is perpetrated Identity Fraud Transactional Fraud • Personal identification information is used to impersonate true person; for example: • SSN • Date of birth • Mother’s maiden name • New credit accounts can be established with this information without consumer knowledge • Account access devices are stolen and used for purchases • Credit Cards • Convenience Checks • Or credit card information is stolen and used for purchases • Counterfeit cards • Internet purchases • Only impacts existing accounts

4. Identity Fraud is perpetrated in three primary ways Definition Examples • Consumer’s personal information is stolen and an unsolicited channel is used to apply An application for the creation of a credit account using a false name or other false identification information Application Fraud The use of an existing credit account by a person who gains access to the account through an unauthorized means • Account address is changed and an access device is requested (i.e., card, convenience check) Account Takeover • Card is stolen from customer’s mailbox or from within the postal system, and activated using stolen personal info The interception and use of a credit card before receipt by the cardholder Not Received Issuance

5. Lost or Stolen Similarly, transactional fraud is grouped into types depending on how it is committed Definition Examples • Credit card is stolen from customer The use of a lost or stolen card or convenience check • Magnetic stripe info is “skimmed” from true card and encoded onto different card The use of altered or illegally produced credit cards or convenience checks Counterfeit The use of credit card account information (e.g., account number, expiration date) without the physical card being involved Card Not Present Purchase • Purchases are made via internet with account number and expiration date only

6. To control fraud losses, we work across three dimensions Detection Recovery Prevention • Transaction monitoring for suspicious activity • Application screening and investigation for potential ID fraud • Signature authentication on convenience checks • Customer education • Reversal of erroneous and/or false claims • Chargeback merchants who are liable under Visa/Mastercard rules • Letters of Responsibility from perpetrators • Law enforcement restitution • Data security • Application screening and investigation for potential ID fraud • Card activation • PIN usage • CVV2/CVC2 usage • Customer authentication on phone/internet • Customer education • Law enforcement

7. And we do this work in close coordination with internal and external organizations • Government • Legislators (Federal and State) • Regulators (Fed, OTS, FTC, Treasury) • Law Enforcement (Secret Service, FBI, Postal Inspectors, local/state) • Industry • Financial Services Roundtable • ID Theft Assistance Center • Internet and ID Theft working groups • MasterCard and Visa • Credit Bureaus • Other issuers • Capital One • Marketing • Customer Service • Mail Services Government Industry Capital One

8. But fraud losses are but one element of our three-part mission for managing fraud risk for Capital One Fraud Management Expenses Negative Customer Impact Fraud Losses + + Minimize: • Call center operations • Investigations of potential fraud • IT systems and infrastructure • Defense strategy and analysis • Customer education • Transaction declines at point of sale • Card activation • Authentication to call center • Victim assistance • Customer education • ID fraud losses • Transactional fraud losses

9. The technical advancement and globalization of fraudster activity will provide increasing fraud management challenges Key trends • More professionalization of fraud practices • More fraud done offshore • More “fraudster-to-fraudster” education • More technical fraud (hacking skillset coupled with straight fraud skillset) • More collusion – not just merchants and fraudsters, but company insiders

10. In spite of ongoing fraudster innovation, the credit card industry has cut its fraud loss rate by over half in the past five years U.S. Credit Card Fraud Losses as a percentage of sales (shown in basis points) Basis Points Of Sales Source: Risk Managers Roundtable Industry Report

11. Q & A