Quick Service Restaurant or QSR fraud is a concern for businesses that has become increasingly common as more QSR locations focus on delivery and carry-out services. QSR chains are experiencing more online orders than ever before. The risk of fraud increases as these entities do more business online.
QSR fraud often entails someone breaking into a person’s online account and ordering and paying for items. But the person who owns that account might not have approved these purchases. The customer would require a chargeback to avoid potential losses. But the chargeback can be costly to a QSR establishment.
It isn’t hard for many people to commit QSR fraud either. While most instances of QSR fraud entails someone acquiring another person’s email address and password, it could also entail malware that accesses one’s login credentials. Some data thieves can also produce lookalike apps or incorrect listings that can steal login data from susceptible patrons. Machine learning has also become a worry, as fraudsters could use malware to access more accounts and to predict when people are likely to provide their data for getting on certain websites.
QSRs have a weapon in hand with multi-factor authentication. The authentication process entails a QSR requiring multiple login factors for each customer who wants to order something. Instead of entering in a username and password, the customer would have to enter something else in the system. The content can come from a text message, a mobile app, or anything else the QSR uses to confirm an identity. The extra data confirms that person’s identity, ensuring the QSR can trust the new visitor.
The authentication effort can work on mobile and desktop devices alike. The setup is necessary for mobile devices, with many people using them to order foods from QSRs.
The effort is advantageous and easy to plan. But it is not without its shortcomings, as these details illustrate.
Positives
- Multi-factor authentication adds extra layers of security.
QSRs won’t always correctly predict a customer through a traditional username and password. A QSR can add an extra point like a security question, a biometric scan on a mobile device, or answering a particular equation produced on a website or app. QSRs can utilize whatever authentication solutions they want, or they can include a combination of methods. They can also let the customers choose which ones they wish to utilize.
- People stealing login data is a common cause of QSR fraud. Multi-factor authentication removes this problem.
Sometimes the people who steal the login data are directly related to the account owner. It could be someone else in the household who wants to buy something. Some customers may request chargebacks if those people access an account and buy things without their permission. A multi-factor approach can reduce that threat, eliminating a prominent cause of QSR fraud.
- It stops bots from acting.
Many fraud bots can steal data and automatically generate orders. A multi-factor authentication system can use a system that requires human interaction to answer. A bot can enter the username and password, but it will struggle to manage another factor. Bots also cannot intercept text messages or other things that can only be read in one space.
- The authentication process can rely on one’s physical location.
Sometimes the second factor will come through a text message or code on a mobile device. The code can come through an email, but it may also come from a dedicated mobile app that the QSR supports.
The customer must be near that mobile device to access the data necessary to confirm an order. The person will enter a message or code from that device to access one’s account. The data will be inaccessible if that person doesn’t have one’s phone or another device on hand. Anyone who sees this code without having access to the website won’t be able to enter anything new.
Since people cannot intercept text messages or other pieces of mobile data that rely on a physical location, it becomes harder for QSRs to fall victim to scammers. Some QSRs could even establish systems where they will only accept orders when someone is within a physical restaurant location.
- Multi-factor authentication doesn’t always require a network connection.
Not all new forms of authentication require a person to get on the same network. A biometric-based system can work with whatever device someone already uses, for example. It can identify the unique thumbprint or retinal scan feature that a device has already saved.
Negatives
- People may not always have access to the things necessary for multi-factor authentication.
Some multi-factor authentication processes require a person’s mobile phone. These efforts include text messages, mobile app codes, and other things that utilize a phone. These authentication methods aren’t worth anything if the customer isn’t near one’s phone or doesn’t have it on hand.
A customer might also be in a spot where one has poor phone reception. It would be tough for that person to receive a message or confirm one’s identity in that case.
- There’s always the risk that bots can evolve and become more powerful.
There are no known bots that can intercept authentication codes produced by apps or other programs. But the risk of there being one that can do this is always present. Bots have evolved and have become more powerful than ever before. Whether these bots will become more effective soon remains unclear, but it is a risk people cannot ignore.
- Customers could still become frustrated by these features.
As convenient as multi-factor authentication can be, not all confirmation methods will be effective. Some people may lose their secondary confirmation data. They may also struggle with some technical aspects of these authentication features, especially with biometrics. Proper refinement may be necessary to make multi-factor authentication easier to manage.
Multifactor authentication is a useful solution for QSRs to prevent fraud. The practice isn’t perfect, but it can still keep them safe if used well.
