PCM Vol.2 - Issue 5

Thought Leaders Corner
by Rebekah Moody
& Vanita Pandey
The Many Faces of Cybercrime – A Look at the Key Fraud Trends
from Q1 2016
As a technologically savvy consumer, you might think you are
fairly adept at spotting potential fraud attempts. We know that
banks won’t ask for our full login details, our passwords need
to be undecipherable, and we need to make sure that we
don’t click on dodgy looking links in emails. Sadly, this may not
be enough to protect us from fraud attacks. The cybercrime
world is evolving and consumer data is now everywhere.
Usernames and passwords can be bought at the touch of a
button following numerous data breaches and fraudsters
can stitch together complete and convincing identities from a
jigsaw of stolen credentials. They create pitch-perfect attacks
because they know so much about us, sometimes more than
the businesses we transact with.
Organizations must become smarter at detecting the full
spectrum of possible attacks, from huge automated identity
testing sessions, to advanced social engineering attacks that
hijack individual accounts. This starts with really understanding
the digital identities of consumers so that high-risk behavior
can be detected in real-time.
We’ve seen some interesting trends emerge in ThreatMetrix
Digital Identity Network at the start of this year. Authentication
is still a core part of our Network traffic, with 86% of
transactions coming from returning devices. Trust is critical
– consumers expect to be recognized, known and given
easy access to products and services without experiencing
unnecessary friction.
However, the dark undertones of fraud attacks continue
to take us all by surprise, with 311 botnet attacks detected
this quarter alone. Businesses are under attack from a
particularly pernicious group of fraudsters who are becoming
would-be generals of their very own botnet army, controlling
vast networks of bot computers, some of which belong to
unsuspecting consumers.
These botnet attacks are mass-testing identity credentials,
often adopting a low and slow attack speed to appear more
like legitimate user traffic and evade rate control measures
that have traditionally formed the first line of defense.
ThreatMetrix also spotted some new forms of credential
testing this quarter. Online businesses provide the perfect
way for fraudsters to anonymously test stolen payment
credentials, such as credit cards, before making a big ticket
purchase. Industries with low digital sophistication are easy
targets. We detected a series of $5 payments made with
stolen credit cards targeting the charity sector.
Identity spoofing had a strong footprint in the FinTech
space with fraudsters using cloaking technologies such as
proxies or spoofed locations to mask their true identities and
locations. This has caused an increase in fraudulent new loan
applications.
Our other big story this quarter was the continued growth
of mobile transactions, particularly prevalent in financial
services. Mobile transactions grew 200 percent compared
to the previous year and now make up one third of our
006