Vulnerabilities to fraud are increasing across the board

Networked exploitation

The stereotype of a fraudster as a lone actor operating out of a darkened room, isolated and without support, does nothing to illustrate the scale and effectiveness of organised fraud in the technological age.

The fraudster of today is generally part of a large network, capable of launching mass attacks simultaneously across a number of industries, using sophisticated automated tools and dark web intelligence across multiple regions.

As the latest report reveals, human-initiated manual attacks decreased 29% YoY during the pandemic; however, bot attacks increased by an alarming 41% across all sectors.

It’s little wonder that bot attacks are such an attractive attack strategy amongst fraudsters globally – they can be automatically scripted by an individual to run anytime, anywhere around the globe.

Fraudsters are using this as their primary attack vector as there is no language barrier; a very high volume of stolen credentials can be tested on multiple businesses simultaneously; and, perhaps most worryingly, there is no victim interaction, meaning automated bot attacks can operate under the radar, without arousing suspicion from their targets.

Sophisticated technology and an acute knowledge of programming – as opposed to a handful of burner phones and a list of misappropriated personal details – are increasingly becoming the tools of choice for organised fraud networks around the world, which goes some way to explain why automated fraud is increasing at such an alarming rate.

Back door attacks

It may surprise some that online media streaming services saw such a stark rise (174%) in automated bot attacks in the first half of the year. After all, what do fraudsters want with logins to online services with no obvious way to monetise them?

Crucially, criminals know that despite years of advice against it, many people still use the same login credentials for all of their online accounts, including their online banking. Paired with the massive rise in subscriptions seen since the first UK lockdown, this presents fraudsters an opportunity to test stolen credentials at an industrial scale.

By taking advantage of media services’ comparatively lower security barriers, criminals can validate login details, such as email address and password, before using them to launch social engineering scams designed to gain the additional information required to gain them access and control of bank accounts, digital wallets and buy-now-pay-later accounts, which can be monetised. With fraudsters building networks to dupe their victims, identifying and fighting those networks should be at the heart of every organisation’s anti-fraud initiative.

Pandemic induced shift to digital

In a phenomenon McKinsey referred to as The Quickening, e-commerce saw more than a decade’s worth of growth in the first quarter of 2020, as more consumers than ever before turned to digital solutions.

According to media regulator Ofcom, UK adults spent an average of three hours and 47 minutes online every day during the pandemic, prompting an increase in the number of personal accounts for banking, financial services, e-commerce shopping and media streaming.

As logins soared, so did the opportunities for fraud. While new account opening fraud remains the most popular form of automated attack across the customer journey, with one in 11 transactions in the Digital Identity Network estimated to be an attempt, overall this attack vector fell 10% YoY.

A corresponding growth of 52% in login attacks and an 18% growth in payment attacks – testing stolen card credentials – reinforces the hypothesis that fraudsters are automating attacks to test the validity of stolen credentials on an industrial scale.

A networked response

The proliferation of highly technical, automated attacks by organised criminal gangs with access to dark web intelligence, coupled with a mass migration online by consumers, should be of real concern to all businesses and authorities. And with the emergence of new, consumer-friendly, convenient payment systems – such as Buy Now, Pay Later and digital wallets – businesses must consider an ever-increasing host of risks.

Awareness campaigns directed at educating consumers on how to spot the red flags and avoid the dangers of online activity can only go so far to preventing the successful infiltration and misappropriation of people’s online accounts.

Increasingly, the emphasis is on businesses to protect their customers online, through better collaboration and sharing of fraud intelligence – in other words, by behaving like the networks they’re fighting.

Sharing of data, and the use of advanced analytics to stop the tell-tale signs of suspicious activity within a complex network of online transactions, is one of the most effective ways to counter the efforts of global criminal networks. Importantly, our analysis shows that while these networks are far-reaching, the same stolen credentials tend to be simultaneously re-used by multiple groups in multiple attacks.

This is an important and fundamental weakness in the fraudsters’ approach, and one that industry could easily exploit through better intelligence sharing using real-time tools across sectors, to become far more effective in detecting and tackling fraud.

This standard should therefore become a priority for all organisations serious about protecting customers and mitigating the increasing threat of online fraud.

With the birth of multi-layered and powerful solutions capable of tokenised intelligence sharing, organisations don’t have to wait for the redrafting of regulation required to make intelligence sharing possible.

Powerful analytical tools are now capable of detecting and blocking a wide spectrum of attacks against every step of the customer journey. Helping firms to understand typical customer behaviours across the entire journey (from account creation to logins to payments) allows organisations to spot and deter bad actors fast, as well as let trusted genuine customers pass without friction.

Fundamentally, it takes a network to fight a network. For firms, that means blending a variety of tools, including digital identity intelligence, behavioural biometrics, machine learning and other advanced technologies, as well as a concerted approach to collaboration, if they hope to effectively protect themselves and their customers from fraud in the years to come.

Jason Lane-Sellers is director of market planning for EMEA at LexisNexis Risk Solutions.