Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

5/9/2019
10:30 AM
Chris Ryan
Chris Ryan
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Fighting Back Against Tech-Savvy Fraudsters

Staying a step ahead requires moving beyond the security techniques of the past.

It seems that a new fraud scheme emerges  every day. And with billions of compromised credentials, criminals have been implementing a high volume of fraud attacks on organizations across all industries.

The latest fraud scheme — known as credential stuffing — involves criminals who have access to advanced systems and technology using the stolen credentials to log in to online accounts. While credential stuffing has been around for a few years, the current iteration of the scheme is so advanced that criminals can make login requests appear to come from different IP addresses and different browsers. This helps bypass fraud prevention defenses that recognize multiple attempts from a single IP address.

But beyond the technological advances that criminals leverage, the challenge for most organizations is the tendency for people to reuse usernames and passwords across multiple sites. That means the credentials that were stolen may not have originated from the affected organization. And according to Experian's "2019 Global Identity & Fraud Report," more than two in five consumers worldwide have already experienced a fraudulent event online at some point in their lives. To make matters worse, organizations still heavily rely on usernames and passwords as the primary security method — confirmed by the report, which showed passwords, PIN codes, and security questions remain the most widely used authentication methods by businesses.

While organizations can take the steps to educate consumers on best practices for online security and passwords, there needs to be more proactive measures to protect people's accounts and information. If not, the risk of account takeover fraud could increase exponentially — especially with the prevalence among consumers to use mobile devices to access online accounts. According to Javelin Strategy & Research's "2019 Identity Fraud Study," in 2018, 17% of account takeover victims had their mobile phone account compromised, compared with 10% in 2017.

As increasing numbers of people use smartphones and tablets for financial transactions and email, organizations must explore heightened fraud prevention measures, such as advanced device intelligence. The use of device characteristics needs to be more sophisticated than the traditional collection of high-level attributes like browser type, operating system version, and IP address. These characteristics are often easy to spoof, enabling criminals to mask the origin of the login request.

Organizations tend to prioritize identifying devices that they're familiar with, but it may be more important to authenticate the devices that they don't recognize. We have the advanced data and technology to help businesses analyze and assess characteristics that go beyond the use of cookies to verify an individual's identity, letting an organization more accurately isolate credential-stuffing attacks.

For example, if most credentials are being used from a specific geolocation — particularly one that has been used in previous attacks — it could indicate fraudulent behavior. But businesses can also analyze the velocity at which the information and device is being used — criminals tend to reuse data and access multiple accounts from the same device at a high volume within a short period of time.

Device intelligence is only one component of a successful fraud prevention and identity management strategy. The combination of device identification technology with advanced analytics, such as biometrics, machine learning, digital tokenization, and document verification can help an organization uncover anomalies that may indicate fraudulent behavior. But more importantly, these advanced measures protect people's information while requiring little effort on behalf of the consumer.

The earlier in the process that an organization can detect fraud, the more damage to a customer's account and identity it can prevent. And that means a happy, loyal customer.

Criminals will always look to exploit weaknesses and vulnerabilities within an organization's systems; however, technology and advanced analytics can help businesses counteract the threat. There is no silver bullet for fraud prevention, but there are multiple approaches that help businesses make the right fraud decisions and protect people's identities.

Related Content:

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Chris Ryan is a Senior Fraud Solutions Consultant at Experian. He delivers expertise that helps clients make the most from data, technology, and investigative resources to combat and mitigate fraud risks across the industries that Experian serves. Ryan provides clients with ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13157
PUBLISHED: 2019-11-22
nsGreen.dll in Naver Vaccine 2.1.4 allows remote attackers to overwrite arbitary files via directory traversal sequences in a filename within nsz archive.
CVE-2012-2079
PUBLISHED: 2019-11-22
A cross-site request forgery (CSRF) vulnerability in the Activity module 6.x-1.x for Drupal.
CVE-2019-11325
PUBLISHED: 2019-11-21
An issue was discovered in Symfony before 4.2.12 and 4.3.x before 4.3.8. The VarExport component incorrectly escapes strings, allowing some specially crafted ones to escalate to execution of arbitrary PHP code. This is related to symfony/var-exporter.
CVE-2019-18887
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. The UriSigner was subject to timing attacks. This is related to symfony/http-kernel.
CVE-2019-18888
PUBLISHED: 2019-11-21
An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. T...