Payment fraud attacks, spikes and patterns

Hi, name is Duncan Malcolm. I convene First Six Last Four to help us understand more about fraud threats and the things that we can do to reduce our risk in the face of highly motivated adversaries. In this post I will explore some of the techniques to detect and understand payment fraud attacks. We will cover: Introduction Fraud attack detection Physical vs non-physical products Common fraud patterns Think like your adversary ****************** ****************** Technology failures The right way to think payment risk Introduction A fraud attack is defined as an elevated period of fraud losses that are higher than usual. Fraud attacks will typically last anything from a few minutes to a few days. The main challenge with payment fraud is that you cannot be sure that a transaction will lead to a chargeback for anything from 15 to 365 days with the average being around 30 days. As a result, consider that an increased amount of fraud happening today may not be noticed for some time. Fraud attack detection Detecting fraud attacks is not too challenging. Unfortunately if you get it wrong the consequences can be significant. Fraud spikes are not always caused by fraudsters they can also be as a result of a tech stack failure. Usually it requires: Trend or spike monitoring Multiple redundant fraud monitoring solutions Manual payments screening An ML model that self-update Trend or spike monitoring This is very simple you should have a system set-up so that if there is an increased number of transactions across any key features that you and your team get an alert. Common features are: Product or product category Card BIN number Card country Issuing bank These alerts should go to key stakeholders including: Payments - The head of fraud, payments and any analysts Marketing - Who might be running a promotion or new ad campaign Engineering tech leads - Who may have made a change to the platform There should be an easy pre-agreed pre-trained approach to investigating and resolving these alerts. Escalations to senior leaders should be pre-agreed so that decisions do not have to be made on the fly. Physical vs. non-physical products Payment fraudsters like to realise their profits immediately. They will therefore generally target businesses where there is a low lead time to getting the product. An example of a physical product might be a washing machine. It's large and bulky and may take a few days to deliver. It goes to a real address all of which is quite risky for a fraudster. An example of a non-physical product might be a money transfer or cryptocurrency. These are purchased and delivered often immediately upon payment. The receiving side can also very quickly move the asset around making it hard to impossible to find the fraudster. Common fraud patterns A fraud patten are the features that make up a series of fraudulent transaction attempts which show them as different to regular customers. The types of pattern you experience will vastly depend on the type of business you are running. Over the past few years patterns have become increasingly complex as fraudsters try to outsmart fraud controls. Think like your adversary A helpful thing to do is consider how your adversary is operating their fraud operation. For example they could be buying lists of card details online or they could be hand picking high value targets and exploiting them with identity theft. As they emerge within your platform each of these patterns should be built into your payments fraud risk management strategy. Test transactions When gearing up for a larger attack fraudsters will often test a small transaction to see if a card will work. Sometimes this will happen on one account where several cards are tested or it could be with another merchant where you don't have visibility. Account priming More sophisticated fraudsters know that new accounts are more likely to have transactions blocked compared with existing accounts. They will therefore often open or buy accounts on the darkweb that have been created some period before and have a few small successful transactions. Once a sufficient number of these accounts are ready they will go for a big blast or layered attack as described below. Big blast The most common fraud attack that fraud teams encounter are big blast attacks. These are typically characterised by a surge in transactions from: a specific BIN number or issuing bank across a large number of accounts a specific device type, operating system, screen resolution proxied or VPN'd traffic but not always How I believe these attacks happen: Fraudsters buy a list of stolen cards online They may test transactions to see which cards are valid with you or another merchant They will use new or farmed/bought accounts to execute transactions They might time attacks to coincide with evenings and weekends From past experience attacks tend to be from smaller issuing banks. My working theory is that these banks either have lax cybersecurity or that people within the banks leak the card numbers. Advanced patterns The above two patterns are the most common. However, fraudsters are becoming more advanced. They will mix up all of the features above and timings to make the traffic look as normal as possible. Whales The less technically savvy but perhaps more socially competent fraudsters will go for high value rather than high volume. They will create accounts that have all the right details and pass every ID check. These are probably from stolen wallets that have all of the victim's details such as SSN, driving license and payment cards. Whales will then rack up quite large transaction values with several large orders. This will happen over a period of 4-12 weeks until you the merchant start getting chargebacks. Technology failures It is possible that increases in fraud are as a result of technology changes. Therefore, if you have active development happening on your eCommerce platforms it is important to have well educated people in your team(s). Your product managers, tech leads and engineers should all have a working understanding of fraud. Therefore consider taking the time to educate them and provide fraud training. It could save you a lot of money in the long run. Training should include: What your key features are to detecting fraud e.g. card attempts How your current fraud detection solution works Where it pulls its data from What validation is in place both on the fraud system side and the eCommerce app payments side The right way to think about payment risk A final thought on this post is what is the right way to think about payment risk. Where does the risk lie? Is it the account or the card? I would posit that it is the card that is risky not the account. Consider that an existing card that has been used to made payments over the last 12 months. It is unlikely to suddenly go bad. A new card however, whether on an existing account or new account however, is much more risky. There could have been ATO it could be a farmed account who knows. But the new previously unseen card is what initiates the payment and fraud risk.

Payment fraud attacks, spikes and patterns

Introduction

This content is only available to Full Members

Leave a comment Cancel reply