Threat intelligence from NuData Security, released today, provides insight into the ominous cyber fraud threats coming over this holiday period.
Fraudsters are using increasingly sophisticated cyber fraud techniques and leveraging spikes in activity over Cyber Monday and holiday shopping periods to circumvent detection. As merchants and financial institutions implement additional security layers for automation, account takeover and fraud detection, hackers are evolving to find more complex and pervasive ways to commit fraudulent activities online. Much like a virus mutates in response to a vaccine, hackers are finding new ways of infiltration.
NuData Security analyses over 80 billion behavioural events annually over its customer base, and this month alone, have performed real-time analysis on 40 billion data points. NuData findings are such:
- High risk events have more than doubled since this period last year representing a higher percentage of total traffic over all placements.
- At the login, fraudulent activity increased from 4% to 15%
- According to NuData’s intelligence, 60% of new account creations are fraudulent compared to 39% last With the underground awash in compromised consumer data from breach-after-breach, fraudulent account creation will continue to climb. Fraudsters will create fraudulent accounts, and let them sit dormant or make the accounts look legitimate during the time leading up to holiday seasons, then strike. Typically, cybercriminals target these times of year because they know security teams are stretched and policies are loosened up to accommodate volume. They can generally hide attacks within the volume of transactions.
- Account takeover continues to be a dire problem for retailers. We saw a staggering 600% increase in login anomalies over this time last year. Both volume and sophistication has spiked, as stolen personal data is so easy to obtain, and consumers continuing to use the same user names and passwords from site to site, login processes have never been so easy to subvert.
- This month has already seen a 128 percent increase in sophisticated scripted attacks from hackers gearing up for this holiday weekend.
- We identified 50 million fraudulent attempts last November across our consortium, and as we are upon holiday shopping season – which will be a banner year for fraudsters – we are predicting an increase in high risk attacks targeting key retailers. We are predicting around 82 million of these attacks over the same holiday period across our consortium.
Mobile transactions represent a concern for merchants this holiday season, as consumers are moving more and more to mobile shopping, retailers are trying to balance security and experience. We’ve observed a 258% increase in unique devices (across our customer base), firmly supporting industry statistics of over 50% of all e-commerce traffic now coming from mobile devices.
- Last holiday season mobile devices represented only 11% of total purchases; this year we are trending to reach 25% of all purchases coming from a mobile device.
- As predicted, with increased usage, will come increased threats. We are seeing a spike in fraudulent activity from the mobile. With a spike from 11% of mobile transactions being high risk in 2015 to 32% this year, equating to a 190% increase over 2015. Fraud increases of this kind could have significant dollar value.
The typical value of a fraudulent transaction on Black Friday is $190 on a smartphone and $210 for tablets.
Fraudsters are using increasingly sophisticated techniques to steal data and circumvent detection:
- Device and location spoofing has grown, to evade traditional security tools. Organisations relying heavily on device ID and geolocation based solutions to find risk, may be in trouble, as geographical and IP spoofing represented 10% of all risky login activity last fall leading up to Black Friday.
- Account takeover and new account creation attacks are more challenging to detect as compared to conventional fraud tactics.
Robert Capps, VP, business development, NuData Security, said: “Analysing the information discovered from our Trust Consortium of data, it is clear that attackers are rapidly evolving their methods to more complex and evolved schemes. Organisations must be ever vigilant as fraudsters leverage the mass of freely available data on the dark web for cyber crime. Expecting consumers to maintain strong, non-reused passwords isn’t realistic, meaning retailers need to shoulder an even larger responsibility to protect their brand and users. This is why it is more important than ever for online merchants to employ technology that can help them effectively differentiate good customers from bad.”
