The Growing Problem of Online Fraud
Online criminals have become organized and have adopted increasingly sophisticated methods, including phishing and ‘man-in-the-middle’ attacks aimed at circumventing traditional online safeguards and security measures. Financial institutions offering Internet based services to hundreds of thousands of their customers have come under an intensive assault because of the relatively low level of effort required to capture potentially lucrative rewards for successful attacks.
In addition, the UK Faster Payments Initiative takes effect in November 2007, which removes the current three-day window in which banks are able to identify and stop fraudulent transactions for cash transfers. While benefiting business and consumers, this initiative will require new techniques and tools to stop fraud before the funds leave the institution. There is a low recovery rate for money from fraudulent transactions once the funds have been transferred.
Most online fraud today is tied to identity theft that is the result of phishing and luring customers to fake sites. These attacks require direct customer involvement. However, the fraudsters have not yet fully exploited all the techniques they could use and the real worry is Spyware, which could capture credentials or do transactions with no involvement from customers.
Even worse, fraudsters today have a business process with distinct steps (development, test, phishing, capturing credentials, testing credentials, recruiting mules who do the actual fraud, sharing the profits). Fraudsters also collaborate and share tools and techniques among themselves and the attacks evolve and adapt rapidly to circumvent prevention measures.
Financial institutions need to protect the customer experience to ensure that the convenience and accessibility advantages of the online channels remain compelling. Draconian security measures will drive customers away. Detection and prevention solutions need to strive for a ‘zero touch’ approach that does not significantly affect the consumer.
Also, the individual user must be considered. What is ‘normal behaviour’ for one customer would be highly suspicious for others. The profile of a customer who travels widely and manages high value payments is very different from one who stays home and pays the bill once a week.
While customer education and strong authentication are a key part of fraud prevention, understanding exactly what is happening with transactions in the various channels is fundamental. Transaction monitoring is the key to obtaining this visibility and assessing the risk associated with any transaction. A good fraud monitoring solution should be aware of the normal behaviour of individual users to detect anomalies and avoid false detection. Likewise, transaction monitoring should not affect user experience except when the risk of a given transaction is high.
Fraud detection rules should be able to consider common attack scenarios in addition to user behavior. For example, are there logins from the same computer to multiple users within a given time frame? Furthermore, are those users changing their confirmation email address and then transferring large sums to the same external account? Is the attack split between the online and voice channels?
The solution should be able to determine, in real-time, the risk associated with each of these factors. Integration between the fraud detection solution and the application authentication system is important. The transaction risk can then be used to determine if a transaction should be allowed to proceed, if additional authentication is required or if it should be blocked. This risk-based authentication method for login and high-value transactions can stop fraud before the money leaves the institution.
The ability to adapt these rules to rapidly evolving threats is also critical. The ability to consider new types of transactions and new conditions and roll out updated rules in minutes can mean the difference between stopping a new attack cold or suffering substantial losses from it.
Fraudsters tend to apply any attack that has proven successful across many financial institutions. In addition they tend share these techniques within the criminal community. In the same way, financial institutions need to collaborate on fraud prevention. Sharing fraud behaviors and fraud incident data is a new and essential tool to combat fraud.
New types of fraud are often detected only when a customer reports it. Having the transaction history data available within the institution with tools for forensic analysis can be key to verifying a fraud case, identifying the attack pattern used and finding other users who may have been affected. Once the attack pattern is identified, new detection rules can be immediately deployed to defend against it.