Kevin Gosschalk, Arkose Labs, believes that 'if there is one thing we can attribute to the hackers of 2019, it is the end of any pretense that personal information is secure online'
We have seen a steady stream of major data breaches, with Forbes estimating that 4.1 billion records were compromised in the first six months of the year alone. No industry has escaped unscathed, and your digital identity is likely to have been compromised whether you have applied for a credit card, ordered food through a delivery app, bought cosmetics online, played video games or you were born in the country of Ecuador. And the list could go on.
Arkose Labs’ customers see surges in automated bots attacks hitting digital commerce sites and apps in the wake of major data breaches, with fraudsters primarily using fake account registrations to test stolen credentials at scale. Verified credentials are then used to launch more sophisticated human-driven account takeover attacks, often targeting lucrative banking and payments transactions.
We have entered a new age, where fraudsters have the ability to mimic trusted customer behavior with unnerving accuracy – leveraging stolen credentials, spoofing digital identifiers and exploiting intel on individual transactional habits, obtained by unauthorised access to online accounts.
Detailed knowledge of the parameters used by data-driven fraud detection systems is informing fraudsters of the characteristics they need to spoof or disguise, and we are seeing a rise in single request attacks, which synthetically manipulate each request to obfuscate IP addresses and mimic legitimate consumer fingerprints.
Due to unpredictable consumer behaviour and these advanced tactics from fraudsters, there is a growing grey area in fraud detection – in between the clear cut cases that are flagged as either trusted or suspicious. Uncertainty leads to a certain tolerance of existing levels of fraud, in order to avoid interfering with too many potentially good customers using more thorough checks.
However, this means that many consumers end up with their accounts hacked, and are left with the headache of trying to reclaim their losses and ensure their digital presence is made secure once again. Additionally, tolerance of fraud actively feeds the vicious cycle of successful cybercrime, as this provides the financial incentive for fraudsters worldwide to continue and expand their operations, and gives them the opportunity to learn from past attempts and replicate attacks elsewhere.
An entire shadow ecosystem has sprung up in support of global fraud, including identity farms, which create synthetic identities and test stolen credentials, click-farms and sweatshops, which provide humans to carry out nuanced attacks, and ‘arms dealers’ selling toolkits.
These cybercrime outfits exist because there is relatively easy money to be made with little-to-no risk. The fraudsters’ business model leverages global economic disparities in income and currency strengths, which incentivise individuals to get involved in cybercrime, and provide access to cheap resources.
Fraud levels will continue to rise indefinitely unless we can disrupt fraud to the point that it ceases to be a lucrative option for cybercriminals – no matter where they are in the globe.
