The Cybercrime Story of 2017: A Power Struggle Intensifies

Posted January 17, 2018

In the wake of yet more large-scale data breaches throughout 2017, the battle against cybercrime has intensified to unprecedented levels. As downstream fraud and identity abuse attacks increase, investments from digital businesses in cutting-edge approaches to protect consumers and grow online revenue also rises. Insight into emerging criminal tactics in order to invest in the most effective mitigation strategies has never been more crucial.

2017 saw a record 700 million attacks on consumer transactions detected and stopped in real time on the ThreatMetrix network, which sees 100 million daily transactions across the globe. Analysis of this volume of cybercrime attacks provides insight into the latest trends, as set out in the ThreatMetrix Cybercrime Report 2017: A Year in Review.

Enlightening Trends

Cybercriminals are opportunists, always looking for maximum financial gain. So, they are continually on the hunt for new ways to target the channels that have become most popular with consumers.

For example, as consumers continue to user mobile devices more frequently — with more than half of all transactions now coming from mobile devices compared with 45 percent at the beginning of 2017 — cybercriminals look to mimic this user behavior with ever more complex attack patterns that are designed to appear more like legitimate customer traffic.

Overall, the number of cyberattacks grew each quarter during the year, and have increased more than 100 percent during the past two years. This increase can be attributed, in part, to the deluge of high-profile data breaches that continued to make headlines throughout the year. A sharp spike in attacks can be seen in the period immediately after a breach as cyber-thieves use bot attacks to test identity credentials.

As a result, the number of bot attacks reached record levels in Q4 2017, and will continue to increase with each new data breach as fraudsters take advantage of what amounts to a data refresh.

Consumer Impact

While the spotlight tends to shine on businesses in the wake of a cyberattack, consumers are not free from the devastating effects of these attacks. Some of these include:

New account creation: Good consumers can get caught in the net as businesses attempt to prevent fraud, often introducing more friction and lengthier identity verification processes.

Account takeover: Many victims face financial losses that takes a long time to recoup. And, it is often not possible to get a new credential every time an account is taken over, resulting in a long-term ripple effect for the victim.

Payment fraud: Credit card merchants and banks are mostly expected to reimburse victims of fraud. However, it can be a long and laborious process to secure a fraud rebate, and can end up leaving victims out of pocket.

Fertile New Ground

Technological advances have spurred an explosion of new businesses that are capitalizing on the real-time, global and dynamic nature of online transactions to capture market share — disrupting, and giving rise to, entire industries.

However, the same technology that makes these new businesses ever so appealing to today’s want-it-now consumer makes them vulnerable to cyberattacks.

Case in point: the growth of the rideshare economy, which has transformed a traditional business model into a mobile-first, competitive digital industry. But, cybercriminals have developed a form of ridesharing fraud using a “fake driver” account to go with a “customer” using stolen credentials.

Meanwhile, online remittance has facilitated fast, efficient worldwide money transfer, while instant shopping loans and P2P lending have brought the convenience of online shopping to the unbanked and underbanked population. However, fraudsters continually attempt to take out fraudulent shopping loans or hijack trusted user accounts by using one device with multiple different email addresses.

And, then there’s that holiday favorite — gift cards, which has seen an inordinate amount of fraudulent new account creations and account takeovers as cybercriminals attempt to monetize stolen credit cards or steal account credits.

Securing 2018 and Beyond

The increasing frequency and sophistication of attacks means businesses can no longer rely on the status quo to deal with an ever-changing enemy. The need for investment in advanced technologies to protect consumers, including individuals with breached identity and financial credentials, has never been more important.

Analyzing transactions based on the ever-changing associations between people, their devices, accounts, locations and addresses across the businesses with which they interact is the most effective way to instantly differentiate between legitimate users and cybercriminals.

And businesses need to do this in real time, without impacting transaction speeds or introducing unnecessary friction. By looking beyond static data — and drilling down to the dynamic intricacies of how people transact online — companies can securely grow their digital businesses in 2018 and beyond.

To learn more, download the ThreatMetrix Cybercrime Report 2017: A Year in Review.

Originally published at www.threatmetrix.com on January 17, 2018.