Internet fraud prevention is the act of stopping various types of internet fraud. Due to the many different ways of committing fraud over the Internet, such as stolen credit cards, identity theft, phishing, and chargebacks, users of the Internet, including online merchants, financial institutions and consumers who make online purchases, must make sure to avoid or minimize the risk of falling prey to such scams.[1]
The speed and sophistication of the online fraudulent actors continues to grow.[2] According to a 2017 study conducted by LexisNexis, $1.00 lost to fraud costs organizations (merchants, credit card companies and other institutions) between $2.48 to $2.82 – "that means that fraud costs them more than roughly 2 1⁄2 times the actual loss itself."[1]
Three constituencies have a direct interest in preventing Internet fraud. First, there is the consumer who may be susceptible to giving away personal information in a phishing scam, or have it be acquired by rogue security software or a keylogger. In a 2012 study, McAfee found that 1 in 6 computers do not have any sort of antivirus protection, making them very easy targets for such scams.[3] Business owners and website hosts are also engaged in the ongoing battle to ensure that the users of their services are legitimate. Websites with file hosting must work to verify uploaded files to check for viruses and spyware, while some modern browsers perform virus scans prior to saving any file (there must be a virus scanner previously installed on the system).[4] However, most files are only found to be unclean once a user falls prey to one. Financial institutions, such as credit card companies, who refund online customers and merchants who have been defrauded also have a strong interest in mitigating Internet fraud risk.[5][1]
History
Internet fraud began appearing in 1994 with the start of e-commerce. The first trend to be seen was the use of "Famous Names" to commit the fraud. Using this method, the person committing the fraud would use stolen credit cards with the popular celebrity of the time's name. This highly unsophisticated plan was only successful because the internet was new and the possibility of fraud had not been considered. Eventually internet merchants implemented rules to confirm the card user name.
Following the "Famous Names" strategies were more technical attacks in which hackers created card-generator applications that came with real credit card numbers. Attacks such as these were commonly targeted toward the same vendor. Merchants had no way to see cross-merchant activity until the credit card associations reported it. After 1996 fraudulent users went on the internet to test the status of stolen credit cards.
By 1998, the internet was filled with e-commerce sites. Fraudsters began to set up "dummy" merchant sites where they could harvest their own credit cards through their own site. Before the charge-backs rolled in, they would shut the doors of the website and leave the country. Soon a trend started of the mass theft of identities from the internet through information provided online under the Freedom of Information Act. One of the counter-methods merchants developed was the use of consumer accounts. The merchant would set up a consumer account the first time the consumer made a purchase. Following the creation of the new account, the merchant would perform a series of third-party checks to validate the information provided by the consumer.
As auction sites like eBay and uBid gained popularity, new fraud methods arrived specifically targeting this new merchant community. From selling bogus goods to misleading the consumer, the fraudsters continued to take advantage of consumers.[6]
Credit card fraud
Credit card fraud is the unauthorized use of a credit card to make a transaction. This fraud can range from using the credit card to obtain goods without actually paying, or performing transactions that were not authorized by the card holder. Credit card fraud is a serious offense, and punished under the charge of identity theft. The majority of this type of fraud occurs with counterfeit credit cards, or using cards that were lost or stolen. Approximately .01% of all transactions are deemed fraudulent, and approximately 10% of Americans have reported some type of credit card fraud in their lifetimes.[7]
While many systems are in place by the card provider to identify fraud, the card holder is left with the ultimate responsibility. Preemptive steps to reduce chances of fraud include installing anti-virus software, keeping and maintaining current records, and reviewing statements and charges regularly. The objective is to provide a first defense in spotting fraudulent charges. Exercising caution on online sites, especially suspicious or non-established sites, as well as in foreign countries is also advisable. The legitimacy of websites should be verified. Checking with the Better Business Bureau is a first step to see how that company has established themselves. Once on a website, the user can check what security or encryption software the website utilizes. A padlock to the left of the URL, can sometimes be found to signify additional security is being implemented. A physical address for the company, or sending an email to one of the contact addresses can further verify the reliability of the company.[8] Even on trusted sites, it is important to be diligent that one has not navigated away from that site. Other safe practices include being cautious of account number distribution, keeping credit cards separate from a wallet or purse, keeping constant sight of credit cards, and drawing lines on blank spaces above the total on receipts. On accounts in which one has saved card information, it is important to have a strong password with a mix of numbers and symbols. Using different passwords for different sites, is also strongly encouraged.[9]
If a card is lost or stolen, the card holder must report it immediately, even if no fraud has been detected yet. Once a card is reported lost or stolen, the card-holder is not responsible for erroneous charges.[10]
Identity theft
Identity theft, also called identity fraud, is a crime in which someone steals and uses another person's personal information and data without permission. It is a crime usually committed for economic gain. Stolen personal data includes Social Security Number's (SSN), passport numbers, or credit card numbers, which can easily be used by another person for profit. It is a serious crime that can have negative effects on a person's finances, credit score and reputation.
There are three specific types of identity theft aside from the broad term. Tax-related identity theft is when a criminal uses someone else's SSN to get a tax refund or a job. Victim of this type of theft must contact the IRS. Child identity theft is when a criminal uses a child's SSN to apply for governmental benefits, open bank accounts, or apply for a loan. Medical identity theft is when a criminal uses someone else's name or health insurance to see a doctor, get a prescription or other various medical needs.[11]
Fortunately, there are precautions that consumers can take to prevent identity theft. There are simple ways in which to avoid becoming a victim of identity fraud and an easy way to remember them is the acronym SCAM. SCAM reminds us to 1. Be stingy when giving out personal information to others 2. Check financial information regularly and recognize when something strange has occurred 3. Ask for a copy of your credit report often, and 4. Maintain careful financial records. It is necessary to be aware of phishing and to always be cautious of giving your personal information out through e-mail, website or over the phone. Also be sure that the phone number, name and mailing address registered to your bank account is all correct as there are cases in which bank statements have been sent to false addresses and identities have been stolen. Check these bank statements regularly and be sure that there are no charges to your account that you do not recognize.[12]
Individuals experiencing identity theft can take immediate steps to limit the damage to their finances and personal life. The first step is to contact one of the three national credit reporting companies and place an initial fraud alert. This is done by contacting a national credit reporting company, asking them to put a fraud alert on your credit file, and confirming that they will notify the other two companies of this change. The next step is to order free credit reports from each of the three national credit reporting companies. Lastly, report the identity theft to the FTC and print an FTC identity theft affidavit and then file a police report and ask for a copy of the report.
Phishing
Phishing is a scam by which an e-mail user is duped into revealing personal or confidential information which the scammer (phisher) can use illicitly.[13] Communications purporting to be from popular social web sites, auction sites, banks, online payment processors or IT administrators are commonly used to lure unsuspecting public. Phishing emails may contain links to websites that are infected with malware.[14] Phishing is typically carried out by email spoofing or instant messaging, and it often directs users to enter details at a fake website whose look and feel are almost identical to the legitimate one. There are four main type of phishing techniques: link manipulation, filter evasion, website forgery, and phone phishing. Legislation, user training, public awareness, and technical security measures are all attempts to control the growing number of phishing attacks. The damage caused by phishing ranges from denial of access to email to substantial financial loss. It is estimated that between May 2004 and May 2005, approximately 1.2 million computer users in the United States suffered losses caused by phishing, totaling approximately US$929 million. United States businesses lose an estimated US$2 billion per year as their clients become victims.[15]
As early as 2007, the adoption of anti-phishing strategies by businesses needing to protect personal and financial information was low. There are several different techniques to combat phishing, including legislation and technology created specifically to protect against phishing. These techniques include steps that can be taken by individuals, as well as by organizations. One strategy for combating phishing is to train people to recognize phishing attempts, and to deal with them. Education can be effective, especially where training provides direct feedback.[16] People can take steps to avoid phishing attempts by slightly modifying their browsing habits. When contacted about an account needing to be "verified" (or any other topic used by phishers), it is a sensible precaution to contact the company from which the email apparently originates to check that the email is legitimate. Alternatively, the address that the individual knows is the company's genuine website can be typed into the address bar of the browser, rather than trusting any hyperlinks in the suspected phishing message.
Nearly all legitimate e-mail messages from companies to their customers contain an item of information that is not readily available to phishers. It is up to the customer to use his or her discretion to separate genuine emails from phishing emails and prevent phishing attacks.[17] The Anti-Phishing Working Group, an industry and law enforcement association, has suggested that conventional phishing techniques could become obsolete in the future as people are increasingly aware of the social engineering techniques used by phishers. They predict that pharming and other uses of malware will become more common tools for stealing information.
Chargebacks
A chargeback is not necessarily a fraudulent activity. In its most basic sense, a chargeback is when an issuing bank, a bank where consumers acquire credit cards, reverses a prior charge from a bank account or credit card at the request of a cardholder because there was a problem with a transaction. The problem could be anything from a situation where the consumer did not receive the product they purchased,[18] to one where the cardholder was not satisfied with the quality of the product, to a situation where the cardholder was a victim of identity theft.[19] The concept of a chargeback rose as a measure of consumer protection taken by issuing banks and credit card companies. Chargebacks were a measure to protect cardholders from identity theft and the unauthorized transitions from identity theft. Chargebacks also provide incentive to producers and sellers to provide products of consistent quality and efficient customer service.
With the rise of technology,[20] and the resulting increase in online and telephone transactions and commerce, it has become easier to commit fraud via chargebacks. Chargebacks are an interesting concept because the process protects consumers from identity theft fraud, but opens the door for consumers to commit chargeback fraud. Chargeback fraud is also known as "friendly fraud." Friendly fraud is the term for when a consumer authorizes a transaction for an online purchase on his or her credit card, receives the product or products the consumer paid for, but then later the same consumer files for a chargeback.[18] The fraudulent filing for a chargeback results in a consumer keeping and avoiding paying for the products they ordered.
There are several common cases where a consumer commits so called friendly fraud.[5] One situation is where the consumer claims that they never received the purchase or order when in reality, they did. In this scenario, when a customer files a chargeback, it enables the customer to keep the product while not paying for the product.[19] Another situation is where a customer claims that the product they received was either defective or damaged. In this scenario, a chargeback claim facilitates the customer to get a "two for one" deal because the producer will ship a replacement product. Finally, another common situation is where the customer buys a product, but then files a chargeback with their issuing bank claiming they never authorized such a transaction.[21]
Producers and merchants have responded to the rise of fraudulent chargeback claims and have implemented measures to combat friendly fraud. Chargeback fraud is challenging because the vendor's first reaction is to tighten internal fraud controls and add anti-fraud software tools. While this reduces fraud, it also prevents many legitimate customers from completing online purchases.[5] In addition, it is difficult for merchants to protect against friendly fraud chargebacks because the chargeback process often favors the consumers over the producers.[21] One of the best ways to prevent friendly fraudsters is for online merchants to require signatures for the delivered packages upon their arrival. This will provide very specific information to the producers about the delivery. The drawback to signature confirmation is that it increases shipping costs, which still hurt producers' bottom line.[21] In addition, producers have started to share data of lists of customers who make chargeback claims. This helps producers see trends of customer's shopping habits.[21] This transfer of information among producers helps them maximize profits and forces consumers to stay honest. Producers have also started keeping a record of all communication with customers, so customers who want to file fraudulent chargebacks have a harder time following through with the claim. Finally, e-commerce sites have started to keep track of customer's IP addresses, so when consumers make a claim that they did not make a purchase, it is much harder to lie.[19]
Although chargeback fraud is a problem with the growth of e-commerce and other alternative shopping outlets[20] with dishonest consumers, many consumers who file chargeback claims are honest and have encountered a real problem with their transaction. In some cases, chargebacks can be reduced by implementing more refined tracking tools to measure reasons for returns and employing more live customer service personnel and improving their training.[5]
FBI response
In May 2001, Deputy Assistant Director of the FBI, Thomas T. Kubic, gave a testimony to the House Committee on the Energy and Commerce, Subcommittee on Commerce, Trade, and Consumer Protection on the FBI's response to Internet fraud crimes. Alongside the U.S. Postal Inspection Services, U.S. Customs Service, Internal Revenue Service-Criminal Investigative Division, and the United States Secret Service, the FBI has developed the "Operation Cyber Loss" program to combat Internet fraud. The agency also created the Internet Fraud Complaint Center (IFCC) to help with the operation. The types of fraud that Operation Cyber Loss is investigating are identity theft, on-line auction fraud, credit/debit card fraud, investment and securities fraud, Ponzi/Pyramid schemes, and non-delivery of merchandise purchased over the Internet.[22]
Mitigating the Risk of Internet Fraud
Businesses selling goods and services online bear a large portion of internet fraud costs—according to the 2017 LexisNexis study, fraud costs as a percentage of revenues for online retail (physical goods) and eCommerce (digital goods) are 2.17% and 2.39% respectively, with online gift card fraud being an area of special concern.[1]
Relying on fraud detection software alone has been found to flag too many legitimate transactions as fraudulent:[2] online purchases are either blocked outright or delayed for review such that the customer abandons the purchase.[5] One approach that has been found successful in reducing the number of "false positives" while still reducing fraud is a "layered" filtering. This technique employs fraud detection software based on algorithms and AI/machine learning, combined with manual review by customer service personnel. Real-time fraud detection supplied by software-as-a-service (SaaS) fraud detection firms includes verifying CVV, PIN/signature, check verification, browser malware detection, address verification, device ID fingerprinting, geolocation, authentication by quizzes, cross-checking shared data bases of customer profiles, automated transaction scoring, rules-based filters and other data points.[1]
In response to the prevalence of online fraud, many fraud detection and prevention software service companies have entered the field, employing a variety of techniques, including machine-learning-based behavior analytics and anomaly detection; the use of a "fraud hub" that enables third-party data sources to feed in purchaser information that is used in predictive statistical modeling; and automated remote malware detection. The largest players in this area are Cybersource (owned by Visa), Brighterion (Mastercard), and SAS Institute. Some of the newcomers in the field include Fraudio, Signifyd, Eye4Fraud, Kount, Riskified, Sift Science, Forter and Feedzai.[2]
Related Research Articles
Identity theft, identity piracy or identity infringement occurs when someone uses another's personal identifying information, like their name, identifying number, or credit card number, without their permission, to commit fraud or other crimes. The term identity theft was coined in 1964. Since that time, the definition of identity theft has been legally defined throughout both the U.K. and the U.S. as the theft of personally identifiable information. Identity theft deliberately uses someone else's identity as a method to gain financial advantages or obtain credit and other benefits. The person whose identity has been stolen may suffer adverse consequences, especially if they are falsely held responsible for the perpetrator's actions. Personally identifiable information generally includes a person's name, date of birth, social security number, driver's license number, bank account or credit card numbers, PINs, electronic signatures, fingerprints, passwords, or any other information that can be used to access a person's financial resources.
Phishing is a form of social engineering and scam where attackers deceive people into revealing sensitive information or installing malware such as ransomware. Phishing attacks have become increasingly sophisticated and often transparently mirror the site being targeted, allowing the attacker to observe everything while the victim is navigating the site, and transverse any additional security boundaries with the victim. As of 2020, it is the most common type of cybercrime, with the FBI's Internet Crime Complaint Center reporting more incidents of phishing than any other type of computer crime.
Bank fraud is the use of potentially illegal means to obtain money, assets, or other property owned or held by a financial institution, or to obtain money from depositors by fraudulently posing as a bank or other financial institution. In many instances, bank fraud is a criminal offence.
Internet fraud is a type of cybercrime fraud or deception which makes use of the Internet and could involve hiding of information or providing incorrect information for the purpose of tricking victims out of money, property, and inheritance. Internet fraud is not considered a single, distinctive crime but covers a range of illegal and illicit actions that are committed in cyberspace. It is, however, differentiated from theft since, in this case, the victim voluntarily and knowingly provides the information, money or property to the perpetrator. It is also distinguished by the way it involves temporally and spatially separated offenders.
Email fraud is intentional deception for either personal gain or to damage another individual using email as the vehicle. Almost as soon as email became widely used, it began to be used as a means to defraud people, just as telephony and paper mail were used by previous generations.
An e-commerce payment system facilitates the acceptance of electronic payment for offline transfer, also known as a subcomponent of electronic data interchange (EDI), e-commerce payment systems have become increasingly popular due to the widespread use of the internet-based shopping and banking.
A chargeback is a return of money to a payer of a transaction, especially a credit card transaction. Most commonly the payer is a consumer. The chargeback reverses a money transfer from the consumer's bank account, line of credit, or credit card. The chargeback is ordered by the bank that issued the consumer's payment card. In the distribution industry, a chargeback occurs when the supplier sells a product at a higher price to the distributor than the price they have set with the end user. The distributor submits a chargeback to the supplier so they can recover the money lost in the transaction.
A spoofed URL involves one website masquerading as another, often leveraging vulnerabilities in web browser technology to facilitate a malicious computer attack. These attacks are particularly effective against computers that lack up-to- security patches. Alternatively, some spoofed URLs are crafted for satirical purposes.
Chargeback fraud, also known as friendly fraud, cyber shoplifting, or liar-buyer fraud, occurs when a consumer makes an online shopping purchase with their own credit card, and then requests a chargeback from the issuing bank after receiving the purchased goods or services. Once approved, the chargeback cancels the financial transaction, and the consumer receives a refund of the money they spent. Dependent on the payment method used, the merchant can be accountable when a chargeback occurs.
3-D Secure is a protocol designed to be an additional security layer for online credit and debit card transactions. The name refers to the "three domains" which interact using the protocol: the merchant/acquirer domain, the issuer domain, and the interoperability domain.
Identity fraud is the use by one person of another person's personal information, without authorization, to commit a crime or to deceive or defraud that other person or a third person. Most identity fraud is committed in the context of financial advantages, such as accessing a victim's credit card, bank accounts, or loan accounts. False or forged identity documents have been used in criminal activity or in dealings with government agencies, such as immigration. Today, the identities of real persons are often used in the preparation of these false documents. This can lead to bad consequences and trouble.
Voice phishing, or vishing, is the use of telephony to conduct phishing attacks.
Chargeback insurance is an insurance product that protects a merchant who accepts credit cards. The insurance protects the merchant against fraud in a transaction where the use of the credit card was unauthorized, and covers claims arising out of the merchant's liability to the service bank.
Credit card fraud is an inclusive term for fraud committed using a payment card, such as a credit card or debit card. The purpose may be to obtain goods or services or to make payment to another account, which is controlled by a criminal. The Payment Card Industry Data Security Standard is the data security standard created to help financial institutions process card payments securely and reduce card fraud.
A credit card is a payment card, usually issued by a bank, allowing its users to purchase goods or services or withdraw cash on credit. Using the card thus accrues debt that has to be repaid later. Credit cards are one of the most widely used forms of payment across the world.
A card-not-present transaction is a payment card transaction made where the cardholder does not or cannot physically present the card for a merchant's visual examination at the time that an order is given and payment effected. It is most commonly used for payments made over the Internet, but can also be used with mail-order transactions by mail or fax, or over the telephone.
A card security code is a series of numbers that, in addition to the bank card number, is printed on a credit or debit card. The CSC is used as a security feature for card not present transactions, where a personal identification number (PIN) cannot be manually entered by the cardholder. It was instituted to reduce the incidence of credit card fraud.
Between 2016 and 2021, multiple prepublication manuscripts were stolen via a phishing scheme that investigators believed were conducted by an industry insider or insiders. In 2022, the FBI arrested Filippo Bernardini, a 29-year-old Italian citizen living in London and working for Simon & Schuster.
1 2 3 4 5 Carlin, Patricia (February 15, 2017). "How To Reduce Chargebacks Without Killing Online Sales". Forbes. Retrieved 2 July 2018. Unfortunately, this leads to overly strict fraud filters, redundancies in fraud tools, and ultimately an increase in cost per transaction and a decrease in sales.
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
