Magazine menu Close Magazine menu

fraud

Latest stories

lighting up dark web, fraud, low enforcement

How police identify criminals selling data on the dark web

  • min read
    • In the north of England, a team of officers are getting creative. They're finding ways to identify criminals selling personal data, fake COVID-19 vaccines and child sexual abuse images on the dark web. Tomorrow Unlocked's film Lighting up the Dark Web follows the UK's Yorkshire and Humber Regional Cybercrime Unit (RCCU) in their quest to unmask a crime ring selling personal data for fraud. What is the dark web? The dark web is a network of computers where web traffic is anonymized. Many use it to access marketplaces and other sites to commit crime. The dark web can also be used for good. Dissidents, whistleblowers and investigative journalists use it to communicate anonymously online, and others use it to avoid online data collection. The sale of personal data is big business on the dark web. The US's Federal Trade Commission reported consumers lost nearly $8.8 billion US dollars to scams in 2022. Linking dark web identities and real-world people In 2014, a trader called Data Pro was selling National Insurance numbers, dates of birth, credit card numbers and more on the dark web marketplace Evolution. RCCU suspected the source was a UK-based business. RCCU used 'slips' – when Data Pro occasionally used identifiable information – to link his clear web and dark web identities. How businesses can protect themselves from dark web criminals While the dark web seemed impossible to control in the past, law enforcement is now getting ahead. Businesses can also act to give fraudsters less opportunity to make dark web profits out of their data. First and foremost, protect your business's data from being stolen with strong data security practices, including encrypting your data and educating employees on how to avoid accidentally giving cybercriminals access. Your people are your most important security feature because most breaches start with basic errors like clicking a link in a rogue email or giving login details to someone who isn't who they said they were. If your data is already stolen and ends up on the dark web, dark web monitoring services like Have I Been Pwned may help you identify a breach and alert those whose information was stolen faster. As law enforcement becomes more cyber savvy, there are fewer places for cybercriminals to hide. Increasing international cooperation is also helping light up the darkest parts of the web. Businesses also have a part to play by reducing the opportunities for their data to be stolen and sold.
fraud prevention social engineering

Financial fraud by social engineering: How humans get hacked and how business can stop it

  • min read
    • A security system is only as strong as its weakest link. And when it comes to cyberfraud, the weakest link is all around you: People. The easiest way for a fraudster to get what they want is to manipulate someone into giving it to them. For example, using a ruse to convince someone to give out their username and password. These 'hacking a human' techniques are known as social engineering. And this threat is on the rise: In 2018, 97 percent of thefts from personal bank accounts and 39 percent from organizations were breached using social engineering techniques. To protect businesses and their customers from financial fraud, business leaders should learn about social engineering and how to prevent it. Detecting social engineering with technology There's no guaranteed technology to detect a social engineering attack. You can use technology to detect behavior anomalies or prevent incubation when malware is installed, but a person is not a robot. Human behavior crosses a wide spectrum. Attackers collect information about their target. Many people publish enough about themselves on social networks to facilitate fraud, like a photo of a passport, driver's license or air tickets. When using trading websites like eBay, buyers sometimes receive sellers' phone numbers or email addresses. A phone number can reveal at which banks someone holds accounts. Once they have information about their target, fraudsters use every available technology to make themselves more convincing. Social engineering and new technologies Fraudulent fraud warnings One recent, common fraud scheme has seen customers believing they're talking to an employee of their bank who is calling to help cut their bank fees or, ironically, warn of fraud on their account. The criminal uses automated Interactive Voice Response (IVR) technology, asking customers to spell their username and password, then prompts the customer to install an app on their phone. The app lets the criminal remotely access their device. With remote access, the fraudster can transfer money, steal personal data to sell on and apply for loans. As detailed in our 2019 Fraud Prevention Report, Kaspersky Fraud Prevention identified more than 3,000 sessions a month using such remote tools on the network of a major bank. We used behavior analysis and behavioral biometrics to detect these suspicious activities, quickly warning banks, e-commerce and similar service platforms. Using faith in robot voices An insight scammers rely upon is the human tendency to think prerecorded messages and robot voices are more trustworthy. Using IVR, they try to get the customer's second authentication factor data for two-factor authentication. Prerecorded voice messages ask the victim to enter a code received in a text message or push notification. Because the second factor is time sensitive, as soon as the client keys in their code, the scammer immediately transfers funds to their own account. Unfamiliar numbers are getting familiar Banking customers are now used to receiving bank-related calls from third parties contracted by their bank. Callers may introduce themselves as financial agency employees, merchant acquiring or soft collection. Fraudsters know people are suspicious of unfamiliar numbers, but they can use technology to replace part of their phone number with digits from a bank's phone number or display vanity numbers. Fraud against businesses: Two common scenarios Although these kinds of fraud attempts are common, they often follow predictable patterns. These two scenarios are commonly used to target business employees using social engineering. Scenario 1: The rescuer Rescuers are criminals that act as security experts and act out a "rescue." Posing as security officers, they might call bank customers to notify them of suspicious debits or payments and offer help. First, they ask the client to verify their identity by a code sent in a text message or push notification. The pretext may be validating the client, blocking a suspicious transaction or transferring funds to a secure account. If the target shows lack of trust, the fraudster may try using IVR or remote device connection to gain a second authentication factor. Scenario 2: The investor The investor scenario involves fraudsters posing as employees of an investment company or investment consultants from a bank. They call clients, offering the chance to invest in cryptocurrency or corporate equity without having to go to a branch office. As a prerequisite for providing the service, the investor asks the target for the code received in a text message or push notification, using similar tools to those of the 'rescuer' scenario. Fraudsters use the investor scenario on victims whose data was acquired by showing interest in boosting their savings. How businesses can prevent social engineering cyberfraud Social engineering is common, and humans are fallible. But organizations can make it harder for cyberfraudsters to exploit their employees. Use awareness training to raise your employees' awareness of what social engineering is. It benefits them at work, but also in their personal and family lives. Give examples and aim to make it fun and interesting, rather than scary. When your business or your contracted security experts conduct penetration tests, make sure social engineering is part of the testing. Put systems in place to prevent internal fraud. Analyze employee behavior, identifying anyone trying to harm the business as well as those being targeted with social engineering. You should also use fraud-detection solutions within your digital service channels. Your employees will always be vulnerable to cyberfraud through social engineering. Cyberfraudsters will keep using the latest technology to manipulate people, and attacks will become more sophisticated. Understanding how social engineering works and staying up-to-date on what cyberfraudsters are doing is a strong way to defend your business.
cyber fraud prevention

What’s changing in cyberfraud and how to keep your business safe

  • min read
    • Today, ecommerce is a basic need. Customers expect speed and convenience, and the 2020 coronavirus lockdowns have only accelerated that demand. Swimming in that tide that raises all boats, Kaspersky's fraud prevention: 2019 report notes a growing number of sharks. One in 50 online financial and ecommerce sessions worldwide are conducted by cybercriminals. As fast as online service technology evolves, fraudsters find loopholes. We're at a crucial point of change in combatting new hacking tools and fraud schemes. So what's changed, and what's changing? Bots fake loyalty Ecommerce customers often receive bonuses as part of loyalty programs, such as for registering, giving reviews and referring friends. With bots, fraudsters create numerous fake accounts and receive bonuses just as real users do. The fraudster then uses the bonuses to buy goods at a big discount for resale. Bots are taking the best seats Research by Distil Networks estimates some 40 percent of traffic to ticket sales sites comes from bots. Fraudsters buy gig, show and sports event tickets with bots, reselling on social media, peer-to-peer sites or ticket resale sites when the event is sold out. This means fans are finding it harder to get tickets and end up paying more. Crawlers are copying prices and photos Cyberfraudsters also use web crawler bots (used legitimately by search engines to give accurate results to search queries) to "crawl" ecommerce competitor websites, recording pricing and making theirs more competitive. They may also steal unique content like images and product descriptions to use on their website, damaging the search rankings of the original website because search engines penalize sites with duplicate content. Bots are getting more like us In 2019 a new generation of "human bots" emerged, designed to mimic human behavior impeccably. Previously, bots moved around web pages in repetitive and simple navigation patterns. The new-generation "human bots" do things humans do, like shake the mouse and make rapid movements. This new human-like behavior is a problem for anti-fraud systems. So far, many have relied on these human foibles to tell bot from human. How fraudsters manipulate The easiest way for fraudsters to attack online businesses is through customers. They use manipulative strategies known as social engineering. They either scare people or earn their trust to get credentials like logins and passwords, and other personal information. Imagine you get a call from someone saying they're with the security department of an ecommerce site you visit. They say someone has tried to buy a high-value item with your credit card and that to stop the transaction, you must download an authentication app. It's a fraudster, of course. The app grants remote access, mirroring the screen of your device and letting the fraudster steal personal information like your full name, address or social security number. They then sell your personal information on the dark web, opening doors to all kinds of fraud, like using your name and bank account to apply for loans. Remote access tools (RATs,) used legitimately by IT support teams in many organizations to access your computer screen to resolve issues, are a powerful tool for fraud in the wrong hands. Fraudsters often target accountants because they work with payment orders. The fraudster accesses the victim's screen without their knowing and substitutes bank details for their own. You may recognize the methods employed in these growing attacks. Some are not new. Here are three emerging cyberfraud trends. Trend 1: Fraud as a service Cybercrime is an easy way to make money without leaving home. This has led to rapid growth in 'fraud as a service (FaaS.)' FaaS makes internet fraud less challenging for newcomers, and so increases the number of people involved. On dark web forums, illegal websites or social media, anyone can buy a set of hacking tools and a leaked customer database, then pay for training on how to make illegal money. Costs range from just 5 US dollars for stolen credit card data, to thousands of dollars for extensive fraud execution courses. The market is booming. Underground digital markets sell bots, digital fingerprints for remotely accessing devices and anonymizer tools that make internet activity untraceable. Trend 2: Resale of bank account access Cybercriminals often target small- to medium-sized businesses (SMBs) in finance who've been acquired by large players, while they adjust their security to meet the buyer's requirements. Kaspersky found, by analyzing dark web forums and chats, criminal groups target these smaller organizations, then resell access to both organizations' internal networks. They predict an increase in this kind of activity, especially in Africa, Asia and Eastern Europe. Trend 3: Data leaks and deepfakes We all love convenient and quick purchases like Amazon's 1-click ordering, despite that these methods usually mean saving and sharing more of our personal information. Yet, a month can't pass without a high-profile data breach from a bank, online store or telecommunications company. Sometimes sensitive personal customer data is exposed, such as biometrics. We're also seeing the rise of impersonation methods where one person's image is replaced with another, using advanced audio, photo and video editing, known as deepfakes. Fraudsters have already used deepfake voice imitation and social engineering to impersonate a CEO successfully. The best ways to protect your business from today's fraudsters These six steps will help your business put in place the strong front against cyberfraud. 1.    Assess risks With growth, or any kind of change in business, comes the possibility of new risks of fraudulent activities. Make sure identifying opportunities for fraud is part of your risk assessment activity. 2.    Review product design Look at the design of your digital services and loyalty program from a fraudster's point of view. Try to find 'loopholes' they could exploit. 3.    Use a fraud detection and prevention system These systems may, for example, analyze online sessions, monitor transactions and analyze payment behavior. They help avoid the financial, reputational and legal consequences of fraud and cut operational costs, such as support team time. 4.    Strengthen your security Put detection and protection measures in place, such as using a web application firewall (WAF) to protect against bots and a solution to protect against Distributed Denial-of-Service (DDoS) attacks. 5.    Strengthen your team Make sure your employees understand how fraud happens and how to combat it by including cyberfraud in your cyberawareness training program. 6.    Record fraud Measure what your business is losing through fraud regularly. Include direct loss, indirect loss and the impact on your brand reputation. If fraud hits your business, hire a fraud expert team to support you through and help you combat future incidents. By taking these steps, you can reduce the risk of cyber fraud affecting your business and make the most of the opportunities the rise of ecommerce brings.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries