By Jason Tan, CEO, Sift Science
Online businesses everywhere are going to be dealing with the effects of data breaches in the post-Equifax breach era. It’s a tough truth to swallow, but these large-scale data breaches have become a fact of life – and it’s not just the breached business that pays the price. The reality is, even if your company wasn’t breached, you still have a huge challenge on your hands. As fraudsters mine the valuable data that’s been compromised, all e-commerce sites and financial institutions need to be on alert.
The downstream consequence of a major breach is that stolen information is sold on the dark web many times over. Since two-thirds of people use the same login information on multiple sites, when fraudsters get ahold of it, they use these stolen credentials for criminal purposes all over the web. The information may have been stolen elsewhere, but if even a small handful of your customers get their accounts hacked or experience fraud on your site, it’s your company that loses the customer’s trust, and your brand reputation that is at risk.
The new reality that businesses need to accept is that a significant number of their customers have been victims, or soon will be. Because of this, there are important things businesses need to look out for to protect themselves. The trick is not to create a bad experience for customers in the process.
Keep an eye out for signs of account takeover.
Last year, 48% of online businesses saw an increase in account takeover (ATO), according to the Sift Science Fraud-Fighting Trends report. And the growing number of major breaches will only exacerbate this trend, potentially flooding the dark web with names, addresses, Social Security numbers, and other personal information that fraudsters can leverage to gain access to a legitimate user’s account. They then make purchases with a stored payment method or drain value from the user’s account.
Some of the signals that could point to an ATO:
- Login attempts from different devices and locations
- Switching to older browsers and operating systems
- Buying more than usual, or higher priced items
- Changing settings, shipping address, or passwords
- Multiple failed login attempts
- Suspicious device configurations, like proxy or VPN setups
Keep in mind that individually, each of these signs may be normal behavior for a particular user. It’s only when you apply behavioral analysis on a large scale, looking at all of a user’s activity and all activity of users across the network, that you can accurately detect ATO.
Monitor for fake accounts and synthetic identity fraud.
Fraudsters can also take all of the different pieces of personal data leaked in a breach to steal someone’s identity and create new accounts. They may also pick and choose pieces from various people’s accounts – like a birthday, Social Security number, and name – and mix them together to create an entirely new ID.
To keep tabs on fake accounts, you can monitor new signups to look for risky patterns, like a sudden spike in new accounts that can’t be attributed to a specific promotion or seasonal trend. If the average time it takes a new user to sign up suddenly gets much faster, that may point to fraudsters using a script to quickly create accounts. And seeing multiple new accounts coming from the same IP address or device is a red flag for a single person creating many accounts.
Stay focused on maintaining user trust.
Even if a breach doesn’t happen on your site, any downstream fraud attacks still happen on your watch. If you don’t invest in protecting your users from the devastating effects of ATO, identity theft, and fraud, you will soon lose their trust. Trust is earned in drops, but lost in buckets.
At the same time, e-commerce businesses and financial institutions should make sure they aren’t overly cautious to the point where they’re rejecting good customers and denying legitimate accounts. Preventing fraud is a delicate balancing act, and the right technology – which looks at a range of data points to make an accurate prediction about what is and isn’t fraudulent – can help you strike the right balance.
Fight technology with technology.
We are at a point where no one can afford to put their head in the sand when these breaches happen, and that includes marketing leaders. It’s time to develop a healthy paranoia and start operating from the point of view that every breach is going to affect you sooner or later, in some way or another. Get your house in order now, because breaches are going to keep happening. Prepare to fight technology with technology. Fraudsters are becoming increasingly good at pulling together large data sets to create ever more nuanced and sophisticated attacks. Businesses have to get out ahead of them with technology that also lets them leverage data and technology to create more nuanced and sophisticated authentication processes.
About the Author:
Jason Tan is the CEO of Sift Science, a trust platform that offers a full suite of fraud and abuse prevention products designed to attack every vector of online fraud for industries and businesses across the world.
