Fraud: No longer a dirty word | Platforms & Technology

Fraud used to be talked of quietly in dark corners, not out loud. But with growing use of carrier billing being part of the global move towards ‘digital life’ it is now an everyday part of business. So let’s talk about it, says Paul Skeldon

Fraud used to be such a dirty word – especially in connection to telemedia. However, as was proved at this year’s World Telemedia show in Marbella, it is very much an accepted part of doing digital business – and one that the industry has never been more on top of.

Back in the day, fraud in telemedia was often something perpetrated by a few bad apples within the industry. Now that telemedia sits very much in the mainstream of the digital economy, it is falling foul to cyber crime just as much as all other ecommerce and digital businesses.

However, it is now one of the leaders in fighting that fraud.

Click jacking, rogue adverts, bad traffic, DCB fraud, cyber hacking, fake sites and fake apps are all things that the digital world has to contend with – but using monitoring techniques that are getting ever more sophisticated the likes of Opticks, Empello and MCP are all helping to keep the industry just one step behind the criminals.

Italian job

And fraud comes from some unlikely places. Asking the audience to guess the top five countries of origin for fraud, Geoffrey Cleaves, head of Opticks, surprises us all when he reveals that top of the list – which already contained Ukraine, Belarus, Russia, Iraq and India – was in fact Italy.

“Regulators have to be on top of it” Cleaves says knowingly. Italy stands out as there is probably – and these are my words, not Geoff’s – rife with corruption.

How Opticks tracks fraud is a closely guarded secret, but I can reveal that it involves more than just odd looking traffic patterns, but also odd ways things appear on the screen.

Tracking fraud means looking for patterns and anomalies, who people are looking and screens and many more factors. But keeping up with the fraudsters is always a challenge.

Fake apps

The key thing with fraud is that it is now happening at an alarmingly fast pace – and in many new places. “Back in the day it used to take hackers two or three weeks to create a new hack and for it to spread,” says Shwetank Tamer from OnMobile Global. “Now it is more like two to three days and so we are constantly catching up. Add in that all these new things like Alexa and smart TV are also getting hit and the problem is huge.”

The proliferation of new devices and new apps only adds to the complexity. Apps are already a huge problem.

Recent research by digital security management experts RSA Security finds that the fraud risk from fake mobile apps is on the rise.

Data gathered by RSA’s Fraud and Risk Intelligence (FRI) unit – a team of experts who infiltrate cybercriminal groups to unearth fraud campaigns and track their proliferation – shows that the total number of global fraud attacks the team detected in the first half of 2019 was 63% higher than the number detected in the second half of 2018, rising from 86,344 to 140,344.

According to the research, fraud attacks originating from fake mobile applications rose by 191% in the first half of 2019, to more than 57,000, as cybercriminals continue to abuse legitimate brands as a channel to commit fraud.

E-commerce payment fraud attempts originating from a ‘trusted’ account – such as one known to the RSA fraud system for 90+ days – but a ‘new’ device increased from 20% to 80% of total e-commerce fraud, as perpetrators double-down on account takeovers as a means to evade fraud detection.

There was an 80% rise in financial malware attacks in the first half of 2019 and fraudsters have been spotted using adapted versions of the old Ramnit Banking Trojan to circumvent defences; for instance, the fraud team found it’s now being distributed via executable files that are downloaded and opened by unknowing users.

Daniel Cohen, Director of the Fraud and Risk Intelligence Unit at RSA Security says: “The digital transformation of finance is well underway and yet, this transformation is a double-edged sword; while digital has created opportunities for organisations to improve customer experience, it also introduces new digital risks that need to be managed. Take for example the number of digital touchpoints that consumers can engage with to access financial services: these have increased dramatically through initiatives such as open banking and this widens the attack surface that fraudsters can take advantage of.”

Cohen continues: “The fact that fraud via fake mobile applications tripled in the first half of 2019 is testament to how perpetrators will constantly seek out weak points. Here, they are exploiting consumers’ growing trust in mobile apps as a means to interact with brands and make purchases. To keep pace with constantly evolving tactics, banks need to take a layered approach to proactively manage the risk of fraud across all channels. This will help them embrace the opportunities that come with digital transformation whilst maintaining confidence in their ability to detect and respond to fraud, protecting both themselves and their customers.”

What can we do to combat fraud?

The big questions is what can be done about it? From an industry point of view, Jonathan Redvik from Appland AB believes that the industry needs to take more responsibility for fraud and work collectively together on it.

“OTP messages can be hacked by bots and are a nightmare for consumers and expensive for brands,” we need better solutions,” he told delegates.

This was backed up by Jacqui Jones from Worldplay in South Africa, which has seen all the main network operators and aggregators get together out there to form WOSPA, a collective body that shares data on fraud and works together to beat it.

Or you can think like a fraudster. The other tack being taken to combat fraud is to think like a fraudster. David Lotfi from EVINA says his company does just that. EVINA has devices set up all over the world to get infected and to be hacked, so it can see precisely what is going on and how the fraudsters are operating.

It then looks for the kind of kit needed to perpetrate the fraud on the dark web and reverse engineers it all.

From a consumer point of view RSA’s Cohen believes that the key weapon is vigilance. “It’s essential that, as consumers, we all stay vigilant of new digital risks and there are several simple steps we can follow. Firstly, avoid clicking on links in text messages or emails from unfamiliar senders as this lowers the chance of having your bank details stolen, or malware being installed on your device. It’s also important to keep track of bank transactions; often, fraudsters will start with smaller purchases to test the water, so monitoring bank accounts closely is vital to catch fraudsters early. Finally, in light of the rise in fake mobile apps, download new applications with caution, make sure to verify the publisher and pay close attention to what data permissions each app requests.”

Carrier billing: how to stop it driving fraud

Carrier billing is growing globally in use, with more consumers than ever using it all over the world for often mainstream purchases from app stores and more. But fraud is becoming an issue, and the mobile industry needs to clampdown on this now if DCB is to survive, industry players warn.

Speaking from this year’s Global Carrier Billing Summit in London, Dimitris Maniatis, head of Upstream’s security platform, Secure-D, warned mobile industry leaders: “We must safeguard digital carrier billing against the ever-growing threat of online transaction fraud that’s targeting mobile operators and their subscribers worldwide.”

Direct carrier billing is growing fast, but is also in danger, Maniatis says: and the proof is in the numbers. Mobile subscribers and smartphone penetration are rising and the number of people going online is increasing, especially in emerging markets. It is expected that 1.4 billion more people will be using mobile internet by 2025, mobile data usage will grow 5X by 2024 and DCB will increase 3X by 2022.

This presents a lucrative opportunity for data generated revenue for MNOs. The rapid evolution of DCB, however, is also gaining the attention of fraudsters whose sophisticated tactics are putting its viability at risk. This threat calls for effective solutions that will safeguard MNOs’ digital revenue growth against fraud related to online transactions.

He continues: “In 2018 alone, Upstream’s innovative security platform processed over 1.8 billion mobile transactions, detected and blocked over 63,000 malicious apps in 16 countries and identified 30 million malware-infected users.”

Steps that MNOs need to take to protect themselves include implementing: