Account takeover fraud is one of the most dangerous types of fraud, because a person is actually gaining access and taking over someone else’s banking, brokerage, credit card or other critical financial account such as their Social Security account. It’s been estimated that 22% of American adults have experienced some type of account takeover fraud, which has resulted in average individual losses of $12,000.The trend is only growing.According to a 2021 annual report by Security.org using data from Deduce, 60% of account takeover victims used the same password as the compromised account across multiple sites, with social media accounts making up 51% of the accounts taken over, followed by bank accounts.Late last year a man pled guilty to federal charges of conspiracy to commit bank fraud after he conspired with several others (two were bank employees) to take over and withdraw money from individual accounts with high balances. The criminals then obtained fraudulent identification cards which allowed them to enter bank branches in Maryland and make large withdrawals of cash or obtain cashier’s checks. They then deposited the money into business accounts opened under the names of shell companies controlled by the co-conspirators. Federal authorities say that at least 14 people and several companies were attacked this way between 2018 and 2019. It’s estimated the victims lost nearly $400,000.
Attacks increased during the pandemic
It’s believed that one of the big drivers of account takeover fraud is the explosion of the online and digital-only fintech market, which is predicted to grow to $310 billion, with an annual growth rate of nearly 25%. It is estimated that globally 46% of people exclusively use digital channels for their financial services and that 88% of legacy financial service institutions lose market share to standalone fintech companies in the next five years. Because of these alarming competitive threats, 77% of these legacy financial service firms have indicated that they plan to increase their focus on digital innovation to improve customer retention.
As the number of fintech customers grow, so do the number of attacks. Experts say that attackers have developed more sophisticated tactics – and attack from multiple fronts—making traditional fraud and account security solutions vulnerable. By taking over accounts, criminals can then use them as money laundering devices, to fund organized crime or clean out the accounts. They can also use the seized accounts to open fraudulent credit applications or get loans.
Account takeover fraud can take many forms to ‘fool’ customers. “Smishing” – traditional phishing scams sent through SMS text messages – often offer a link to a site that masquerades as a popular bank and then tries to get the user to offer personal information. But now phishers are using a hybrid form of smishing, which sends out linkless text messages about suspicious bank transfers as a pretext for then calling and scamming whoever responds via text.
KrebsOnSecurity reports that one Silicon Valley executive got voice phished after he tried to catch the scammers. Specifically, he tried to keep the fraudster on hold while he checked with his bank. But what he didn’t know was that a member of the fraudster’s team was impersonating him on the phone with the bank’s customer service people. The man thought the scammers were legitimate and continued talking to them.
In another example, Arkose Labs reports that human-driven attacks grew six times in the first half of 2021, with low-cost human labor from developing economies around the world helping to ramp up attacks. In addition, attackers are also successfully using: “identity farms” that offer large numbers of stolen and synthesized identity credentials; stolen cloned fingerprints from personal devices; and spoofing tools to make them appear to be trusted sources. Even if the attackers fail in an account takeover, they use what they’ve learned about that user’s behavior to mimic them again in the future and evade anti-fraud measures.
At the same time, there are still phishing, malware, brute force and man-in-the-middle attacks that are popular with criminals, especially with more people doing business online since the start of the pandemic. Security.org says that 58% of the reported account takeovers happened within the last year.
Account takeover solutions
As account takeover fraud continues, consumers will begin to demand better safeguards. Security breaches can damage a company’s reputation and customer loyalty, not to mention the costs of investigations and recovery. But how to continue to offer the speed of service that consumers demand while also ensuring that users are legitimate?
More data, faster. Machine learning at the edge allows Aerospike
to analyze millions of events, billions of data points and petabytes of data in milliseconds. For example, a leading global financial services firm uses Aerospike’s real-time data platform to process and analyze data to identify emerging fraud patterns in less than 30 milliseconds even at volumes more than 150TBs
Improve AI/ML and reduce false positives. Real-time fraud management at scale is only usable if it also provides customers a pleasing experience. The ability to process enormous amounts of data quickly enables data scientists to use increasingly
sophisticated AI algorithms, such as neural nets, to optimize their results and reduce false positives. Aerospike’s real-time data platform has helped customers significantly reduce their online fraud and identity authentication, with the added benefit of decreasing their false positives by 30x.
Aerospike’s real-time data platform also offers real-time ingestion of customer, market and transactional data from multiple data feeds simultaneously, which can help keep ahead of criminals launching new attacks. In addition, its high reliability (five 9s of uptime), speed at any scale and low total cost of ownership (a reduction of 40%-60%) ensures that as businesses scale up, they can count on fraud prevention measures to keep up.
With growing account takeover fraud, businesses need to take immediate steps to ensure their users are safe from criminal activity. Leading financial service firms depend on Aerospike to provide the critical components for account takeover security, including the ability to ingest and process enormous amounts of data in real-time with high reliability.Learn more about how Aerospike’s real-time data platform is helping to protect companies from Fraud.
Learn more about how Aerospike is helping Financial Services companies and Banks gain a competitive advantage.
