Magazine menu Close Magazine menu

Author

Claire Hatcher

Claire is Global Lead for Kaspersky’s Fraud Prevention division. She’s worked in cybersecurity for over 15 years, specializing in fraud prevention for the past decade where she’s developed a deep understanding of how fraud threats and trends emerge and evolve. Claire has developed many relationships within the financial services sector, online retailers and other industries around the world.

Get in touch with Claire

Latest stories by Claire

fraud prevention social engineering

Why people fall for social engineering and how business can stop it

  • Safer business
  • min read
    • A security system is only as strong as its weakest link. And when it comes to cyberfraud, the weakest link is all around you: People. The easiest way for a fraudster to get what they want is to manipulate someone into giving it to them. For example, using a ruse to convince someone to give out their username and password. These 'hacking a human' techniques are known as social engineering. And this threat is on the rise: According to Kaspersky's 2020 Fraud Prevention Report, in some parts of the world nearly two-thirds of people had experienced financial fraud by social engineering through a phone call, text message or email. To protect businesses and their customers from financial fraud, business leaders should learn about social engineering and how to prevent it. Detecting social engineering with technology There's no guaranteed technology to detect a social engineering attack. You can use technology to detect behavior anomalies or prevent incubation when malware is installed, but a person is not a robot. Human behavior crosses a wide spectrum. Attackers collect information about their target. Many people publish enough about themselves on social networks to facilitate fraud, like a photo of a passport, driver's license or air tickets. When using trading websites like eBay, buyers sometimes receive sellers' phone numbers or email addresses. A phone number can reveal at which banks someone holds accounts. Once they have information about their target, fraudsters use every available technology to make themselves more convincing. Social engineering and new technologies Fraudulent fraud warnings One recent, common fraud scheme has seen customers believing they're talking to an employee of their bank who is calling to help cut their bank fees or, ironically, warn of fraud on their account. The criminal uses automated Interactive Voice Response (IVR) technology, asking customers to spell their username and password, then prompts the customer to install an app on their phone. The app lets the criminal remotely access their device. With remote access, the fraudster can transfer money, steal personal data to sell on and apply for loans. Kaspersky Fraud Prevention analyzed nearly 20 million potentially fraudulent events each day,  detailed in the 2020 Kaspersky Fraud Prevention Report. We used behavior analysis and behavioral biometrics to detect these suspicious activities, quickly warning banks, e-commerce and similar service platforms. Using faith in robot voices An insight scammers rely upon is the human tendency to think prerecorded messages and robot voices are more trustworthy. Using IVR, they try to get the customer's second authentication factor data for two-factor authentication. Prerecorded voice messages ask the victim to enter a code received in a text message or push notification. Because the second factor is time sensitive, as soon as the client keys in their code, the scammer immediately transfers funds to their own account. Unfamiliar numbers are getting familiar Banking customers are now used to receiving bank-related calls from third parties contracted by their bank. Callers may introduce themselves as financial agency employees, merchant acquiring or soft collection. Fraudsters know people are suspicious of unfamiliar numbers, but they can use technology to replace part of their phone number with digits from a bank's phone number or display vanity numbers. Fraud against businesses: Three common scenarios Although these kinds of fraud attempts are common, they often follow predictable patterns. Fraudsters often use these three social engineering scenarios to target business employees. Scenario 1: The rescuer Rescuers are criminals that act as security experts and act out a "rescue." Posing as security officers, they might call bank customers to notify them of suspicious debits or payments and offer help. First, they ask the client to verify their identity by a code sent in a text message or push notification. The pretext may be validating the client, blocking a suspicious transaction or transferring funds to a secure account. If the target shows lack of trust, the fraudster may try using IVR or remote device connection to gain a second authentication factor. Scenario 2: The investor The investor scenario involves fraudsters posing as employees of an investment company or investment consultants from a bank. They call clients, offering the chance to invest in cryptocurrency or corporate equity without having to go to a branch office. As a prerequisite for providing the service, the investor asks the target for the code received in a text message or push notification, using similar tools to those of the 'rescuer' scenario. Fraudsters use the investor scenario on victims whose data was acquired by showing interest in boosting their savings. Scenario 3: The police officer Employees can be surprised and feel nervous if they receive a call, text or email about a financial crime or theft in progress from someone claiming to be from the police. The 'police officer' ruse may make victims feel more confident in sharing personal information. How businesses can prevent social engineering cyberfraud Social engineering is common, and humans are fallible. But organizations can make it harder for cyberfraudsters to exploit their employees. Use awareness training to raise your employees' awareness of what social engineering is. It benefits them at work, but also in their personal and family lives. Give examples and aim to make it fun and interesting, rather than scary. When your business or your contracted security experts conduct penetration tests, make sure social engineering is part of the testing. Put systems in place to prevent internal fraud. Analyze employee behavior, identifying anyone trying to harm the business as well as those being targeted with social engineering. You should also use fraud-detection solutions within your digital service channels. Your employees will always be vulnerable to cyberfraud through social engineering. Cyberfraudsters will keep using the latest technology to manipulate people, and attacks will become more sophisticated. Understanding how social engineering works and staying up-to-date on what cyberfraudsters are doing is a strong way to defend your business.
cyber fraud prevention

What’s changing in cyberfraud and how to keep your business safe

  • Safer business
  • min read
    • Today, ecommerce is a basic need. Customers expect speed and convenience, and the 2020 coronavirus lockdowns have only accelerated that demand. Swimming in that tide that raises all boats, Kaspersky's fraud prevention: 2019 report notes a growing number of sharks. One in 50 online financial and ecommerce sessions worldwide are conducted by cybercriminals. As fast as online service technology evolves, fraudsters find loopholes. We're at a crucial point of change in combatting new hacking tools and fraud schemes. So what's changed, and what's changing? Bots fake loyalty Ecommerce customers often receive bonuses as part of loyalty programs, such as for registering, giving reviews and referring friends. With bots, fraudsters create numerous fake accounts and receive bonuses just as real users do. The fraudster then uses the bonuses to buy goods at a big discount for resale. Bots are taking the best seats Research by Distil Networks estimates some 40 percent of traffic to ticket sales sites comes from bots. Fraudsters buy gig, show and sports event tickets with bots, reselling on social media, peer-to-peer sites or ticket resale sites when the event is sold out. This means fans are finding it harder to get tickets and end up paying more. Crawlers are copying prices and photos Cyberfraudsters also use web crawler bots (used legitimately by search engines to give accurate results to search queries) to "crawl" ecommerce competitor websites, recording pricing and making theirs more competitive. They may also steal unique content like images and product descriptions to use on their website, damaging the search rankings of the original website because search engines penalize sites with duplicate content. Bots are getting more like us In 2019 a new generation of "human bots" emerged, designed to mimic human behavior impeccably. Previously, bots moved around web pages in repetitive and simple navigation patterns. The new-generation "human bots" do things humans do, like shake the mouse and make rapid movements. This new human-like behavior is a problem for anti-fraud systems. So far, many have relied on these human foibles to tell bot from human. How fraudsters manipulate The easiest way for fraudsters to attack online businesses is through customers. They use manipulative strategies known as social engineering. They either scare people or earn their trust to get credentials like logins and passwords, and other personal information. Imagine you get a call from someone saying they're with the security department of an ecommerce site you visit. They say someone has tried to buy a high-value item with your credit card and that to stop the transaction, you must download an authentication app. It's a fraudster, of course. The app grants remote access, mirroring the screen of your device and letting the fraudster steal personal information like your full name, address or social security number. They then sell your personal information on the dark web, opening doors to all kinds of fraud, like using your name and bank account to apply for loans. Remote access tools (RATs,) used legitimately by IT support teams in many organizations to access your computer screen to resolve issues, are a powerful tool for fraud in the wrong hands. Fraudsters often target accountants because they work with payment orders. The fraudster accesses the victim's screen without their knowing and substitutes bank details for their own. You may recognize the methods employed in these growing attacks. Some are not new. Here are three emerging cyberfraud trends. Trend 1: Fraud as a service Cybercrime is an easy way to make money without leaving home. This has led to rapid growth in 'fraud as a service (FaaS.)' FaaS makes internet fraud less challenging for newcomers, and so increases the number of people involved. On dark web forums, illegal websites or social media, anyone can buy a set of hacking tools and a leaked customer database, then pay for training on how to make illegal money. Costs range from just 5 US dollars for stolen credit card data, to thousands of dollars for extensive fraud execution courses. The market is booming. Underground digital markets sell bots, digital fingerprints for remotely accessing devices and anonymizer tools that make internet activity untraceable. Trend 2: Resale of bank account access Cybercriminals often target small- to medium-sized businesses (SMBs) in finance who've been acquired by large players, while they adjust their security to meet the buyer's requirements. Kaspersky found, by analyzing dark web forums and chats, criminal groups target these smaller organizations, then resell access to both organizations' internal networks. They predict an increase in this kind of activity, especially in Africa, Asia and Eastern Europe. Trend 3: Data leaks and deepfakes We all love convenient and quick purchases like Amazon's 1-click ordering, despite that these methods usually mean saving and sharing more of our personal information. Yet, a month can't pass without a high-profile data breach from a bank, online store or telecommunications company. Sometimes sensitive personal customer data is exposed, such as biometrics. We're also seeing the rise of impersonation methods where one person's image is replaced with another, using advanced audio, photo and video editing, known as deepfakes. Fraudsters have already used deepfake voice imitation and social engineering to impersonate a CEO successfully. The best ways to protect your business from today's fraudsters These six steps will help your business put in place the strong front against cyberfraud. 1.    Assess risks With growth, or any kind of change in business, comes the possibility of new risks of fraudulent activities. Make sure identifying opportunities for fraud is part of your risk assessment activity. 2.    Review product design Look at the design of your digital services and loyalty program from a fraudster's point of view. Try to find 'loopholes' they could exploit. 3.    Use a fraud detection and prevention system These systems may, for example, analyze online sessions, monitor transactions and analyze payment behavior. They help avoid the financial, reputational and legal consequences of fraud and cut operational costs, such as support team time. 4.    Strengthen your security Put detection and protection measures in place, such as using a web application firewall (WAF) to protect against bots and a solution to protect against Distributed Denial-of-Service (DDoS) attacks. 5.    Strengthen your team Make sure your employees understand how fraud happens and how to combat it by including cyberfraud in your cyberawareness training program. 6.    Record fraud Measure what your business is losing through fraud regularly. Include direct loss, indirect loss and the impact on your brand reputation. If fraud hits your business, hire a fraud expert team to support you through and help you combat future incidents. By taking these steps, you can reduce the risk of cyber fraud affecting your business and make the most of the opportunities the rise of ecommerce brings.
black friday

Retail cybersecurity must step up for Black Friday and Cyber Monday

  • Safer business
  • min read
    • Coronavirus has canceled many things, but Black Friday and Cyber Monday may be as big as ever in 2020. Only this year, it will be different. Some stores promise to end the famous Black Friday sea of bodies clambering over each other for heavily discounted items by offering, for example, no shipping fees for online purchases. And consumer choices on how they shop look set to shift sharply. Google's US shopper survey found 75 percent plan to buy online more than they did last year. UK retailers point to a surge online shopping since COVID-19 lockdowns hit and urge customers to shop early for Christmas, which will drive more customers to online Black Friday sales. Black Friday and Cyber Monday are big retail events at the best of times. In the US alone, 2019 online sales on the two days were worth nearly 17 billion US dollars. It's not just retailers and consumers gearing up to benefit. Black Friday and Cyber Monday present lucrative opportunities for hackers and social engineering scammers. Retail is an attractive target for cybercriminals Verizon's 2020 data breach investigations report found financial motivations lay behind 86 percent of attacks. The holiday season excitement is distracting, but businesses can't afford to let their guard down. Cyberattacks damage retailers in many ways, like lost sales, loss of reputation and legal sanctions if they've not met regulations such as the European Union's General Data Protection Regulation (GDPR.) The stakes are high on Black Friday and Cyber Monday – in 2019, Kaspersky research identified a range of cleverly designed phishing scams masquerading as seasonal discounts from big brands, almost indistinguishable from the real thing. It's not just phishing emails – smart scammers also launch malicious websites for the occasion to further build a sense that they're credible. Cybercriminals' tactics against retail Cybersecurity advice around the November-December shopping extravaganza is mostly aimed at consumers, but there are two sides to every transaction. Retailers have a duty to protect their customers from scams. Social engineering attacks depend on scammers being able to convince would-be victims they're authentic. If an attacker masquerades as your brand, it reflects poorly on you, even if you're not to blame. In the holiday season, there's also a greater likelihood of direct attacks on retailers. You may be too distracted to notice attacks in progress. Hackers can target your website, leading online shoppers to malicious clones to steal their personal or payment information. Attackers may plant malicious links and code where consumers click, such as in branded websites and mobile apps. Others might set up fake websites and social media profiles from scratch. Social media and business email are popular ways to attack. By compromising employee accounts, cybercriminals can greatly increase their impact. Lockdowns and travel restrictions this year will drive more people to buy gifts online and have them delivered directly to the recipient. Mismatched billing and shipping addresses challenge retailers because they may indicate fraud, requiring sophisticated systems or time-consuming manual checks. Often, it will be someone with no recorded purchase history who may have device characteristics not typical of their usual consumer. How retailers should respond to threats Be proactive in letting everyone know you're a step ahead of the threats. See your cyberawareness as a value proposition that drives business growth, rather than just taking care of the necessary. For example, if scammers masquerading as your company target your customers, inform them: Ask them to make sure they check links to your website are legitimate. Don't wait for customers to tell you about the scams – look for them. Find and isolate scams posing as your brand and lock down any compromised online accounts before they cause irreparable damage. Look beyond conventional perimeter security (thorough checks for all attempts to connect to corporate resources from outside the infrastructure,) locking down social media and other online endpoints. National- or multinational-scale retail business should monitor the web around the clock to increase the chances of finding fake websites or other assets disguised as their brand. Threat intelligence or a Security Operations Center are two ways to do it. Monitoring the dark web is also crucial because it's where criminals sell stolen information and assets. In the lead up to Black Friday, warn customers you face threats beyond your direct control. Educate them on how to spot social engineering scams, like poor spelling and grammar, and asking for confidential information over email. Remind them of your security and privacy procedures. Tell customers what you're doing to combat threats and what they can do to be safer when shopping online. Your transparency will build trust in your brand. Another often-overlooked holiday season threat is distributed denial of service (DDoS) attacks: When hackers bombard servers with requests until they slow to a crawl or crash. For bigger business, ruthless competitors, state-sponsored hackers or political activists may use this tactic, hoping to damage your business finances and reputation. To protect your online store from being taken offline on a landmark retail day, have DDoS protection. Black Friday and Cyber Monday security challenges are undeniable. Overcoming them will make the holiday season more profitable for your business and safer for your customers. Be honest, transparent and proactive in how you communicate with your customers. Get the right security in place against the kinds of threats your retail business faces, then sit back and enjoy watching the sales roll in.
by Innovating leaders.
Innovative tech.
About Secure Futures

Secure Futures magazine is your go-to business guide for opinions, trends and insight into the world of technology and cybersecurity. We help your business to bring on the future. Brought to you by Kaspersky, the global cybersecurity experts.

  • For all other countries