If you sell goods or services online, especially high-risk categories like digital goods, gambling and financial services, you’re a prime target to fraudsters.

Introduction

Online payment fraud prevention is an endless game of Whack-A-Mole. Whenever payment technology advances or user preferences evolve, fraudsters are the first to identify the weaknesses, and as soon as one vulnerability is resolved, another appears. This is why it is crucial to keep abreast of all developments related to payment fraud; the favoured attack vectors, the most vulnerable platforms, and the best protection methods. 

PwC’s Global Economic Crime and Fraud Survey 2022 reveals that 46% of surveyed organizations reported experiencing some form of fraudulent activity in the last 24 months. The report also shows that organizations in Europe are significantly more likely than those in other regions to experience fraud perpetrated by external actors (56%).

What are external actors? That varies, from hackers (31%) and customers (29%) to organized crime (28%), vendor/suppliers (20%) or even competitors (14%), consultants (10%) and foreign states (9%).

The types of fraud businesses experience depends on the industry they operate in. Customer fraud is most prevalent in the financial services (44%) and retail (37%) industries, whereas cybercrime is the most experienced type of fraud in the telecom (50%), health (40%), public sector (36%) and manufacturing (32%) industries.

46% of surveyed organizations reported experiencing some form of fraudulent activity in the last 24 months.

Source: PwC’s Global Economic Crime and Fraud Survey 2022

Cybercrime and threat attacks become more elaborate

Within the EMEA region, Europe is a very mature market with relatively low growth in attack rates. However, as Europeans increasingly move towards mobile commerce, a surge in desktop attacks has become evident. Overall, at 13% YOY, EMEA has seen the highest growth in desktop attacks compared to other regions.

Strong Customer Authentication (SCA) is having a positive effect on fraud attacks. Still, recent research from LexisNexis shows that the EMEA region saw a clear uptrend in the volumes of both human-initiated and automated bot attacks during the second half of 2021. Specifically, human-initiated attack volume is up 7% YOY, while automated bot attack volume has grown by a whopping 16% YOY. In particular, the (automated bot) attacks, seen in EMEA, mostly focus on logins. The goal of which is to gain access to accounts and use the data mined to facilitate fraud through social engineering.

Globally, attacks targeting gaming, gambling and financial services are on the rise, while communications, mobile and media remain the most vulnerable of all.

Source: LexisNexis Risk Solutions Cybercrime Report | July to December 2021

The techniques employed by cybercriminals grow ever more sophisticated, and companies of all shapes and sizes face a mountain of threat levels. Since the COVID-19 pandemic, 62% of merchants report seeing new fraud types emerge. Luckily, business awareness regarding fraud has also grown, and over half of businesses surveyed have increased their fraud protection budget accordingly. Business awareness of fraud has increased most for companies in the digital goods (62%), subscription (58%) and retail (53%) industries.

Though larger merchants that sell through multiple channels experience the highest level of successful fraud attempts, how likely your company is to be targeted by fraudsters depends on many factors. Those include the sales channel and industry you work in, the fraud awareness maturity of your market, the security of your IT infrastructure, as well as consumer behaviour and regional regulatory environment.

Fast-evolving attack techniques employed by cybercriminals

Device Spoofing:
Fraudsters delete and change browser settings in order to change their device identity or fingerprint, or attempt to appear to come from a victim’s device. 

Identity Spoofing:
Using a stolen identity, credit card or compromised username/password combination to attempt fraud or account takeover. 

IP Address Spoofing:
Cybercriminals use proxies to bypass traditional IP geolocation filters, and use IP spoofing techniques to evade velocity filters and blacklists. 

Man-in-the-Browser (MitB):
Man-in-the-browser attacks use sophisticated trojans to steal login information and one-time-passwords from a user’s browser. Bots are automated scripts that attempt to gain access to accounts with stolen credentials or create fake accounts and transactions.

Crimeware Tools:
Crimeware refers to malware specifically designed to automate cybercrime. These tools help fraudsters create, customize and distribute malware to perpetrate identity theft through social engineering or technical stealth.

Low and Slow Bots:
Refers to low frequency botnet attacks designed to evade rate and security control measures, and thus evade detection. These attacks appear to be legitimate customer traffic, and they typically bypass triggers set around protocols and velocity rules.

Source: LexisNexis Risk Solutions Cybercrime Report | July to December 2021

Cross-border sale of digital goods: high demand, high risk

In Europe, the number of internet users trying to get cross-border access to content has nearly doubled over the span of four years (from 8% in 2015 to 15% in 2019). The increase in demand is being driven by the lack of access to digital goods.

Digital goods is a term commonly used to describe intangible products and services that can be acquired and consumed online. The fulfilment process is fully digital and occurs in real-time. Examples of digital goods and services include:

• Prepaid phone credit
• Digital gift cards
• Game vouchers
• Media files
• E-books
• Fonts
• Digital subscription services
• Internet coupons
• Virtual goods / in-game items
• Online courses
• Music & video streaming services
• Website themes etc.

Data from the Eurobarometer survey shows that audiovisual and other electronically supplied copyright-protected content, such as music streaming and downloading, e-books and games, are among the most popular content sought by consumers across borders.

The growth of international e-commerce is also fuelling fraud attacks. Recent observations by the European Banking Authority show that fraudulent cross-border transactions represent 81% of fraudulent card payments reported by issuers and 94% of fraudulent card payments reported by acquirers.

Among the cross-border payments, the payments with counterparts located outside the European Economic Area are more frequently subject to fraud compared to the payments executed inside the EEA. In fact, the share of fraud in the total volume of card payments outside the EEA – as reported by issuers – is three times higher than inside the EEA, and 85 times higher than the fraud share for the domestic transactions.

The financial impact of fraud on merchants

Fraud is costly. In 2021, the global value of e-commerce losses to online payment fraud was estimated at $20 billion. A growth of 14% compared to the previous year. 

As consumers make more use of mobile apps and digital wallets, the cost of fraud appears to be rising along with the trend. In EMEA, every fraudulent transaction costs 3.49 times the lost transaction value on average. The cost of fraud is highest among financial services institutions (4.34 times the lost transaction value).

A quick word on geo-blocking

Businesses often reject transactions that originate from specific countries. A practice known as geo-blocking. While blacklisting certain regions is a way of reducing fraud risk, this does come with a major downside. The more transactions you reject, the higher the risk is of rejecting transactions from good customers. Moreover, many European companies may not realize that unjust geo-blocking is actually illegal. The European Union’s regulation against unjustified geo-blocking, which entered into force on 3 December 2018, addresses unjustified online sales discrimination based on customers’ nationality, place of residence or place of establishment within the internal market.

To be clear, the regulation does not oblige merchants to allow access to their content, nor sell or deliver across the whole EU. Rather, it prohibits merchants from discriminating against customers based on their nationality, place of residence or place of establishment, if the merchant already delivers to their particular Member State.

Geo-blocking is not a solution for online payment fraud

Geo-blocking limits sales opportunities and stunts revenue growth. Though geo-blocking may be a quick solution to a growing problem, companies who are serious about expanding their cross-border sales are better off investing in proper fraud protection tools and processes.