The role of digital services in our lives has never proven more pivotal than it has been over the past few years. Digital banking has increased in popularity with customers, which means it’s also becoming a favorite avenue for attackers.
For financial institutions, in particular, this means putting years of investment in digital transformation to the test. For example, it is estimated that the biggest global banks have saved $15 billion from cloud adoption and cut technology infrastructure costs by 25% in recent years. In addition, financial institutions have had to adjust to entirely new ways of working to serve and protect their customers. Have those investments paid off in their ability to offer a high level of service and address the needs of customers that are being served through digital channels?
Fraudsters go where the money is, and today, that means going to the digital world. They are seizing the opportunity to grow their criminal business in a time when the use of digital tools and channels might be at an all-time high. One way in which they are doing this is through account takeover attacks.
Account Takeover Fraud: The $11 Billion Problem
Account takeover is a form of identity theft in which a fraudster gains access to a victim’s account and uses it to make unauthorized transactions or purchases. It remains an ongoing problem for financial institutions, e-commerce merchants, and virtually any organization that offers products or services that can be monetized. In 2021, account takeover fraud cost U.S. customers $11.4 billion, according to Javelin Strategy & Research.
There is a sense that these attacks are growing as the increased reliance on digital services offer fraudsters more potential victims to target and more opportunity to fly under the radar as some businesses temporarily lower their security barriers in order to provide an optimal customer experience.
Malware Emerges in Account Takeover Attacks
With the widespread use of mobile devices, it is hardly a surprise that mobile attacks have been on the rise for years. As banks look to meet their customers where they are, criminals have adapted their strategies as well. Specifically, mobile malware is emerging again, targeting mobile devices to hijack the operating system or steal personal and financial information with the goal of committing fraud.
BioCatch has seen an increase in mobile malware being used in account takeover fraud, and many of the tools that are currently in use are more sophisticated than their predecessors. One example is TeaBot, a widely distributed mobile malware that emerged in 2021. The Android banking Trojan uses RAT capabilities to steal credentials and intercept OTP codes. TeaBot started out by targeting victims across the UK and Europe and has spread to become prevalent more recently in Australia and the United States. A recent report found that there have been over 1 billion downloads of financial apps targeted by prominent mobile malware, with TeaBot targeting the largest number of them.
Five Factors Fueling Account Takeover in 2022
Regardless of the means, there are five drivers that continue to fuel the growth in account takeover attacks.
1. Data Breaches
A data breach to a fraudster is like a treasure chest to a pirate —full of gold. There have been nearly 12 billion account credentials compromised in the last few years, mostly email addresses and username-password combinations. Breaches are fueling the underground economy and providing fraudsters with a ready supply of credentials to commit account takeover fraud.
2. Fraud Automation
Fraudsters are continuously working to innovate and develop the tools, technology, and methods they use in cybercrime attacks. One example is the use of fraud automation tools like SNIPR and Sentry MBA in automated attacks such as credential stuffing. These tools enable fraudsters to check the validity of high volumes of credentials against any website in minutes. BioCatch has seen success rates of up to 23% for tested batches of stolen credentials.
3. Social Engineering
Humans still remain the weakest link. Whether it’s clicking on a link in a phishing email, downloading a rogue mobile app containing malware, following a smishing prompt, or unknowingly authorizing a fraudulent transaction, every successful fraud attack relies on the ability to exploit human vulnerabilities. Advanced social engineering scams, such asauthorized push payment and Zelle scams, are nearly impossible to recognize with traditional fraud prevention methods as the genuine user is unknowingly being tricked into conducting the transaction and authorizing a payment to an account controlled by a fraudster. Last year, UK banks and consumers had over £583 million stolen in authorized push payment scams.
4. Expansion of Digital Banking Services
The financial services industry is undergoing a rapid digital transformation to simplify banking and optimize user experience. The pressure on traditional banking from emerging challenger banks and fintechs has created an innovation race. From mobile and cloud to instant payments and P2P platforms, financial institutions are faced with balancing the benefits of innovation against the potential new risks of an expanding attack surface.
5. Weaknesses in Legacy Fraud Controls
With a near-universal reliance on passwords, most fraud prevention tools are designed to provide an additional layer of strong authentication at login based on parameters such as device identification, IP, geo-location, and one-time passcodes. While these controls are still effective, they do have weaknesses that fraudsters have learned to circumvent. Visibility beyond login based on user behavior provides a rich additional layer of trust signals to identify more sophisticated attacks such as social engineering scams.
Preventing Account Takeover
Behavioral biometrics present a strong solution for preventing account takeover attacks in the digital age. As technology evolves, it makes it easier for fraudsters to automate attacks, spoof a device or IP address, or steal an OTP code. But one thing they can’t mimic is genuineuser behavior
Learn more about what scammers are doing to target vulnerable customers in 2022 and what shape the fraud landscape is expected to take. Download 4 Ways Financial Scammers Are Getting Ahead today.
