Battle of the networks

Your bian­nu­al Cyber­crime Report is always high­ly antic­i­pat­ed due to the vol­ume of trans­ac­tions you process. What trends caught your eye in the lat­est report?

We process more than 35 bil­lion online trans­ac­tions a year glob­al­ly so that gives us a real­ly inter­est­ing per­spec­tive on what’s going on in the world of cyber­crime. Our lat­est report, which cov­ers the peri­od between July and Decem­ber 2019, shows quite a sig­nif­i­cant tip­ping point in terms of the plat­forms that fraud­sters tar­get. Four years ago, mobile devices made up about 20 per cent of our net­work traf­fic. In the lat­est report, it’s about two-thirds. The shift­ing con­sumer behav­iour from desk­top to mobile has clear­ly been hap­pen­ing for a long time, but there were always more attacks on desk­tops than on mobile. That’s part­ly because the vol­ume was slow­ly shift­ing, but also part­ly because fraud­sters tra­di­tion­al­ly saw desk­top trans­ac­tions as an eas­i­er tar­get because mobile trans­ac­tions are set with­in the often more secure frame­work of a mobile app, with the likes of fin­ger­print bio­met­rics, for exam­ple. In the last six months of 2019, how­ev­er, mobile attacks out­paced desk­top attacks by vol­ume for the first time.

 Mobile usage has exceed­ed desk­top for some time now. Why is it only just recent­ly that fraud­sters have decid­ed to tar­get this plat­form more than desk­top?

One of the rea­sons it hap­pened in this peri­od is because we did see a big growth of glob­al bot attacks pri­mar­i­ly tar­get­ing mobile app reg­is­tra­tions, so it might be that in the first six months of 2020 we see those attack vol­umes edge back towards desk­top again. How­ev­er, a mobile bot attack, in itself, indi­cates a clear shift in fraud­sters’ approach. We’ve seen big, auto­mat­ed bot attacks in the net­work con­sis­tent­ly over the last few years and the fact that fraud­sters are now using bots to tar­get mobile appli­ca­tions indi­cates a change in their behav­iour.

What does this mean for organ­i­sa­tions and how they approach cyber­se­cu­ri­ty?

Any one indi­vid­ual solu­tion can even­tu­al­ly be bro­ken by fraud­sters, but lay­er­ing up mul­ti­ple tools togeth­er is a real­ly good way to pro­tect organ­i­sa­tions and their cus­tomers. Most organ­i­sa­tions have been think­ing about mobile secu­ri­ty for a num­ber of years now, but there are some evolv­ing tech­nolo­gies that are real­ly inter­est­ing, par­tic­u­lar­ly in the con­text of reg­u­la­tion. One of the most inno­v­a­tive emerg­ing tech­nolo­gies at the moment is behav­iour­al bio­met­rics. That does­n’t refer to fin­ger­print or iris scan­ning, but rather iden­ti­fy­ing high-risk behav­iour from the way users inter­act with their devices. On mobile, this could mean the way they swipe, hold their phone or touch their screen. All these pieces of infor­ma­tion can be com­bined to under­stand and iden­ti­fy risk, and be used in the future as one com­po­nent of a strong cus­tomer authen­ti­ca­tion work­flow to sup­port the sec­ond Euro­pean Union Pay­ment Ser­vices Direc­tive (PSD2).

What have you been able to learn about the way fraud­sters oper­ate?

Last year we start­ed track­ing indi­vid­ual fraud­sters using their dig­i­tal iden­ti­ty and we found they were oper­at­ing across mul­ti­ple organ­i­sa­tions with­in our net­work. In our lat­est report, we took our analy­sis a step fur­ther by visu­al­is­ing the pat­tern of when a device that had been asso­ci­at­ed with a con­firmed fraud event at one organ­i­sa­tion had then been seen at anoth­er organ­i­sa­tion. By con­nect­ing these events, we were able to see this huge net­work of inter­link­ing fraud­u­lent activ­i­ty. We broke those net­works down into spe­cif­ic small­er net­works that we see oper­at­ing across par­tic­u­lar regions or indus­tries. The glob­al net­work we mapped out had around 73,000 devices that were asso­ci­at­ed with a fraud­u­lent event at one organ­i­sa­tion and then record­ed at anoth­er. Dur­ing just a one-month peri­od, those trans­ac­tions amount­ed to more than $40 mil­lion of mon­e­tary expo­sure to this net­work of cross-organ­i­sa­tion­al fraud. It feels like if they can work in that kind of advanced and inter­con­nect­ed way glob­al­ly, they must have a very advanced set-up and process. This net­worked con­cept of fraud was a real eye open­er.

How is Lex­is­Nex­is Risk Solu­tions help­ing com­pa­nies deal with this net­work of fraud­sters?

It takes a net­work to fight a net­work and so we are build­ing that through what we call the Lex­is­Nex­is^® Dig­i­tal Iden­ti­ty Net­work^®, which is a crowd­sourced repos­i­to­ry of dig­i­tal iden­ti­ty intel­li­gence har­nessed from these bil­lions of glob­al trans­ac­tions. With each trans­ac­tion we can look at numer­ous pieces of infor­ma­tion, such as the device integri­ty, loca­tion data, user behav­iour and whether there is any threat intel­li­gence asso­ci­at­ed with the online trans­ac­tion. From all these insights we are able to build a dig­i­tal iden­ti­ty for each user and our tech­nol­o­gy can then flag if any activ­i­ty seems incon­sis­tent or unusu­al.

We are using all of the indi­vid­ual com­po­nents of some­one’s dig­i­tal iden­ti­ty, stitch­ing them togeth­er and using that as a base­line to analyse and under­stand whether trans­ac­tions are high risk or trust­ed. On top of that there are many oth­er com­po­nents we lay­er in for addi­tion­al secu­ri­ty. We have numer­ous phys­i­cal iden­ti­ty solu­tions that cus­tomers can use, either in know-your-cus­tomer, or KYC, require­ments or to ver­i­fy the phys­i­cal iden­ti­ty of a user, as well as a deci­sion plat­form, which incor­po­rates machine-learn­ing tools and advanced behav­iour­al ana­lyt­ics to bet­ter mod­el fraud risk. We’re then devel­op­ing new and inno­v­a­tive solu­tions such as behav­iour­al bio­met­rics, which we recent­ly launched, to lay­er in addi­tion­al data about how users inter­act with their devices.

This holis­tic solu­tion allows us to detect the macro attacks, like auto­mat­ed bots, as well as the indi­vid­ual attacks on cus­tomer accounts, and even social engi­neer­ing attempts. A key chal­lenge for finan­cial insti­tu­tions at the moment is fraud­sters tar­get­ing cus­tomers by call­ing them, imper­son­at­ing the bank, play­ing on their fears by say­ing their account has been hacked and then gain­ing remote access to steal from them. Our sys­tem can help organ­i­sa­tions detect if this is hap­pen­ing and help them block high-risk behav­iour before it jeop­ar­dis­es good user accounts. The abil­i­ty to com­pare the phys­i­cal iden­ti­ty of a user with the dig­i­tal iden­ti­ty and behav­iour­al infor­ma­tion pro­vides a lay­ered solu­tion to pro­tect organ­i­sa­tions and their cus­tomers.

How do you fore­see the cyber-threat land­scape con­tin­u­ing to evolve in the com­ing years?

We will con­tin­ue to see this macro to micro trend where attacks are hap­pen­ing on a mass scale, but also an indi­vid­ual scale. That means more mass-scale, glob­al attacks hap­pen­ing across coun­try bor­ders and indus­tries as fraud­sters look to max­imise their suc­cess. In addi­tion, we are like­ly to see more social engi­neer­ing attacks, a pop­u­lar tac­tic with cyber­crim­i­nals who often tar­get vul­ner­a­ble peo­ple less like­ly to detect what is occur­ring. Being able to iden­ti­fy attacks across this very broad spec­trum is impor­tant. Fraud­sters will always look for the low­est com­mon denom­i­na­tor to attack and gen­er­al­ly the cus­tomer will be the weak­est link in the chain, so it’s cru­cial organ­i­sa­tions imple­ment the solu­tions that real­ly enable them to pro­tect their end-users from the effects of fraud.

For more infor­ma­tion please vis­it www.risk.lexisnexis.com/cybercrime-report