More evidence that cyber criminals are using personal information from social networking sites to create socially engineered attacks was recently disclosed when VeriSign iDefense reported a cyber crook was trying to sell 1.5 million Facebook accounts on an electric fraud Web forum. In the article, “1.5 Million Facebook Accounts for Sale in Web Forum, VeriSign Reports,” social networking credentials are gaining value in the cyber-underworld. According to Rick Howard, director of cyber-intelligence at iDefense, the more Facebook friends an account has, the more valuable the credential. Read the rest of this entry »

While the hot new iPad provides an exciting platform to surf the web, exchange emails and read books, users are also using the computer tablet to access their existing accounts on social networking sites, play virtual games, and make online purchases much like they would on their home computer.

This past week, iovation has seen a rapid adoption of the iPad being used at our customer sites. We’ve seen the number of iPad transactions grow by thousands every single day since the new device was made available. And these transactions aren’t just occurring within the same industry. In fact, we’re seeing iPad transactions on a multitude of verticals including travel sites, social networks, sportsbooks, dating sites, credit issuers, MMOs and online social games. And our job is to make sure that the transactions processed are from legitimate, good customers.

Topping the list of industries where we’ve seen the most online transactions this week is online communities at 45%, with the majority on social networking sites as opposed to dating sites. The second largest group was online retail, accounting for 28% of total iPad transactions. Most of those transactions occurred on travel sites. And lastly, international gambling sites such as sportsbooks came in third, at 23% of all iovation-protected iPad transactions.

So that’s where we’re helping customers, but what information do fraud teams share within our database in order to reduce fraud losses and ensure good customers have a positive experience on their site?

iovation tracks over 30 different types of bad behavior and this segmentation is important to our customers. How they treat evidence (specific types of fraud and abuse) changes across various industries. For example, an online retailer cares about mitigating chargebacks and catching criminal activity before product goes out the door, whereas an online community cares more about stopping spam, solicitations, predators and phishing attempts, in order to protect community members and maintain a safe and trusted environment.

Our customers can customize our fraud protection service to gain control over the specific transactions and activities that they correlate with high risk. This allows them to take more business with confidence and spend less time conducting costly manual reviews.

Believe it or not, within the first week of iPad sales, we have already uncovered fraudulent activity. Over half of all transactions denied from iPads were specifically related to credit card fraud. In other words, they were fraudsters attempting to monetize stolen identities on our customers’ websites.

As iPads connect to online businesses to create accounts, submit applications and make purchases, it is very important for organizations to know whether or not the device:

• has committed fraud or abuse on their site
• has committed fraud or abuse at another business
• has relationships with other devices or accounts that have been involved with fraud or abuse
• has not been seen before, but matches the profile of other high-risk or suspect devices

As iovation’s global shared database of over 275 million devices grows, so do the reputations of iPads used to request transactions. This is important information that companies can use to determine whether or not a transaction requested by an iPad, or any other Internet device, can be trusted and just the kind of information iovation provides to its valued customers.

I’m very proud that iovation was included in the 2010 OnDemand Top 100, as selected by the AlwaysOn staff and other industry experts across the globe. This list recognizes companies for creating new opportunities in cloud computing and SaaS.

AlwaysOn asserts that the selected companies are developing game-changing approaches and technologies that are likely to disrupt existing markets. Selection criteria include innovation, market potential, commercialization, shareholder value and media buzz. Quoting Tony Perkins, founder and editor of AlwaysOn:

“As the digital information created by businesses continues to explode at astronomical rates, the need to store, manage, and share this information is becoming extremely challenging. By providing innovative technologies that help enterprises better compete in this new era of information complexity, the OnDemand 100 represent some of the highest growth opportunities in the private company marketplace.”

It’s an honor to be recognized by industry experts for pioneering the use of device reputation to help online businesses fight fraud and abuse. The only thing better is recognition from customers that use our service every single day. Read the rest of this entry »

The FBI recently released some interesting findings about cyber crime that confirmed what we suspected all along — cyber criminals are very business-like, working together, and operate like most other businesses that are out to make a profit. In the article, “The rise of Mafia-like cyber crime syndicates,” Deputy Assistant FBI Director, Steven Chabinsky, said a number of sting operations have uncovered the various roles individuals play within a criminal organization down to the specific titles and duties.

For example, Coders write the malware. Hackers are actively searching for vulnerabilities to exploit. Fraudsters create and deploy social engineering schemes. Hosters provide safe hosting of content on servers and sites. Techies maintain the infrastructure. And Leaders are the managers who keep the team together. Read the rest of this entry »

While overall percentages of online fraud continue to climb, one of our partners in fighting cyber crime, Retail Decisions (ReD), reported that card payment fraud in the UK dropped an estimated 15% last year. According to the article, “ReD Estimates a 15% Drop in UK Card Payment Fraud in 2009,” the value of online, mail order and telephone order fraud dipped to GBP278 million in 2009 from GBP328 million in 2008.

Retail Decisions CEO, Carl Clump, credits innovations in fraud prevention technologies for the estimated 15% decline over the past year. This defied the trend where overall CNP (card not present) fraud losses have grown consistently over the past five years. Despite the total drop in losses, Clump was quick to point out that the current trend, which would continue well into 2010, may not be here to stay. Read the rest of this entry »

Online retailers are losing on average 1.2% of their total revenue to online fraud. That’s according to a recent survey conducted by the Merchant Risk Council and reported in the article, “Fraud is costing online merchants 1.2% of revenue, survey finds.” Not surprising, the more automated fraud screening tools a company used, the lower their fraud rates were.

For large online merchants that used 7.9 fraud tools, fraud losses dropped to 0.9% of their revenue compared to the 4.7 average tools for all survey respondents. Reported fraud rates for international orders were also lower for large online retailers by a 1.4% to 2% margin, compared to all companies who participated in the survey. Read the rest of this entry »

Last week, the Internet Crime Complaint Center (IC3) released its 2009 Annual Report on Internet fraud activity, and the results were staggering. According to the report, in 2009 U.S. citizens lost nearly $560 million to online scams. That number more than doubled the $265M in online fraud losses reported in 2008. The IC3, which tracks worldwide complaints of Internet fraud through its Web site, also said the total number of complaints in 2009 jumped 22% compared to 2008.

In the article, “Internet fraud’s U.S. price tag put at $550 million,” Donald Brackman, director of the National White Collar Crime Center (NW3C), said the growing figures can be largely attributed to increasingly sophisticated online schemes and cyber criminals’ ability to hide their true identities online. Read the rest of this entry »

Security experts from around the globe will soon meet in Nigeria to help boost the West African country’s parliament to fight Internet fraud and terrorism worldwide. In the article, “Foreign cybercrime experts to partner with lawmakers,” anti-cyber crime and terrorism experts from the US and other European countries will partner with members of the National Assembly to explore the extent of the fraud problem in Nigeria and discuss strategies to combat it.

Over the years, online schemes operating out of Nigeria have cost victims millions in fraud losses. The proposed conference of worldwide anti-fraud, economic and strategic Nigerian government agencies and groups will evaluate the country’s electronic payment system and ensure that measures are taken to protect public funds for a new payment system and other online transactions. Read the rest of this entry »

The month of February provided another stark reminder that cyber criminals continue to be on the prowl in online dating communities.

According to a recent Toronto Sun article, “Money scammers target online daters,” Durham Regional Police received several reports—all during the weeks following Valentine’s day—from women claiming they had been scammed by men they met online. After several months of courtship and communications with these men, women then said they were asked to wire money overseas to help with work-related charity efforts. Some women were also conned into providing personal identification and financial details to the suspects and were debited “substantial amounts of money from their personal accounts.” Read the rest of this entry »

For some time now I’ve been writing about the importance of businesses working together to combat cyber crime. Echoing this sentiment is retired Air Force General Dale Meyerrose, who sat down this week with The New New Internet to discuss the importance of building partnerships, the challenges of building those alliances, and the question of who is ultimately responsible for protecting critical infrastructures in cyberspace.

In the article, “Cybersecurity Partnerships are Absolutely Critical, says Gen. Dale Meyerrose,” Meyerrose, now the VP for Cyberspace Solutions at Harris Corporation, expressed his concerns surrounding cybersecurity and the economic impact of cyber crime:

“The [issue] of most concern to me is cyber crime… elements of cyber crime, particularly economically for our country, have come to the point where we need to really be concerned. There have been estimates that we’ve lost over a trillion dollars a year to cyber crime in the last couple years. And it now exceeds all other crime in terms of the amount of money.” Read the rest of this entry »

The security strategy of “defense-in-depth” allows a system or an organization to prevent an attack by coordinating complementary defense techniques, taking advantage of the strengths of each one while relying on the combination to shore up weaknesses in the others.  The end result is a more complex and nuanced system that is resilient to a much greater number of attacks.

In a similar vein, we can see that any single device recognition strategy on the Web is going to run into some serious limitations, mostly related to the quality and the variety of the data that can be collected from a browser.  There are a number of sources of data that we can use to construct a view of a device on the Web, but most of them can be manipulated, and all of them have problems with uniqueness.  How to build a system that is resilient to so much data uncertainty?  Yeah, I know you’re already a step ahead of me – we design in depth. Read the rest of this entry »

The Merchant Risk Council, which brings U.S. businesses together to help combat online fraud and abuse, is taking its experience abroad. The Seattle-based association announced that in April it will launch MRC Europe to help European merchants improve their e-payments strategies and share best practices for managing online payment risk.  The inaugural event will take place April 21 and 22 in Brussels, Belgium at the NH Hotel du Grand Sablon.

Executive Director, Tom Donlea, said expanding the merchant-led program is a natural extension for the MRC because both the U.S. and Europe share common problems associated with online payment fraud.

“U.S. and European online merchants face many of the same fraud issues, security risks and payment challenges—there are nuances that MRC Europe will adapt to best serve European merchants.”

Read the rest of this entry »

Identity fraud, and the number of its victims, continues to rise each year.

According to a recent article,  “Number of identity fraud victims jumps,” a Javelin Strategy & Research survey found that the total number of ID fraud victims in the U.S. rose to last years to 11.1 million—a 12% increase over the year before. The study also found that 2009 losses due to ID fraud totaled  $54 billion (in comparison  $48 billion in 2008).

But why, with so many anti-fraud management solutions and techniques available, does ID fraud continue to climb year-over-year? According to James Van Dyke, president and founder of Javelin, the continual evolution of technology is one of three main factors contributing to the increase of Identity fraud. Van Dyke sees online crime continuing to escalate, due to: Read the rest of this entry »

It’s been said that the best offense is a good defense. But how do you defend against something that’s always changing? That’s an important question for IT security professionals who know that it’s only a matter of time before cyber criminals find ways to take advantage of the inherent weaknesses in even the best technologies.

The harsh reality is that today’s cyber criminals are so tech savvy and innovative that staying one step ahead of them isn’t always possible. That’s why, when it comes to network security, a good defense should be made up of several different layers. That way, even if a hacker is able to exploit vulnerability in one layer of the system, he may be stopped or slowed down by another. This strategy, known as defense in depth, essentially allows organizations to protect the integrity of their systems by slowing hackers down and buying security professionals the time they need to respond to a security breach once it has occurred. This mitigates the damage that malicious hackers can do, even if they are able to make it past initial barriers. Read the rest of this entry »

A recent survey revealed that the overall perception of online fraud continues to be a growing concern for both online merchants and consumers. The result, not surprisingly, is a lack of consumer confidence and, therefore, the loss of profits for online businesses. An article, “Online retailers see fraud as a major threat,” summarizes the findings of Cybersource’s 2010 UK Online Fraud Report, and includes some eye-opening statistics about how fraud – and the perception of fraud – directly impacts the shopping habits of online consumers and the fraud policies of Internet businesses.

From the point of view of retailers, the survey found:

• 57% of merchants see online fraud as the greatest threat to their business
• Merchants expect to lose an average of 1.8% of their income to online fraud
• Merchants reject 4.6% of online orders due to suspicion of fraud

When it came to consumer attitudes about fraud, the study found:

• 71% of all consumers had concerns about online fraud
• 50% of people still don’t shop online in the UK (representing a large untapped market)
• 78% said they would never use their mobile phone to make purchases Read the rest of this entry »