“Social fakes” are invented profiles on social media (often referred to as profile misrepresentation), which can be used to harass or mock victims anonymously. But the more lucrative fake profile is one that imitates a legitimate business, damaging that business’s online reputation.

The impostors’ ultimate goal? Spam leading to scams.

Social-web security provider Impermium published the results of their recent analysis of the cost of social spam. “Online ID signup fraud” is an emerging trend, with fraudulent accounts ranging from a low of 5% to 40% of users. “Scammers are registering accounts by the millions as they perpetrate fake “friend requests,” deceptive tweets, and the like, while the black market for bulk social networking accounts is growing exponentially.”

They also warned about social web abuse, describing current “sleeper cells” as “a ticking time bomb.” Last month, more than 30,000 fraudulent accounts coordinated an attack, in which attackers submitted more than 475,000 malicious wall posts in one hour. According to Impermium, “Even accounts you’ve had for years could be lying in wait for just the right moment.”

Multiple issues stem from fake accounts, such as brand damage for both the website and its users, scams being perpetrated on existing or potential customers, and for social networking websites, an inflated, incorrect summation of active subscribers—to name a few.

Social media sites can use iovation’s device reputation service to help identify fraudsters at account setup. When a device (or related group of devices) signs up for more than your allotted number of accounts, you can receive alerts on this behavior. When multiple countries are logging into the same accounts within a specified timeframe, you can set alerts on this activity. When users are constantly changing their device attributes between multiple online registrations (to look like new, legitimate consumers), you can know this immediately—and automatically deny the new accounts outright or send them to your fraud review queue. If 1,000 accounts were just set up from the same machine, one after another, wouldn’t you want to know that while it’s happening so you can do something before the scams start?

Rather than relying on information provided by the user, which may not be honest or accurate, device reputation technology goes deeper, identifying the computer being used to register an account. This exposes negative behaviors right away, allowing a website operator to deny access to threatening accounts before your business reputation is damaged and your users are abused.

Robert Siciliano, personal security and identity theft expert contributor to iovation, discusses hackers hacking social media on Fox Boston. Disclosures

Online auction and classifieds websites are unwittingly participating in car sale scams. Ads gain credibility by appearing on eBay, Craigslist, and other online automobile sales websites, but some are either completely phony or have been copied and pasted from other websites.

The FBI’s Internet Crime Complaint Center received nearly 14,000 complaints from 2008 through 2010, from consumers who have been victimized, or at least targeted, by these auto sale scams. Of the victims who lost money, the total dollar amount is staggering: nearly $44.5 million.

The FBI explains how the scam works:

“Consumers find a vehicle they like—often at a below-market price—on a legitimate website. The buyer contacts the seller, usually through an e-mail address in the ad, to indicate their interest. The seller responds via e-mail, often with a hard-luck story about why they want to sell the vehicle and at such a good price.

In the e-mail, the seller asks the buyer to move the transaction to the website of another online company….for security reasons….and then offers a buyer protection plan in the name of a major Internet company (e.g., eBay). Through the new website, the buyer receives an invoice and is instructed to wire the funds for the vehicle to an account somewhere. In a new twist, sometimes the criminals pose as company representatives in a live chat to answer questions from buyers.

Once the funds are wired, the buyer may be asked by the seller to fax a receipt to show that the transaction has taken place. And then the seller and buyer agree upon a time for the delivery of the vehicle.”

Consumers should watch out for the following red flags:

• Cars are advertised at too-good-to-be true prices
• Sellers want to move transactions from the original website to another site
• Sellers claim that a buyer protection program offered by a major Internet company covers an auto transaction conducted outside that company’s website
• Sellers refuse to meet in person or allow potential buyers to inspect the car ahead of time
• Sellers who say they want to sell the car because they’re in the U.S. military about to be deployed, are moving, the car belonged to someone who recently died, or a similar story
• Sellers who ask for funds to be wired ahead of time

Online classified and auction websites could work together, and share information on the devices running these scams, through the device reputation service provided by iovation Inc. Their fraud detection service, called ReputationManager 360, is a B2B SaaS solution incorporating complex device identification, device reputation and real-time risk profiling. It is used by hundreds of online businesses to prevent fraud and behavioral abuse in real time by analyzing the computer, smartphone, or tablet connecting to their online properties.

iovation’s “living shared database” is used by fraud analysts daily and shares the reputations of devices from literally every country in the world. This reputation is a combination of fact-based evidence (such actual chargebacks, identity theft, online scams and account takeovers), plus what risk can be inferred at transaction time. Fraud analysts take this fight seriously and submit 10,000 events of fraud or abuse into the shared database each day.

Performing a device reputation check on a scammer attempting to create a new account at a sale or auction website would stop him before he has a chance to post advertisements for scams, preventing damage to the business and its customers. And when one of your good customers has been scammed, you can submit that evidence back into the iovation database to make sure it does not happen again, whether from the same device, or a related device.

Robert Siciliano, personal security and identity theft expert contributor to iovation, discusses scammers and thieves on The Big Idea with Donnie Deutsch. Disclosures.

Meet with Cory at iDate West

On June 22-24, the Internet Dating Conference will be taking place in Beverly Hills at the SLS Hotel. The 8th annual show assembles senior dating and social networking executives to network and share best practices.

Attendees will hear from the likes of SpeedDate, Google, Click 2 Asia, Pink Sofa, Match.com, Grindr, DatingHype.com and Mark Brooks of Online Personals Watch.

From anti-fraud experts iovation, Senior Sales Executive Cory Swick will be attending the show. Cory has been a frequent speaker at the Internet Dating events, presenting case studies and leading panels on protecting brand reputation and customers against online scams, predators and spammers.

This year Cory will be talking to online communities about the latest enhancements to iovation’s fraud-fighting service, ReputationManager 360. These recent developments include mobile SDKs (iOS and Android) and a suite of new and updated business rules that offer great flexibility and control over the activity on dating sites.  The sophisticated business rules allow sites to identify specific characteristics or behaviors at the device, account or transaction level. Business rules are combined into rule sets to manage the risk associated with different interactions on the dating site – such as profile creation or payment.

Dating sites configure and weight business rules in various categories to efficiently identify spammers and scammers, including:

• Evidence Rules – Trigger an alert when activity comes from an account or device already associated with fraud such as online scams or financial fraud.
• Geolocation Rules – Trigger an alert when activity is coming from an unauthorized country or through a proxy.
• Velocity Rules – Trigger an alert when thresholds for the number of accounts opened, or the number of devices accessing an account has been exceeded within a certain timeframe. Or perhaps when an account has been accessed by too many countries.
• Watch List Rules – Trigger alerts on your pre-defined list of attributes. These lists can be set up as positive or negative lists, depending on what result or weight you assign to the rule. Lists could include accounts, devices, IP ranges, ISP lists and more.
• Age-Based Rules – Trigger an alert based on the amount of experience that you have with a device or device-account pair. If activity comes from a device that has never previously been associated with an account in your system, you may want to offer additional authentication questions prior to giving account access.
• Anomaly Rules – While individual device characteristics may not be indicators of risk, certain characteristics are worth monitoring, or several in combination with each other may indicate attempts by the user to evade detection.
• Risk Profile Rules – Profile risk rules look at the specific combination of characteristics for the device accessing the dating site and then assess the risk by examining all other devices in iovation’s system that look similar. These profiles are based on devicesthat have accessed your dating site, as well as devices seen at any of iovation’s global client sites.

iovation has extensive experience helping online communities such as dating sites and social network stop fraud and abuse.  This greatly protects brand reputation and keeps valued customers in a safe environment.  iovation has already protected more than 2 billion dating site transactions and flagged 3 million dating activities for fraud, abuse or high-risk behavior.

If you’re attending iDate West, be sure to set aside time to talk with Cory Swick about how to ensure your online community is protected against spammers and scammers.

In the physical world, as the saying goes, “You are only as good as your word.” And when somebody says one thing and does another, we no longer trust them.

Online, people say and do things they never would in the real world. Internet anonymity fuels bad behavior. Websites’ comments sections are filled with vitriol that you’d never hear real people utter. Pedophiles who’d never approach a child on the street contact kids over the Internet. Sex offenders avoid the stigma of their label on dating sites and social media. Scammers create accounts in order to con people and businesses into forking over money. And identity thieves use your personal information to fill out online applications for credit.

All of this is made possible by the anonymity of the Internet.

As fraudsters develop more sophisticated schemes and collaborate in elaborate fraud rings, the threat of cybercrime increases. Online businesses are getting hit hard by fraud and abuse, and it’s critical that fraud protection solutions save them from significant losses and damaged reputations.

A device reputation service checks for suspect history, but also investigates for characteristics consistent with fraudulent users. And the best part is that it denies criminals, often even before their first attempt.

According to Greg Pierson, Founder and CEO of iovation, “Device reputation helps prevent identity thieves from monetizing the credentials that they have stolen. At the same time we are protecting online businesses, we’re also protecting the consumer.”

Device-based fraud management and a shared device reputation infrastructure play a critical role in identifying online fraud and abuse. Neglecting to take advantage of these tools severely limits a business’s ability to prevent fraud.

On Super Sunday weekend much of the scamming taking place is designed to separate the public from their money using the Big Game as the lure. People are seeking information on the Game and are being tackled by criminals who steal the ball.

The promise of cheerleader-filled videos along with downloadable player pictures or even Big Game memorabilia will dominate the scamverse.

Don’t get taken:

Ticket scams abound: Auction sites and Craigslist are ground zero for Scammers who buy up a few expensive tickets and, because many tickets are printed at home, the scammer just makes copies and resells the fakes to desperate buyers online or at the game.

Social media scamming: Bad guys who pose as legitimate individuals or businesses offering up Super Sunday media and post infected links that will infect the victim’s PC or network with a virus that gives hackers backdoor access.

Search poisoning: Scammers lure victims to their scam sites via search engines. When a website is created and uploaded to a server, search engines index the scam sites as they would any legitimate site. Doing a Google search can sometimes lead you to a website designed to steal your identity.

Zombie PCs: A botnet is a group of Internet-connected zombie personal computers that have been infected by a malicious application, which allows a hacker to control the infected computers without alerting the computer owners.

Scott Waddell, Vice President of Technology at iovation states, “Criminals will lure Internet users to malicious sites where malware can compromise their computers, making their systems ‘zombies’ in a global botnet. Identity data on these systems can be stolen and remote fraudsters can monitor the systems to compromise online accounts.”

Solutions like iovation’s ReputationManager 360 can identify fraudulent use of stolen accounts through geolocation rules, velocity indicators associated with identity thieves trying to quickly leverage stolen credentials, and the shared reputation view across more than 2,000 fraud fighting professionals strengthening the system every day.

According to the article, “Website offers forum on avoiding romance scams,” fraudsters continue to successfully scam unsuspecting lonely hearts by using stolen credit cards to join online dating sites and set up fake profiles. From there, they quickly lure their victims off the dating sites and onto more personal lines of communications such as instant messaging and email before romance sites can discover the stolen credit card and pull their fake profiles.

Barbara Sluppick, the founder of Romancescams.org, said the problem continues to escalate despite having more information.

“I am sorry to say scams are growing all the time. Phonebusters, the Canadian organization that deals with online scams, recently said that more money is earned in online scams than in the drug trade. Australia recently put together a commission to deal with these scams, as they have discovered their losses are topping $1 million a month.”

While Sluppick and other anti-fraud advocates are doing everything they can to educate the public about scammers and their evolving methods, including posting photos of scammers, as long as fraudsters are able to successfully bypass fraud management tools and techniques to create false identities, the industry will continue to see similar increases in online dating scams.

With scammers continuously providing new information to create multiple profiles, we cannot expect to effectively catch them with tools that solely rely on identifying the person or the false data they provide. As they evolve, so should the methods to detect them. New techniques that don’t rely on personal information to identify and stop fraud are needed to provide a defense-in-depth approach that complements and enhances online dating sites’ existing anti-fraud security strategies.

On July 20th, iovation CEO and co-founder, Greg Pierson, presented to 800 webinar registrants, a comprehensive way to detect criminal activity online, without collecting personally identifiable information (PII) or interrupting the user experience. Over 300 major brands (including more than 30 major dating site providers) use iovation’s fraud protection service to protect their members from romance scams, spam, financial fraud and many other forms of online fraud and abuse. To watch the webinar, please visit www.iovation.com/risk-mitigation.

In the article, “Internet fraud’s U.S. price tag put at $550 million,” Donald Brackman, director of the National White Collar Crime Center (NW3C), said the growing figures can be largely attributed to increasingly sophisticated online schemes and cyber criminals’ ability to hide their true identities online.

“Criminals are continuing to take full advantage of the anonymity afforded them by the Internet. They are also developing increasingly sophisticated means of defrauding unsuspecting consumers.”

FBI special agent, Charles Pavelites, added that another reason the numbers continue to climb year over year is the simple fact that more people are using the Internet than ever, which increases the overall pool of online criminals and potential victims.

Findings like these underscore the ongoing need for individuals and businesses to stay on top of emerging threats, take all necessary precautions around unsolicited emails and Web sites they’re providing personal information or making online payments on, and, of course, make sure they’re using the latest anti-virus software and solutions. The key to evolving cyber crimes is the fact that criminals are taking advantage of the latest technology and techniques to defraud anyone they can. Shouldn’t we be doing the same to protect ourselves?