Home -> Law Blog Directory -> Intellectual Property Law Blogs -> IBLS Internet Law Blog

Intellectual Property Law

: IBLS Internet Law Blog

ONLINE RETAIL FRAUD and RECOMMENDED DEFENSIVE MEASURES

By Jerry

v\:* {behavior:url(#default#VML);} o\:* {behavior:url(#default#VML);} w\:* {behavior:url(#default#VML);} .shape {behavior:url(#default#VML);} Normal 0 false false false EN-US X-NONE X-NONE /* Style Definitions */ table.MsoNormalTable {mso-style-name:"Table Normal"; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-priority:99; mso-style-qformat:yes; mso-style-parent:""; mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-para-margin-top:0in; mso-para-margin-right:0in; mso-para-margin-bottom:10.0pt; mso-para-margin-left:0in; mso-pagination:widow-orphan; font-size:11.0pt; mso-bidi-font-size:10.0pt; font-family:"Calibri","sans-serif"; mso-ascii-font-family:Calibri; mso-ascii-theme-font:minor-latin; mso-hansi-font-family:Calibri; mso-hansi-theme-font:minor-latin;}

Essay Submitted by:

Sarah Growcott,JD

Czech Republic

IBLS Diploma Graduate

Cyber Crime and Techno Torts

Online Retail Fraud and

Recommended Defensive Measures

 

Table of Contents

 

1.     Introduction

 

2.     Threats to Online Retailers

 

i.                 Payment Fraud

ii.               Fraudulent Chargebacks

iii.             Phishing

iv.             Spoofing

v.               Sophisticated Fraud

 

3.     Defensive Measures Businesses Can Take

 

a.      Pre-Screening Phase

 

i.                 3D Secure Protocol (Verified by Visa / MasterCard SecureCode)

ii.               Card Verification Devices

iii.             Digital Signatures

 

b.     Payment Phase

 

i.                 Real Time Authorization

ii.               Address Verification Systems (AVS)

iii.             Card Verification Methods (CVM)

 

c.      Post-Screening Phase

 

i.                 Use of Specialist Fraud Screening Services

ii.               Customizable Merchant Rules

iii.             Fraud Scoring Modules

iv.             Velocity of Use 

v.               Velocity of Change

vi.             Hot / Warm / Positive Lists

vii.           Out of Wallet Checks

viii.         Manual Review

 

d.     Account Integrity Phase

 

i.                 Adaptive Authentication

ii.                Post-Screen Customer Authentication Measures

iii.               CAPTCHA

iv.               Quiz Pad

 

4.     Conclusion

 

5.     Bibliography

1.  Introduction

 

In 1991, the internet was first opened to commercial use, and in the two decades since has literally changed the face of retail almost beyond recognition, the resultant new branch of ?ecommerce? (short for ?electronic commerce?) opening up new doors and modes of online transactions to businesses and consumers alike. For the first time in history, business transactions can now take place in real-time, 24/7 without any barriers of time or distance. Consumers now have near unlimited access to a diverse range of products or niche markets otherwise unavailable through traditional retail outlets, which can be purchased at the touch of button and easily traded with other consumers on C2C auction sites such Ebay or Bidz. Online businesses benefit equally from being able to market their products to a far wider audience than would be possible via a traditional ?bricks and mortar? establishment, while at the same time drastically reducing standard business overheads and thereby passing on the savings to the consumer. Today such online enterprises as Amazon, Ebay or Monster are now common household names, while most traditional high street retailers such as Tesco or John Lewis now also keep pace by offering an online purchase option to their existing customer base. Statistics show that 65% of the British population has now made a purchase online, and that internet sales have increased on average of 20% per year since 2005.[1] A recent survey conducted by Paypay also forecasts that by the year 2011 the value of internet sales will have risen to as much as £21.3 billion, as opposed to a projected £8.9 billion at the end of 2009.[2]  In other words, ecommerce has in a very short timeframe become an established and increasingly significant sector of the global marketplace.

 

However, as with all new technologies or modes of enterprise, retailing on the internet is not without an element of risk, as criminal entities have likewise quickly adapted to a new medium. By virtue of its anonymous, globalized nature, the internet can be used for good or nefarious purposes alike depending on the intentions of the individual user. The challenge for e-businesses and business with ecommerce offshoots is to therefore distinguish their legitimate customers from fraudulent entities using their websites with unlawful intent, and to keep pace with the increasing sophistication of determined cyber criminals. As an industry sector, ecommerce is at particular risk from fraud, with Visa estimating online fraud to be approximately 7 times that of fraud in the offline world.  This is due to the fact that online retailers operate via a ?card not present? (CNP) environment, through which it is not possible to check the pin number, establish the presence or appearance of the card, or verify the identity or behaviour of the buyer using the card at point of sale. While the introduction of Chip & Pin technology in the UK means that card fraud in face-to-face transactions is now at its lowest level since the collation of industry fraud losses began in 1991, by contrast online CNP fraud has risen 350% since 2000, increasing from £150.8 million to £328.4 million between 2004 and 2008 alone.[3] Likewise in the USA, Avivah Litan, a financial analyst for research firm Gartner, estimates that online fraud cost internet vendors over $700 million in lost merchandise last year alone, with the resultant retaliatory security measures put in place by internet retailers on average costing web stores between 5 ? 8% of their overall annual sales.[4]

 

Ecommerce retailers not only suffer from the highest levels of fraudulent attacks, but also receive the least protection against incurred losses. While traditional card present retailers are covered for fraud losses as long as they can be shown to have acted with due diligence, in contrast the internet merchant bears the entirety of the loss ? that of the value of goods or services sold, the resultant chargeback fee raised by the legitimate cardholder, and finally the initial transaction fees (approximately 2 ? 5%) levied by the credit card provider on the original sale. Furthermore, aside from the most newsworthy of corporate security breaches, most online retailers (especially small or medium-sized ones) enjoy little to no protection from local or national law enforcement either. Despite the recent establishment of such professional bodies as the Dedicated Cheque and Plastic Crime Unit (DCPCU) to combat card crime in the UK, when struck by online fraud, most e-businesses find that law enforcement agencies generally lack the resources or the technological savvy to pursue all but the most high-profile of cases. As a result, the onus is very much on online retailers to take defensive measures in preventing fraudulent transactions, with the term ?caveat venditor? (or ?seller beware?) the accepted maxim for those who choose to continue trading in a CNP environment.

 

This essay aims to explore the risks to merchants posed by fraudsters in the online retailing environment and detail the defensive measures ecommerce businesses may take to prevent a fraud attempt on their site from becoming a fraud attack.

 

 

 

 

 

2.  Threats to Online Retailers

 

As any seasoned internet user will undoubtedly be aware, the world wide web can be a platform for multiple scams and fraudulent activities. A glance into a typical user?s email account may, for example, contain any number of spam mails, including Nigerian 419 letters, dating scams, solicitations to click on various software links, advertisements for Viagra, phishing mails purportedly from banks / Ebay / Paypal urging immediate action on their account, offers to ?get rich quick? via various stock / investment / Business Opportunity positions and many more. Each mail in some way aims to part the recipient with his or her money, either by obtaining their username and password to sensitive sites via phishing or by obtaining funds via deception, social engineering, or the provision of worthless or even potentially harmful goods.

 

Ecommerce businesses may also be targeted by similar scams, though in this case typically with the object of obtaining goods or services under false pretences or gaining access to confidential company data, such as lists of customer credit card numbers, on a much larger scale. The myriad of scams perpetrated against online businesses are too many and various to document fully here, varying naturally as they do according to nature of site. For example, gaming sites such as PokerStars or 888.com are at risk of player collusion, bonus abuse via ?gnoming?, or the use of poker playing bots and social engineering (i.e. ponzi, side bet, chip dumping scams etc) to defraud fellow players of winnings or launder illegal funds. Online auction sites such as Ebay are equally at risk from both seller and buyer abuse in terms of feedback manipulation, the selling of counterfeit / faulty / misrepresented / non existent goods, shill bidding, triangulation and user enticements to complete the transaction off site, either through banner ads leading away from Ebay or referrals to fraudulent Escrow sites. Likewise, social networking sites such as Facebook or MySpace, which generate revenue through advertising, are put at financial risk if their users start to perceive them as an unsafe place to post personal information, leading to identity theft via false friends, phishing or PC infection through viral wall postings. Online job portals, on the other hand, need to protect against fraudulent Business Opportunity, Pyramid Schemes or money mule positions being advertised on their site and discrediting their company brand.

 

That said, threats to online retailers can in general be loosely grouped into a number of distinct categories, while ecommerce businesses across the board can to some extent take a common approach in terms of defensive measures, which I will come to discuss at a later stage. In this essay I will limit myself to exploring the threats to ecommerce retailers posed by cyber criminals attempting to defraud companies of goods or services, either via online submission of fraudulent orders or through hijack of legitimate customer accounts via phishing or social engineering. In subsequent sections I will then go on to discuss the technological and non-technological means by which ecommerce businesses can help prevent this genre of fraud from being successfully perpetrated on their site. Security attacks via technological means such as hacking, pharming, rootkits or Denial of Service attacks will not come under the scope of this essay, while likewise online threats to a company?s brand name in terms of cybersquatting, intellectual property theft and online stock manipulation will similarly not be discussed within this document.

 

For the purposes of this essay, it will be assumed that the vendor in question already practices standard "defensive computing" in terms of maintaining strong firewall protection, running regular anti-virus scans, adhering to strict data protection policies, and conducting regular employee training in safe computer usage. Larger businesses will also be assumed to be utilizing Secure Socket Protocol (SSL), Digital Certificates from Trusted Third Parties such as Verisign, and encryption tools as appropriate, as well as maintaining a dedicated IT Security department to protect the site against hacking attacks and other such security breaches.

 

Depending on the nature of the online retail site in question (B2B, B2C, C2C etc), the main categories of online fraud can therefore be classified as follows:

 

i. Payment Fraud

 

Payment fraud is perhaps the most frequent crime perpetrated against online businesses, but also one of the easiest to prevent. In a typical payment scam, smaller-scale or auction retailers may be requested to accept a cheque over online payment methods such as Paypal or Worldpay, ostensibly because the buyer does not wish or is unable to enter their credit card payments on the internet. The seller agrees and issues the goods to the buyer once the cheque has cleared. However, several days later the cheque is found to be either stolen or counterfeit and therefore bounces, leaving the seller liable to the bank for the balance. A variant of this scam is known as overpayment fraud, in which the buyer either somehow ?accidentally? issues the cheque for a higher amount than agreed, or makes an excuse for the overpayment such as that it is to cover shipping costs, for example. The seller is then requested to pay back the remainder by Western Union or bank transfer once the cheque has cleared, and several days later when the cheque bounces finds they have lost not only the goods and their monetary value, but also a significant sum of their own money as well.

 

On a B2B level, online retailers selling high-value goods or services may place trust in its business customers by allowing them the option of selecting an invoice option at the time of online order purchase. In a very small minority of cases, however, it may later be discovered that the client company in question was fraudulently established or already in liquidation at the time of sale, and that the invoice will not in fact be paid despite the goods or services having already been provided.

 

Ecommerce retailers can protect against such scams by conducting ?Know Your Customer? checks as standard, as well as not accepting cheques from unknown entities (especially those from overseas), checking all forms of money orders for signs of counterfeiting, and being alert to the behaviour of their customer ? i.e. they want the item in a hurry, or are prepared to pay in excess of the real value of the item.

ii. Fraudulent Chargebacks

Chargeback fraud is similar to non-payment fraud, except that it involves credit or debit cards rather than non-electronic payment forms such as cheques or postal orders. Chargeback occurs when a genuine cardholder disputes a transaction within a given 90 day period. A chargeback does not necessarily have to result from fraud, but can also occur when a legitimate customer disputes quality, representation or receipt of a product as well.

Chargebacks can cause major financial losses to the online merchant, as in every case a fee is levied on the business (typically about £15 - £25 depending on the provider), whatever the reason for the dispute and even if the merchant is in the right. However, a chargeback resulting from fraud (i.e. when a legitimate card holder disputes a fraudulent transaction made without his or her knowledge) is particularly damaging to the uninsured merchant. In this case the seller also loses not just the physical goods, which by this stage have already been shipped to the fraudster, but also their monetary value as well, as the funds now have to be returned to the legitimate cardholder. On top of this the merchant also has to pay the additional chargeback fees to the credit card provider. As fraudsters will typically be drawn to high-value goods, such as electronics, jewellery, mobile phones, computers etc, which they can then sell on at a profit, the resultant loss to the merchant may run into thousands, particularly if multiple fraud orders have been placed against the site at the same time. 

A further variation to this scam is ?friendly fraud?, which in itself is no less damaging to the merchant, and indeed is only ?friendly? in the sense that the card details in question were not used by a criminal third party. Rather, with ?friendly fraud? the legitimate cardholder deliberately sets out to defraud a business by purchasing high-value goods and then falsely claiming that the goods were undelivered, so ends up with both the goods and the money they originally paid for them, while the merchant is left once again with heavy losses as a result.

According to the 2008 edition of the Merchant Perspective report, 96% of online vendors believe they have fallen victim to friendly or unfriendly fraud in the past, while ecommerce fraud is estimated to have cost businesses in excess of $9.25 billion dollars in 2007 alone.[5] It is therefore in the interests on online retailers to implement a combination of all of the preventive measures discussed in the next chapter, even at a cost of sales decrease due to the increased insult rate and abandoned orders resulting from heightened security measures.

iii. Phishing

 

The terms "phishing" refers to fraudulent emails which attempt to acquire sensitive information, such as passwords and credit card details by lending the mail the format and appearance of a legitimate business communication such as a bank or ecommerce site, most frequently Ebay or Paypal.  Phishing mails are a form of social engineering attack, which by aping the appearance of a legitimate company email deceive the recipient into clicking on a fraudulent link, usually under the pretext of confirming their account or signing in to receive some important new information. On clicking on the link, the victim is then directed to a fraudulent website, where they are requested to enter their password, credit card or other sensitive information, which then ends up in the hands of the fraudsters. Phishing emails vary in sophistication from the very simplistic to the highly sophisticated, linking into code and graphics from legitimate sites.

 

Phishing poses a significant threat to online retailers, both in terms of legitimate users giving away their sensitive account information and the resultant damage to their company reputation by simple association, despite the fact that this attack was not perpetrated from within the company itself. Most major online retailers carry warnings on their sites regarding phishing mails, stating that the company itself will never ask a user to log in via an email link; however, every year a small percentage of phishing recipients will fall victim to the scam, and with each version of a phishing email being sent in bulk to mass mailing lists of millions, this alone is sufficient for fraudsters to persist in this activity. In fact, a recent Gartner report puts the cost of phishing for 2007 at $3.2 billion in the US alone.[6] 

 

iv. Spoofing

The term ?spoofing? is used to describe emails in which the sender address and other parts of the header are altered to appear as though the email originated from a different source. By manipulating the From, Return-Path and Reply-To fields of an email message, fraudsters aim to hide the true origin of spam or phishing emails and instead make it appear as if it comes from a legitimate sender. The actual email origin can in fact only be verified by viewing the header information. As with phishing, spoofing can sully a legitimate company?s reputation by fooling users in to thinking that a fraudulent mail was sent from within the firm itself, when in fact it actually originated from an outside criminal source.

v. Sophisticated Fraud

Sophisticated fraudsters may work individually or as part of a wider fraud ring, with the aim of identifying the weak points in an ecommerce company?s process and exploiting these for nefarious ends. Perpetrators in this case are intelligent, both technologically and socially savvy, and above all ? patient. Sophisticated fraudsters may work by submitting repeat orders to test dollar thresholds and scoring rules, or at vulnerable time periods such as the run up to Christmas, when they gamble that fraud screening measures may not be applied as stringently as usual due to time and / or staffing constraints. They may also employ social engineering tactics in wording their order information and subsequent communication in ways that will not generally arouse suspicion. Having established the components of a company?s fraud screening procedure, the fraudsters will then typically launch both ?morph? and / or ?multiple personality? assaults against the site. In the ?multiple personality? attack, a fraudster will typically set up several different personas with different cards and make periodic purchases over a 30 to 90 day timeframe, while in a slow ?morph? assault, the fraudster will make purchases over a longer time period, only changing the credit card, billing / shipping address etc slowly over time so as to evade detection. In each case, however, the aim of the fraudster is to keep one step ahead of the ecommerce merchant and continually test out the boundaries and thresholds that are put into place in response.

3.  Defensive Measures Businesses Can Take

 

The defensive measures an ecommerce business may choose to take depends largely on the nature of the company in question. For example, a small-scale, one-man site marketing Beanie Babies is an unlikely candidate for targeted fraud attacks, as they offer little in terms of fenceable goods. On the other extreme, online banks or corporations holding large-scale databases of sensitive information are often obliged to maintain 24/7 teams dedicated to site security alone. The majority of ecommerce sites retailing medium to high value items such as electronics, software or jewellery generally fall somewhere between these two extremes.

However much exposed to internet fraud an e-business may deem itself to be, in all cases a clearly defined anti-fraud strategy is an absolute must for any entity that chooses to trade online.  According to president of Fraud Practice Consulting, David Montague, there are several distinct phases of a strategy:  Pre-screen, Payment, Post-screen and Review. Typically the pre-screen, payment and post-screen phases are automated and occur in real-time, while the review phase is largely manual in nature.

·       The pre-screen phase is used to authenticate a customer?s identity at initial point of sale.

 

·       The payment phase involves the various checks on the payment card used, including authorization, address verification information and card security check data.

 

·       The post-screen phase is typically automated, using pre-programmed rules to distinguish legitimate orders or trusted customers from ones flagged as potentially suspicious.

 

·       The review phase includes the post-screening checks of fraud flagged orders and is typically a manual phase involving contact with the customer.

 

To this I would add an additional stage which I will term the ?account integrity? phase. This is not so much a per order phase as detailed above, but instead consists of an ongoing site overview to both ensure the security of legitimately established accounts and protect against hijack or compromise via phishing and other technological or social engineering style means.

a.  Pre-Screening Phase

 

i.  3D Secure Protocol (Verified by Visa and MasterCard SecureCode)

To minimize the risk posed by fraudulent chargebacks, online retailers may choose to incorporate Verified by Visa (VbV) and MasterCard's SecureCode into their payment process for additional customer verification. In both cases, the buyer is prompted to prove their identity by entering three letters of a pre-determined password into a designated field. There is an additional processing fee incurred for using this service; however, if retailers choose to use this program, then the majority of liability costs shift back from the business to the card issuers, so overall they should save money by reducing chargeback costs. However, online retailers also have to balance security considerations with the need to ensure a smooth transaction from the customer?s perspective and not deter sales by blocking purchases from legitimate clients who may have forgotten their VbV or SecureCode password, or whose pop-up prevention software obstruct the window from showing on the page. Furthermore, not many buyers or sellers have as yet enrolled to either program, so further fraud screening checks would still have to be performed in the meantime for the vast majority of orders until full roll-out in the future.

ii. Card Verification Devices

In card present transactions, Chip & Pin technology is now near universally applied in Europe. This technology verifies that the buyer is the rightful possessor of the card by requiring them to enter their PIN into a card reader at point of purchase. As yet Chip & Pin technology is not available for the vast majority of CNP sales; however, certain banks and payment aggregators such as Barclays and Paypal are currently rolling out handheld Remote Card Readers, whereby the cardholder is prompted to insert their card into a pre-provided portable card reader and enter their PIN to complete their purchase. On validating the PIN entered, the reader then generates a one-time use passcode, which the cardholder then enters into a designated field on the site for authentication, and the transaction is authorized. This new technology is likely to be instrumental in reducing online CNP fraud over the next 5 ? 10 years.

iii. Digital Signatures

 

Full post as published by IBLS Internet Law Blog on December 01, 2009 (boomark / email).