Whether they are carefully perusing underground crimeware packages that produce the most generous profit margin, or modifying and enhancing a current online bad-boy campaign, miscreants always excel in the realm of criminal-thinking-on-steroids.
Last week, I posted my 2017 threat forecast predicting healthcare data breaches rising, insider threats increasing, more IoT exploits, attacks on new mobile malware growing, and fake retail and product apps on the rise. But there are always plenty more cybercriminal activities to pay attention to throughout the year. #epicunderstatement
Fraud is truly a never-ending story, so I wanted to touch on a few more critical developments that, while not included last week’s forecast, should definitely be on everyone’s radar.
Card-Not-Present (CNP) becomes ubiquitous
According to Radial’s Annual Holiday Fraud Index, which studied EMV, cross-border and digital gift cards, Card-Not-Present (CNP) will be the biggest security threat during the current holiday shopping season.
Radial's findings include:
- Online fraud attempts using card numbers over phones or Internet devices are up 30 percent in the last year.
- Venezuela sported the highest cross-border eCommerce attack rate at 17.04%, while the U.S. Virgin Islands has one of the lowest at 0.06%, as well as the highest order approval rates at 99.77%.
- Cross-border fraud attack rates dropped over 33 percent on Cyber Monday in 2015, as compared to the rest of the holiday season.
- After Christmas, (from December 26th to January 1st) digital gift card attacks spike dramatically. Radial found digital gift card fraud attacks are 10 times more likely to occur during the holidays and 25 times more likely the week after Christmas.
The data also shows cybercriminals took a Christmas Day break in 2015 when attack rates hit a seasonal low and “came back with a vengeance after December 25 with a final surge around the New Year.”
Mobile device fraud tactics grow
At the start of 2016, the average U.S. household held approximately 13 mobile devices, up by eight compared to 2014 when the average U.S. household held five mobile devices.
IDology recently published their 4th annual fraud report noting that mobile fraud tactics are shifting into new areas this year. These include phone number recycling, SIM swaps, cloning and SMS intercepts.
Though the bad guys constantly shift direction to stay on the path of least resistance, the following mobile fraud tactics are still quite common:
- Number porting
- ANI spoofing
- Call forwarding
- SIM cloning
- Recycling phone numbers
- Voicemail hacks
Idology recommends organizations employ robust identity verification and fraud prevention solutions with emphasis placed on mobile identity, where the identity of the mobile user remains “persistent through all the different change events that may occur as a user changes devices or carriers, ports their phone, swaps their SIM and more.”
Fake news expands
Fake news sites dominated the election cycle this year and continue to steal advertising dollars in order to generate shares and ad revenue. Though this may seem trivial in comparison to other cyber threats, the manipulation of truth can become a powerful force when placed in the wrong hands.
Fake news is based on what people want to see and not on the facts. With so many people disillusioned with mainstream media reporting, social media enthusiasts are lapping up “calls to action” and sharing fake news on social platforms across the web.
Marc Goldberg, CEO at Trust Metrics, told Ad Age "Fake news, which is a byproduct of the clickbait economy, is the same thing as other fake sites that are just sending bots. It's the same thing because they're both designed to steal advertising dollars."
Using Ghostery’s tracker map, Ad Age visited dozens of fake news sites comprised of ad sites bloated with ad tech. Looking at the amount of tags in comparison to the New York Times, which has an average of 50-60 tags per story, Ad Age discovered 196 tags in a single story at a fake news site called Clash Daily with headlines like “WIKILEAKS IS BACK!” and “Hillary Will NOT Like This,” which boasted 12.8K shares within a 3-day timeframe.
Scott Meyer, CEO of Ghostery summed it up best in saying "This a new frontier in the fraud war and it came out of a weird place."
Though 2017’s threat landscape is sure to become a long-lasting and difficult war for businesses across all sectors, companies can gain an upper hand by taking a proactive stance and never allowing bad actors to enter the front door. Of course, while a proactive approach can sometimes be perceived as paranoia, it is still more likely to lead to a better outcome than being apathetic, detached and reactive.