Connect with us

Expert Speak

Fraud Abroad: How SMBs Can Expand Globally and Stay Secure

Published

on

Written by Arthi Rajan Makhija, SVP of Global Fraud Risk, PayPal

One in four consumers will continue to shop from foreign online stores, even after the pandemic, according to a recent Ipsos survey of 13,000 respondents across the world’s biggest eCommerce markets. In addition, nearly three out of four (73%) UAE consumers are shopping more online than they did before the pandemic. According to the UAE Ministry of Economy, the digital economy contributes 4.3 per cent to the economy of the UAE as a whole. This shift illustrates that the time is now for all merchants to ensure their business is adaptable to the new digital economy, and ready to compete for the more than 4.28T USD global online retail market that’s expected to rapidly grow in the coming years.

The COVID-19 pandemic greatly accelerated a digital wave of change across almost every industry by three to five years. At the same time, this digital wave also presented an almost ideal scenario for online fraudsters to exploit the fear and confusion created by the pandemic as an opportunity to prey on both vulnerable consumers who are new to online shopping and the companies who are serving them. As a result, almost four in 10 UAE consumers have experienced online fraud attempts in the past year. A recent survey of 632 business leaders in the U.S. by the Ponemon Institute and sponsored by PayPal revealed that businesses were losing an average of $4.5 million a year due to fraudulent transactions. Other studies have even noted that cybercrime has become the third-largest economy behind the U.S. and China and will grow to cost the world $10.5T annually by 2025.

While there are various fraud scenarios and tactics plaguing businesses, most efforts by fraudsters are simply taking advantage of the lack of cyber hygiene. For example, criminals use basic techniques like phishing and smishing to attack both small and large companies and illegally acquire financial credentials or personally identifiable information. Unfortunately, SMBs are frequently the target of these kinds of attacks due to lack or limited resources dedicated to fraud protection, and those that sell internationally can be exposed to even greater threat vectors if they do not take the necessary precautions.

What SMBs Can Do to Help Protect Their Customers And Their Business?
Although the potential for fraud is high in online transactions, by putting the right tools and processes in place, merchants can help keep their business and customers secure, while also reducing chances of drowning in chargeback fees and lost revenues. Below are seven tips to help get started.

Stay Alert. Watch out for suspicious signs, such as an order being larger than normal or receiving an unusually large number of international orders within a short period of time. Other red flags include orders consisting of multiple requests for the same item or several orders from different customers shipping to the same address.

Use an address verification system (AVS). AVS compares the numeric parts of the billing address stored within a credit card to the address on file at the credit card company. This is a fraud tool included in most payment processing solutions but check with your payment processor to be sure it is supported. Be suspicious if a customer asks to change the shipping address after the order has been paid for. Criminals may ship orders to freight forwarders, shipping companies, P.O. boxes or vacant properties so they can remain anonymous.

Require the card verification value (CVV). You are familiar with this three- or four-digit security code printed on credit cards. What you might not know is that Payment Card Industry standards prevent you from storing the CVV along with the credit card number and card owner’s name. That is why it is so effective – it is virtually impossible for fraudsters to get it unless they have stolen a physical credit card. Most processors include a tool to require CVV as part of their checkout templates. Use it.

Use up-to-date software. Make sure you are running the latest version of your operating system (OS), as OS providers continually update their software with security patches to protect you from newly discovered vulnerabilities, as well as the latest viruses and malware. Similarly, install and regularly update business-grade anti-malware and anti-spyware software (free, limited-feature and consumer-strength anti-virus software are not sufficient) to prevent attacks that exploit outdated software vulnerabilities. Leverage software that triangulates customer location with the delivery and billing address.

Educate your customers and your employees. Educate your customers on how they can shop safely with you by not using the same password on multiple sites and prompt them to use a complex password on your site. New online shoppers can be very inexperienced and need to be reminded of security basics. Also educate your employees on the importance of protecting customer data, as criminals look for weaknesses both in systems and people.

Choose the right payment provider. Find the balance of consumer trust, hassle-free experience, and protecting your business.

Collaborate. Fraud protection should be done in partnership with in-house expertise and industry partners. Collaboration can improve the time to detection, ultimately reducing the financial and brand costs. If you are affected by fraud, do not hesitate to report it to the authorities.

Ultimately, fraud management is not only about managing your financial exposure or loss of goods. In today’s economy built on consumer trust, it is critically important that your customers can feel confident and safe when they shop with you.

 

Artificial Intelligence

How AI is Reinventing Cybersecurity for the Automotive Industry

Published

on

Written by Alain Penel, VP of Middle East, CIS & Turkey at Fortinet (more…)

Continue Reading

Cyber Security

Positive Technologies Study Reveals Successful Cyberattacks Nett 5X Profits

Published

on

Positive Technologies has released a study on the dark web market, analysing prices for illegal cybersecurity services and products, as well as the costs incurred by cybercriminals to carry out attacks. The most expensive type of malware is ransomware, with a median cost of $7,500. Zero-day exploits are particularly valuable, often being sold for millions of dollars. However, the net profit from a successful cyberattack can be five times the cost of organizing it.

Experts estimate that performing a popular phishing attack involving ransomware costs novice cybercriminals at least $20,000. First, hackers rent dedicated servers, subscribe to VPN services, and acquire other tools to build a secure and anonymous IT infrastructure to manage the attack. Attackers also need to acquire the source code of malicious software or subscribe to ready-to-use malware, as well as tools for infiltrating the victim’s system and evading detection by security measures. Moreover, cybercriminals can consult with seasoned experts, purchase access to targeted infrastructures and company data, and escalate privileges within a compromised system. Products and tools are readily available for purchase on the dark web, catering to beginners. The darknet also offers leaked malware along with detailed instructions, making it easier for novice cybercriminals to carry out attacks.

Malware is one of the primary tools in a hacker’s arsenal, with 53% of malware-related ads focused on sales. In 19% of all posts, infostealers designed to steal data are offered. Crypters and code obfuscation tools, used to help attackers hide malware from security tools, are featured in 17% of cases. Additionally, loaders are mentioned in 16% of ads. The median cost of these types of malware stands at $400, $70, and $500, respectively. The most expensive malware is ransomware: its median cost is $7,500, with some offers reaching up to $320,000. Ransomware is primarily distributed through affiliate programs, known as Ransomware-as-a-Service (RaaS), where participants in an attack typically receive 70–90% of the ransom. To become a partner, a criminal must make a contribution of 0.05 Bitcoin (approximately $5,000) and have a solid reputation on the dark web.

Another popular attack tool is exploits: 69% of exploit-related ads focus on sales, with zero-day vulnerability posts accounting for 32% of them. In 31% of cases, the cost of exploits exceeds $20,000 and can reach several million dollars. Access to corporate networks is relatively inexpensive, with 72% of such ads focused on sales, and 62% of them priced at under a thousand dollars. Among cybercriminal services, hacks are the most popular option, accounting for 49% of reports. For example, the price for compromising a personal email account starts at $100, while the cost for a corporate account begins at $200.

Dmitry Streltsov, Threat Analyst at Positive Technologies, says, “On dark web marketplaces, prices are typically determined in one of two ways: either sellers set a fixed price, or auctions are held. Auctions are often used for exclusive items, such as zero-day exploits. The platforms facilitating these deals also generate revenue, often through their own escrow services, which hold the buyer’s funds temporarily until the product or service is confirmed as delivered. On many platforms, these escrow services are managed by either administrators or trusted users with strong reputations. In return, they earn at least 4% of the transaction amount, with the forums setting the rates.”

Considering the cost of tools and services on the dark web, along with the median ransom amount, cybercriminals can achieve a net profit of $100,000–$130,000 from a successful attack—five times the cost of their preparation. For a company, such an incident can result not only in ransom costs but also in massive financial losses due to disrupted business processes. For example, in 2024, due to a ransomware attack, servers of CDK Global were down for two weeks. The company paid cybercriminals $25 million, while the financial losses of dealers due to system downtime exceeded $600 million.

Continue Reading

Expert Speak

What the Bybit Hack Reveals About the Future of Crypto Security

Published

on

Written by Oded Vanunu, Chief Technologist & Head of Product Vulnerability Research at Check Point (more…)

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.