# Fraud Attack ## Index **9TH EDITION** SEPTEMBER 2020 --- ## Executive summary **2020 has been marked by significant global commerce changes due** **to the overwhelming impact of the outbreak of Coronavirus (COVID-19).** Online consumer volumes have fluctuated considerably, impacting how merchants approach their business practices and effecting how and where fraud and abuse occur. Forter’s Ninth Edition Fraud Attack Index captures the most extensive research ever conducted in this field, with over $200 billion in e-commerce transactions and the ability to identify over 800M unique users across a robust network. This report tracks and explains these changes amid an unprecedented time of global commerce. **This report highlights four major trends seen over H1 2019 - H1 2020** --- ## MAJOR TRENDS # A boom of new online users creates risk for increased false declines and fraud chargebacks New users represent new revenue potential for many merchants, but there is also potential for loss because of false declines. Traditional fraud prevention systems are not able to accurately identify the legitimacy of these new users resulting in: • Good customers being falsely declined • Greater exposure to instances of fraud a new user is 5-7x more likely to be falsely declined than a returning user --- # Online shopping replaces brick and mortar, masking the impacts of fraud For merchants that experienced unprecedented volumes of consumer transactions, fraud attacks appear to be on the decline. Sheer numbers of fraud are not necessarily decreasing, but the percentage is. **Still, fraud** **continues to advance and prevention should be prioritized.** Food Delivery & Beverage volumes **increased 93%** Grocery volumes **increased 119%** Home furnishings & garden volumes **increased 172%** --- # New channels are creating new opportunities for fraud and abuse Many merchants have been pushed to optimize both their digital and omnichannel offerings to better serve new and existing customers. However, this has exposed businesses to new vulnerabilities of fraud and abuse. Both legitimate customers and fraudsters have already started to take advantage of these under-protected areas. 55% increase in buy online pickup **increase in buy online pickup** 55% **in store (BOPIS) fraud attacks** **Policy abuse set to spike - aggressive** **promotions and omnichannel options are** **creating greater abuse risk, including** **returns, promotion and reseller abuse** --- # Fraudsters are laying the groundwork for future attacks 4.1 billion records in With focus diverted, and security precautions diminished amid remote work conditions, a perfect storm for fraud is brewing. While attack rates in account takeover decreased slightly over the past year, fraudsters are using this time to harvest and age rich account data collected through data breaches and social engineering scams to launch more impactful account-based attacks in the coming months. Also, new customer accounts opened by less experienced users are likely to use weaker passwords, fewer security steps, and be more vulnerable to Account Takeover attacks. ## Retailers need to prepare for increasing ## ATO attacks during the coming months and holiday season **Data breaches exposed** 4.1 billion records **in** **the first six months of 2019** --- ## DATA HIGHLIGHTS **Top level fraud attack statistics** Hotels 139% ↑ INCREASE IN FRAUD ATTACKS Buy online pickup in store (BOPIS) 55% ↑ INCREASE IN FRAUD ATTACKS Money services & cryptocurrency 65% ↑ INCREASE IN FRAUD ATTACKS Identity manipulation 123% ↑ INCREASE IN FRAUD ATTACKS **High fraud incident categories** Tequila Branded apparel more likely to be more likely to be more likely to be fraudulent than fraudulent than fraudulent than 7x 27x 1.5x other groceries other apparel ## Baby formula other alcohol --- ## How the global pandemic impacted fraud trends --- ## The power and risk of the new online buyer Businesses have seen an unprecedented level of net new customers, and legacy fraud systems struggle to identify legitimate new users from fraudsters due to the lack of data. **Portion of New Accounts Compared with Benchmark** ***Week 2 - 26 represents the time period beginning Jan 6 (Weeks 2-26 of 2020).** ## This results in: • Falsely declining new users at a rate 5-7x higher than returning users • Increased risk of fraud and chargebacks • Future increased exposure to account takeover attacks as new users are less savvy on safeguarding their personal data Exiting June, new users on merchant sites account for approximately 30% of overall consumer volumes versus 5% - 7% during pre-COVID-19 days. --- ## Service chargebacks versus fraud chargebacks In the early months of COVID-19, data reflected spikes in service chargebacks across many industries. Service chargebacks typically occur when customers request for charge reversals on their credit cards due to shipping, delivery, or dissatisfaction with the product or service. These chargebacks result in extraneous fees for merchants and cut into revenue. The rise in service chargebacks reflects two different phenomena: 1. Sudden spikes in overall order volume – legitimate shoppers that normally would have done their shopping in-store are beginning to overburden digital systems. 2. New users tend to expect the highest standards of service creating a gap in expectations and resulting in increased service chargeback rates. ## Contactless delivery has a greater chance of service chargebacks Instances of “fraud manifested as service chargebacks” occur as fraudsters leverage the current contactless climate to their detail. For example, in food deliveries, users can attach a note to “leave delivery outside,” or “leave by the door.” Contactless delivery fraud results in poor customer experience and legitimate customers being less likely to return to shop. Last-mile delivery costs hovered around £1.6 B (US $2 billion) for failed parcel deliveries in the UK. --- ## INDUSTRY BREAKDOWN ## Explore industry impacts: As consumers across the globe moved entirely online, the number of legitimate online transactions increased dramatically. Therefore, as a percentage of overall transactions, the proportion of fraud attacks in these affected industries appeared to have decreased. Sheer numbers of fraud are not necessarily decreasing, but the percentage is. Growing consumer transaction volumes during the timeframe reflected in this report, have served to mask fraud and abuse attacks in specific industries. Nevertheless, fraud and abuse remain persistent issues that merchants must prioritize. In industries where transaction volumes decreased, merchants were hit even harder. They lack the new consumer volumes to offset increased fraud costs, eating away at business revenue. ## Apparel & accessories Beauty Digital goods Money services & cryptocurrency Electronics Groceries Home furnishings & garden Jewelry Marketplaces Travel Variety home shoe hair dryer credit card money noodle bowl apple office chair shopping cart airplane ### APPAREL & ACCESSORIES # What’s trending in fashion this season? 51%↑ TRANSACTION VOLUMES While fraud attacks decreased slightly, fashion merchandise consistently remains a target for fraudsters as these products are easy to resell. Fraudsters target items that don’t require sizing specifications – handbags / purses, scarves, hair accessories, sunglasses, etc. These items can often be high value but are easy to resell given their universal appeal. ## $255 Average order value per fraud attack ## 61% Average declined order value is **61%** **greater** than average approved order value 1.5x Branded apparel has **fraud attacks 1.5x the** **normal rate** ### Staying fresh faced for conference calls in COVID 65%↑ TRANSACTION VOLUMES The beauty industry has seen a consistent rise both in online activity and fraud attacks over recent years. Fraudsters favor the high value products in this industry that they are able to easily resell to make a profit. Many people are working from home and upticks in video conference calls mean people are still investing in makeup and skincare products to look their best, even while social distancing. --- ### DIGITAL GOODS # What’s good in digital goods? 24%↑ TRANSACTION VOLUMES ## Fraudsters’ favorites? Gift cards. Gift cards are gaining popularity, especially for merchants in home furnishings and garden, electronics, and Quick Service Restaurants (QSRs). Prepaid gift cards are typically anonymous, transferable, and are used as a currency almost equivalent to cash, making them desirable targets for fraud. --- Digital currency gift cards have **fraud** **attacks 5x the** **normal rate** 3x Downloads (apps and music) have **fraud** **attacks 3x the** **normal rate** 2x Console games (Playstation followed by Xbox and Nintendo) have **fraud attacks 2x** **the normal rate** The most common type of gift card fraud is when stolen credit card data is used to buy gift cards online and then resold online. ## 25%-60% Gift cards are usually sold for 25% - 60% of their real value on the dark web. This is less than what they are actually worth, but still relatively high compared to most stolen goods on the dark web. --- ### ELECTRONICS # What’s next in electronics? 59%↑ TRANSACTION VOLUMES 20%↓ FRAUD ATTACKS Fraudsters favor this industry as electronics tend to be high value items that are easy to resell. Fraudsters sell the stolen goods for below-retail prices on third party sites and marketplaces while enjoying a nice pay off. ## 41% ↑ **Consumer purchase volumes for computers, tablets, and** **laptop accessories increased by 41%.** Consumer volumes in this area will continue to increase, especially as prolonged remote education and work from home orders persist. --- ### MONEY SERVICES & CRYPTOCURRENCY ## Cashing it in quickly Money services and crypto remain a growing industry and an attractive target for fraudsters. Legitimate consumers are drawn to cryptocurrency for its tech-savvy nature and forward-looking applications. For fraudsters, the easy cash out process makes this a highly desirable industry, leaving businesses with the resulting chargebacks. ## Many crypto exchanges are starting to offer “card-to-crypto” services ## – the ability to purchase crypto currencies using credit cards. Legitimate customers are looking for this service as it gives them more control over how they spend their money. However, these services come with increased risks of fraud. Fraudsters can buy crypto using stolen credit cards and enjoy added anonymity, making this type of offering an even more desirable target for fraud. --- ### FOOD DELIVERY & BEVERAGE # A taste of what’s happening in food & beverage 93%↑ TRANSACTION VOLUMES Merchants in this sector experienced higher than ever transaction volumes, leading to issues with stock, fulfillment, and delivery time frames, resulting in poor customer experience and increased service chargebacks. --- # Consistently favored for fraud attacks? Alcohol. ## Tequila One tequila, two tequila, three tequila…Floor? 27x the normal rate ## Champagne A bit of the bubbly. 17x the normal rate Cognac This brandy goes down smooth. 16x the normal rate Wine(average label) Perhaps an acquired taste? 2x < less targeted than other alcohol # What are fraudsters hungry for? 119%↑ TRANSACTION VOLUMES Grocery businesses in particular have been experiencing new patterns of consumer behaviors. Retailers should pay attention to grocery deliveries that are being serviced by third party applications. Forter data indicates that these types of platforms are at an increased risk for fraud and breached credit card information. --- # What’s risky in the grocery industry? ## Non-risky items 5x Diet drinks (of all brands) are **5x less likely to be fraudulent.** Organic groceries are **4x less likely to be fraudulent.** Least risky among the vegetables, though not surprisingly, is spinach. Kids typically hate it but parents still try to force them to eat it. This leafy green purchase is **8x less likely** **to be fraudulent.** ## Riskier items 7x Baby formula is almost **7x more likely to be fraudulent.** Reports indicate criminal syndicates (particularly in Asia) and fraud rings have been exploiting an overseas market of baby formula for a number of years. The lucrative operation has criminals holding large amounts of the baby food in order to resell the products for marked up (in some cases by 100%) prices in overseas markets. ## In other grocery news… The week following the US Administration’s suggestion that disinfectants could be used to treat Coronavirus, there was a **36% spike in the purchase of bleach products (of all brands).** This surge quickly decreased and within a week it had already declined below the previous rates. --- ### HOME FURNISHINGS & GARDEN # The comforts of home amid COVID 172%↑ TRANSACTION VOLUMES With more people at home, many are investing in DIY projects and kid-friendly toys for outdoor play including gardening kits, sandboxes, swing sets, and children’s playhouses. Purchases of outdoor exercise equipment and power tools have also increased. --- # The shine hasn’t worn off Despite slightly decreased rates of fraud attacks in this industry, online fraudsters in general tend to favor this industry since just one successful attack (given the high value per item) can yield an extremely lucrative payout. --- ### MARKETPLACES # What’s new in the market? Marketplaces are consistently an interesting industry to watch as new kinds of buyer-seller collusion often emerge and fraudsters are testing out different methods of attack. ## What’s hot in the market? ## Facemasks & sanitizer. Facemasks and sanitizers (hand and other sanitizing products) have consistently been among the most purchased items in this industry. In the early months of COVID-19, N95 masks were very popular. More recently, consumers have switched to cheaper masks, and now more “fashionable” masks that have prints or are branded are also becoming more common. --- # A quieter than usual travel season 48%↓ TRANSACTION VOLUMES 118%↑ FRAUD ATTACKS During this period, large increases in fraud attacks within subcategories of travel (flights, ground services, and hotel) highlight that while consumer demands are low, proper fraud and abuse protection need to be in place. In this industry, fraudsters took advantage early on of the “getting home” hysteria. Travelers looking to buy tickets quickly during this period were more susceptible to get defrauded by fake or stolen tickets. ## 97%↓ During the peak of the COVID-19 outbreak transaction volume for the entire travel industry showed a nearly 97% decrease. --- ## A mixed bag 29%↑ TRANSACTION VOLUMES 30%↑ FRAUD ATTACKS Variety refers to the old style stores that capture the “one-stop-shop” concept for all consumer needs. They rely on their physical presence rather than digital channels for customer engagement. However, COVID-19 conditions required these retailers to quickly shift their business approach to meet online requirements. This transformation has occurred rapidly without proper precautions in place, leaving them more vulnerable to fraud and abuse. --- ## Methods of attack # A perfect storm for fraudsters COVID-19 has forced many businesses to conduct their work remotely leading to network vulnerabilities. Fraudsters are taking advantage of recent data breaches, harvesting rich account data, and leveraging social engineering scams to exploit merchants and their customers. As retailers adjust to better accommodate shoppers, both legitimate customers and fraudsters have started to take advantage of under-protected omnichannel offerings including more flexible return policies. As things go back to normal, merchants should expect to see increases in returns fraud and abuse rates. Account takeover (ATO): → Loyalty BOPIS Collusion Policy Abuse Instrument Manipulation → Returns Coupon Abuse Repeat Offenders --- ## ACCOUNT TAKEOVER (ATO) # Let’s breach the subject of ATO 5%↓ DECREASE While there has been a slight decrease, accounts are being penetrated and breached now, with fraudsters harvesting data to use in the future, possibly during the holiday season. New online users will also contribute to this trend and are more likely to reuse passwords and take fewer precautions to safeguard their personal data. Fraud and risk managers should stay alert in the coming 4-6 months. ATO can lead to damages in brand reputation, and customer trust, resulting in lost revenue. Older, wiser, but more vulnerable... Elderly populations have become more frequent targets for account takeover fraud. Criminals will call a victim and convince them to open an account and then have them buy large ticket items (often high value jewelry or electronics), and put a shipping address that is not their own. ## $25.6B Account-focused fraud losses are expected to reach $25.6 billion in 2020. --- ## Don’t let fraudsters reap the rewards 67%↓ DECREASE Loyalty fraud has seen a significant drop, which can largely be attributed to the temporary decline of the travel industry amid the current climate. However, similar to ATO, loyalty account details are currently being stolen by fraudsters and held for future use, so merchants should prepare accordingly. 22% of consumers shop exclusively with brands of whose loyalty programs they are members. ## Account Aging As fraudsters accrue more account data during this period, merchants should remain vigilant. Fraudsters are breaching accounts and stealing personal data, using this time to “age” the accounts they steal. They are taking the time to build the account’s reputation, making it more difficult for rules-based systems or manual review teams to detect a hacked account from a legitimate one. --- ## COLLUSION # Working together to commit fraud 14%↓ DECREASE Collusion occurs most frequently in marketplace environments or gig economy platforms where fraudsters work together to boost each other’s sales. Fraudsters will post positive reviews to one another’s stores and encourage other shoppers to buy items from them. Businesses lacking identity-linking capabilities to determine the trustworthiness of their users suffer from this type of activity. ## ATO and Collusion Combo Attacks Attackers will open and age several accounts on one continent and after several weeks or months, take over other accounts on other continents. These can look like disparate acts but are often fraudsters working together to avoid detection. ## Collusion in the Gig Economy These platforms offer users temporary, flexible jobs or services. Forter has noted rising instances of collusion between the buyer/ collector. Often the MO is that they will buy an item or service with a stolen credit card and ask a connected entity to pick it up. --- ## BUY ONLINE PICKUP IN STORE (BOPIS) # BOPIS fraud 55%↑ INCREASE Buy Online Pickup In Store (BOPIS) fraud is increasingly more common as fraudsters know that retailers, in an effort to ensure seamless customer interactions, will be less likely to cause any friction at the point of pickup. Fraudsters commonly use the victim’s correct billing and personal details, ask for in-store pickup, and then appear in-store while assuming the identity of said victim. ## Delivery Abuse Some retailers have started to offer free delivery if customers pick up part of their orders in-store. However, customers are abusing this omnichannel option to capitalize on the free delivery. Instead of coming to pick up some of their order in-person, customers will simply apply the free delivery services to larger /higher value items (i.e. an expensive home appliance) and never come to the physical store to pick up the smaller and less valuable items (i.e. household cleaning supplies). --- ## RETURNS ABUSE # Reduce the abuse 43%↓ DECREASE Merchants should be prepared for this form of policy abuse – where consumers take advantage of a merchant’s return program and policies – to pick up in the coming months. In order to remain competitive in this COVID-19 environment, merchants have been more flexible with their returns policies. This includes: • **Return policy extensions.** • **No more “final sale” items.** • **Return anywhere.** As businesses go back to “normal,” there is likely to be a spike in returns fraud and abuse. Merchants should ensure they are prepared. ## Curbside Pickup Many retailers and consumers have embraced curbside pickup (also known as “click-and-collect”) as a safe alternative to in-store shopping. Merchants should keep curbside pickup as a top priority, especially as the holiday season approaches. It is likely that more shoppers will turn to online channels rather than in-store experiences. --- ## POLICY ABUSE # Keeping consumers happy 32%↓ DECREASE As customer expectations remain high and digital channels have become a more primary focus, merchants are shying away from strongly enforcing any policies that may restrict consumer interactions with their brand and potentially turn away good customers. Customers expect brands they shop at to trust them and not create barriers to their purchase process. --- ## COUPON ABUSE # A rewarding way to shop 22%↓ DECREASE Despite an overall decrease in coupon abuse, data did indicate a rise through the early days of COVID-19. This eventual decrease was a result of the plummeting activity in the travel industry where coupons are most often used. However, as noted in the Forter Fraud Attack Eighth Edition, there was a large uptick in coupon use across the food delivery, beverage, and grocery industries. They offered new customers new user promotions and loyal shoppers with added rewards points. Merchants should look for coupon and promo abuse to increase in coming months, especially during the holiday season. --- ## INSTRUMENT MANIPULATION # Rise of the robots 33%↑ INCREASE Instrument manipulation or the takeover of the entirety of the instrument itself, reflects the growing sophistication and the ease by which fraudsters are able to access more affordable mobile devices and hardware. Through burner phones, virtual machines, bots, and remote desktop protocol (RDP), fraudsters mask their activities, cloaking themselves from detection by less sophisticated fraud prevention systems. Rules-based systems and manual reviews will not be able to accurately distinguish between legitimate device use and when a device has been taken over for nefarious purposes. ## Bot Attacks Bot attacks are being dedicated to exploiting specific sites. These attacks are launched from outside the country where the business and items are sold, but they are built specifically to attack certain brands and are responsible for tens of thousands of very aggressive attacks. Smart home products including home security and alarm systems are being specifically targeted. --- ## REPEAT OFFENDERS # Fool me once... 66%↑ INCREASE More fraudsters are retrying their luck against websites whose systems have previously failed to identify their attacks. These websites often have legacy fraud systems in place leaving them more susceptible to exploitation and less capable of accurately stopping fraud. This trend also reflects the repeat targeting of newer and more vulnerable areas of the customer journey, including loyalty programs and returns policies or industries where there are influxes of consumer volumes. --- ## ON THE HORIZON... ## A taste of what’s to come this 2020 holiday season The upcoming holiday season is likely to highlight the commerce trends seen earlier this year. Many merchants attempting to recoup some of the physical / in-store losses they have felt earlier this year as a result of the COVID-19 environment will aim to capitalize on holiday consumer volumes and new shoppers. How can merchants prepare their business to catch fraud while recouping losses caused by the global pandemic? --- # Differentiate **between legitimate** **behavior and fraud at scale** Online transaction volumes are likely to soar in the coming weeks, and merchant systems will need to be prepared to meet demands at scale to capture all potential revenue. Merchants need to be able to differentiate between atypical holiday shopping behavior, new users, and fraud. Fraud prevention systems must understand new user behavior and the broader holiday context to approve legitimate transactions in real time, without impacting the customer experience **Areas of focus:** false declines, cart abandonment. --- # Deliver **new omnichannel** **experiences- securely** Shoppers who once relied on in-store interactions for all of their holiday shopping will turn to digital channels or omnichannel options. Merchants will need to ensure they not only have seamless connectivity between shopping channels to deliver on consumer demands, they’ll also need to amply protect themselves from fraudsters and good customers, looking to exploit these new offerings. **Areas of focus:** returns, policy, and delivery abuse; BORIS/BOPIS. --- # Protect **your brand from impending** **account-based attacks** With fraudsters taking advantage of diverted attention, credentials and accounts are being harvested now, and will likely be exploited during the holiday season. Ensure your fraud prevention system can assess every touch point and interaction a customer has with an online platform to catch suspicious account-based activity. If you’re only stopping fraud at checkout, you’re already too late **Areas of focus:** ATO, New account signup fraud and abuse. --- ## The way forward COVID-19 has changed global commerce. As this new era of digital commerce has begun, fraudsters have taken note. How and where fraud and abuse are committed have shifted and require merchants to alter their approach in order to better protect their business and brand. Merchants must sure their businesses are prepared to meet the new challenges of the current climate. --- ## DATA IN ACTION ## Approve more With a more sophisticated fraud prevention system in place, merchants will be able to accurately identify legitimate buyers from fraudsters when an influx of new customers hit their site. Using a fraud prevention platform powered by a global network of merchants allows retailers to leverage a wide set of data across geographies, touch points (in-person and online), industries, and clients to accurately identify legitimate consumer behavior and fraudulent behavior. This dramatically reduces false declines of good customers and protects businesses from emerging fraud and abuse trends. --- ## Prevent fraud and abuse at scale Businesses need a single, fully automated and adaptable fraud prevention platform capable of assessing trust at every point of interaction in real time. Unprecedented consumer volumes and shifts in digital interactions require a fraud prevention solution that will scale seamlessly as a merchant’s business grows and shifts. --- ## Protect new channels and offerings As companies add new channels and strategies to meet changing consumer needs, new opportunities for fraud and abuse will emerge. To support these expanding channels, merchants must be able to assess trust at every point of interaction in real time – from login, to coupon redemption, pick-up, and returns. Retailers should expect a spike in policy fraud and abuse if not amply prepared. --- ## Always stay a step ahead While many forms of fraud appear to be on the decline, increased online transaction volumes are masking the true impact of fraud, and merchants cannot rest on their laurels. Fraudsters are capitalizing on diverted attention to harvest and age account data now to launch more impactful account-based attacks in the coming months. Merchants must examine their current approach to fraud and abuse prevention now, to properly prepare for the future. The last year has seen extreme changes, and the effects are sure to linger into 2021 and beyond. **Merchants** **must examine their current approach to fraud and abuse prevention now.** --- ## ABOUT FRAUD ATTACK INDEX REPORT The **Ninth Edition of Forter’s Fraud Attack Index** highlights changes within and across the dynamic world of online commerce from H1 2019 - H1 2020. This report is based on the depth and breadth of Forter’s robust database to examine shifting behaviors and trends in online fraud attacks across global industries. With over $200 billion in e-commerce transactions and the ability to know over 800M unique users across a robust network, the Ninth Edition Forter Fraud Attack Index encapsulates the most extensive research ever conducted in this field. This report reveals fraud attack rates, rather than successful fraud, exposing current fraud and abuse patterns across a variety of global industries. This report aims to arm retailers with a deeper understanding of the current commerce climate, payment trends and rising vectors of account fraud and abuse, and to better equip them with the ability to ensure their businesses and customers are better protected from the most common fraud and abuse methods and vulnerabilities in the coming months and year. --- ## Methodological approach Our approach to data pulls involves two different measurements in order to look for patterns in the data and to best calculate fraud averages: The first methodology described will allow for data is more representative towards specific merchants and therefore, maybe much more dependent on specific phenomenon due to specific merchants. The latter methodology tends to have more fluctuations due to the fact that denominators are lower. $$ \frac{\sum^{M}i=1}{\sum^limits{M}i_{i=1}N_{i}} $$ By weighting every transaction identically, where larger merchants have a larger impact on the resulting data. Where F, is the number of fraud transactions for merchant i and N, is the number of transactions for merchant i and M is the number of the merchants. $$ \left\langle\frac{F_{i}}{N_{i}}\right\rangle $$ By weighting every merchants’ rates and averaging those rates, so that all merchants will have equal impact on the resulting data. Where F, is the number of fraud transactions for merchant i and N, is the number of transactions for merchant i and M is the number of the merchants. ---