We’ve been talking to our customers about their biggest challenges and observations throughout the 2017 holiday season. Elie Chemaly, Director of Fraud Strategy and Investigations at Staples, spoke with us back in October about how Staples was gearing up to manage fraud, and we wanted to check back from the other side of the holiday season to learn how things went.
Elie and his team spotted several new trends this season that he wanted other retailers to be made aware of.
We typically think of fraudsters as going after a certain type of product: one that is easily monetized and has a high ticket price. This leads to many retailers writing rules to review their highest ticket-price items and most valuable, in-demand gadgets.
This year, however, Elie and his team noticed that fraudsters were changing their tactic and going after electronics with lower price points — like a $299 laptop — outside of normal trends. These lower priced items are still highly fencible, but because of higher peak season volumes a fraudulent order can blend in more easily with legitimate ones.
Because Staples adjusts their fraud models in real time, they were able to notice and to deter fraudulent “mass-market” orders once the new pattern became clear.
Zombies in Action
Another disturbing trend was new levels of sophistication in account takeover (ATO) fraud this year. Traditionally, ATO is the result of credential stuffing, when stolen username/password pairs are automatically and systematically entered into the system in order to fraudulently gain access to user accounts. These account details are generally harvested from previous data breaches.
This year, the Staples team saw an increase in situations where customer’s account was taken over through malware. In these cases, fraudsters were able to gain access to a consumer’s computer via malware downloaded from a phishing email or other message. Then, the fraudster was able to “tunnel through” the consumer’s computer in order to steal their saved credentials and access their account. In essence, this turns a consumer’s machine into a “zombie,” unwittingly performing fraud.
Because the fraud is coming from the consumer’s machine, standard detection tools like device recognition, IP address, and biometrics are not as effective. This makes it more important than ever to deeply understand the customer history, shopping patterns, SKUs and velocity.
Grooming Customer Accounts for Fraud
In the past, most account takeovers have resulted in quick-hit fraud attempts. However, more fraudsters are committing multiple counts of fraud over a longer period of time on a single customer account. A fraudster may start small with an order that is not out of ordinary for the customer’s history. Then, a few days later, they may put through more orders at a slightly higher amount. The goal is to groom these accounts for a large cash out. The fraud analyst team detects these attack trends through gap analysis leveraging multiple data sources and visual analytics to derive these insights.
Having access to a consumer’s multi-year buying history is one way to prevent this type of fraud. If they regularly make purchases of a certain amount and then suddenly make a bigger purchase, you may have a cultivated accounts take over on your hands.
Standard Identity Details Still Essential
Even with these sophisticated new types of fraud, Staples relies heavily on the essential pillars of fraud detection during the holiday season. This includes verifying basic identity details (linking name to email, name to phone, name to address, IP address proxy and distance) and other fraud tools such as device identifications and biometrics.
According to Elie, a thorough check of identity details shows no sign of slowing down in its effectiveness in preventing fraud. He noted that individual identity details aren’t enough to prevent fraud — especially when it comes to these new trends. Rather, they’re most effective when used to create a network of identity details that paint an accurate picture of your legitimate customers.
Contact Ekata to learn more about how Identity Check helps the Staples fraud team improve their fraud prevention efforts.