Online orders are up. As noted by Business Insider, consumers spent $3.34 billion online this Black Friday, up 22 percent year over year and significantly exceeding predictions. Expect this trend to continue through the Christmas shopping season.
The rise of internet-based shopping offers a huge opportunity for cybercriminals, especially when it comes to credit cards. According to CIO, crooks are now crowdsourcing credential compromise through a “distributed guessing attack,” casting a wide net to zero in on key consumer details.
E-Commerce Evolution
Physical credit card fraud remains a problem for many companies. On average, 5.65 cents on every dollar is lost to credit card fraud, with almost half of it taking place in the U.S. Online shopping is the new sales juggernaut that issuers and retailers must effectively manage.
Consider the rise of mobile-based e-commerce. As noted by Beta News, 71 percent of consumers say they plan to make purchases using mobile this holiday season, while 43 percent will spend more than $250 via their mobile device. However, 64 percent of those surveyed said they have not installed a third-party mobile security application, yet 82 percent feel safe when shopping online.
In some cases, solid security hygiene can help prevent fraud. Consumers should only download reputable apps from authorized app stores, never click on malicious links and, according to the Iowa attorney general, opt for websites that contain the HTTPS designator in the URL. Unfortunately, though, best practices may no longer be enough.
20 Questions
How do popular retail sites limit credit card fraud? Most require multiple pieces of information to validate card use — typically card number, expiry date and card verification value (CVV) code — then limit users to a specific number of attempts to enter the correct information.
On a small scale, this works well enough. When fraudsters armed with credit card numbers, which are easily available in any Dark Web marketplace, fail to login multiple times, they are locked out of the accounts they are trying to break and cardholders are notified.
But a team of researchers at Newcastle University discovered that cybercriminals can get around this problem by leveraging stolen credit card numbers across multiple sites at once. Using its distributed guessing attack technique, the Newcastle team managed to crack card details in less than six seconds.
Distributed Guessing Attack
Empowering this effort are two key factors. First is the type of information required by the e-commerce site. Those asking for expiry data make it easy. Credit cards are typically valid for five years, giving a range of only sixty possible month/date combinations.
The second factor is the number of allowed guesses before getting locked out. For example, ferreting out the CVV is more difficult since it requires thousands of guesses. But even that remains a relatively easy endeavor, since there are at least that many shopping sites available online, many of which support 10 or 20 login attempts.
The researchers also discovered disparity between card issuers. MasterCard’s centralized payment network shut down multiple requests after less than 10 attempts regardless of website, while Visa’s distributed platform made it possible to pluck out the necessary details. And some sites that demanded address verification in addition to CVV and card number were vulnerable since some banks encoded branch details in credit cards, giving researchers a solid starting point to track down physical addresses.
Online shopping is on the rise, both through mobile and traditional desktop platforms. While users are becoming more savvy with their details, processors and e-commerce sites are inadvertently opening the door to increased online fraud. Where possible, don’t save credit data online and always follow up digital purchases with regular statement checks. Credit fraud can happen almost instantly if crooks decide to crowdsource.