December 6, 2016 By Douglas Bonderud 3 min read

Online orders are up. As noted by Business Insider, consumers spent $3.34 billion online this Black Friday, up 22 percent year over year and significantly exceeding predictions. Expect this trend to continue through the Christmas shopping season.

The rise of internet-based shopping offers a huge opportunity for cybercriminals, especially when it comes to credit cards. According to CIO, crooks are now crowdsourcing credential compromise through a “distributed guessing attack,” casting a wide net to zero in on key consumer details.

E-Commerce Evolution

Physical credit card fraud remains a problem for many companies. On average, 5.65 cents on every dollar is lost to credit card fraud, with almost half of it taking place in the U.S. Online shopping is the new sales juggernaut that issuers and retailers must effectively manage.

Consider the rise of mobile-based e-commerce. As noted by Beta News, 71 percent of consumers say they plan to make purchases using mobile this holiday season, while 43 percent will spend more than $250 via their mobile device. However, 64 percent of those surveyed said they have not installed a third-party mobile security application, yet 82 percent feel safe when shopping online.

In some cases, solid security hygiene can help prevent fraud. Consumers should only download reputable apps from authorized app stores, never click on malicious links and, according to the Iowa attorney general, opt for websites that contain the HTTPS designator in the URL. Unfortunately, though, best practices may no longer be enough.

20 Questions

How do popular retail sites limit credit card fraud? Most require multiple pieces of information to validate card use — typically card number, expiry date and card verification value (CVV) code — then limit users to a specific number of attempts to enter the correct information.

On a small scale, this works well enough. When fraudsters armed with credit card numbers, which are easily available in any Dark Web marketplace, fail to login multiple times, they are locked out of the accounts they are trying to break and cardholders are notified.

But a team of researchers at Newcastle University discovered that cybercriminals can get around this problem by leveraging stolen credit card numbers across multiple sites at once. Using its distributed guessing attack technique, the Newcastle team managed to crack card details in less than six seconds.

Distributed Guessing Attack

Empowering this effort are two key factors. First is the type of information required by the e-commerce site. Those asking for expiry data make it easy. Credit cards are typically valid for five years, giving a range of only sixty possible month/date combinations.

The second factor is the number of allowed guesses before getting locked out. For example, ferreting out the CVV is more difficult since it requires thousands of guesses. But even that remains a relatively easy endeavor, since there are at least that many shopping sites available online, many of which support 10 or 20 login attempts.

The researchers also discovered disparity between card issuers. MasterCard’s centralized payment network shut down multiple requests after less than 10 attempts regardless of website, while Visa’s distributed platform made it possible to pluck out the necessary details. And some sites that demanded address verification in addition to CVV and card number were vulnerable since some banks encoded branch details in credit cards, giving researchers a solid starting point to track down physical addresses.

Online shopping is on the rise, both through mobile and traditional desktop platforms. While users are becoming more savvy with their details, processors and e-commerce sites are inadvertently opening the door to increased online fraud. Where possible, don’t save credit data online and always follow up digital purchases with regular statement checks. Credit fraud can happen almost instantly if crooks decide to crowdsource.

More from

Change Healthcare discloses $22M ransomware payment

3 min read - UnitedHealth Group CEO Andrew Witty found himself answering questions in front of Congress on May 1 regarding the Change Healthcare ransomware attack that occurred in February. During the hearing, he admitted that his organization paid the attacker's ransomware request. It has been reported that the hacker organization BlackCat, also known as ALPHV, received a payment of $22 million via Bitcoin.Even though they made the ransomware payment, Witty shared that Change Healthcare did not get its data back. This is a…

Phishing kit trends and the top 10 spoofed brands of 2023

4 min read -  The 2024 IBM X-Force Threat Intelligence Index reported that phishing was one of the top initial access vectors observed last year, accounting for 30% of incidents. To carry out their phishing campaigns, attackers often use phishing kits: a collection of tools, resources and scripts that are designed and assembled to ease deployment. Each phishing kit deployment corresponds to a single phishing attack, and a kit could be redeployed many times during a phishing campaign. IBM X-Force has analyzed thousands of…

How I got started: AI security researcher

4 min read - For the enterprise, there’s no escape from deploying AI in some form. Careers focused on AI are proliferating, but one you may not be familiar with is AI security researcher. These AI specialists are cybersecurity professionals who focus on the unique vulnerabilities and threats that arise from the use of AI and machine learning (ML) systems. Their responsibilities vary, but key roles include identifying and analyzing potential security flaws in AI models and developing and testing methods malicious actors could…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today