opinion

How to Halt Hackers as Fraud Attacks Rise

How to Halt Hackers as Fraud Attacks Rise

For hackers, it’s often a game of trial and error. Bad actors will perform enumeration and account testing, repeating the same test on a system to look for vulnerabilities — and if you are not equipped with the proper tools, your merchant account could be the next target.

This kind of attack is most frequently conducted using automated software, trying as many different combinations as possible until they get a hit uncovering a user’s sensitive information. When it comes to credit card hacking, leaving this risk unmitigated could lead to extensive authorization fees for each attempt and even the merchant account being shut down.

The best approach is to institute as many safety measures as possible on your site, and leverage all the robust tools your service provider has in place to fight these types of fraud.

This month, we will talk about how these fraud attacks work and how you can guard your accounts.

The Threat Is Real

Over the last year, we’ve seen an increase in enumeration attacks and account testing, and we’ve seen it firsthand. Recently, one of our merchants processing through another gateway was subjected to an attack that lasted two days and resulted in close to 4 million attempted authorizations. Neither the merchant nor the gateway provider had tools in place to combat the attack.

The results were not good. The merchant identification number (MID) — the unique code that identifies a business’s merchant account used for processing debit and credit payments — had to be shut down, and the merchant was hit with exorbitant authorization fees. After the MID was turned back on 24 hours later, the merchant added additional code to their checkout flow and the gateway added additional tools to help block future attacks.

Our acquirers are also seeing an increase in these types of attacks. Even Visa now has a solution in place as part of its new Visa Acquiring Monitoring Program (VAMP), which we will share more about next month.

What to Look For

If you haven’t experienced one of these attacks yourself, you may be wondering: “How will I know if this is happening to me? What happens during an attack?” Let’s break down and define the different types of attacks.

An enumeration attack is when fraudsters systematically submit card-not-present (CNP) authorization attempts. These attacks are concentrated on a single bank identification number (BIN) or multiple BINs, and iterate through various combinations of payment values such as a primary account number (PAN), expiration date, card verification value 2 (CVV2) or postal code. These attacks succeed when the right combination of payment values returns an approval response.

Account testing attacks occur when fraudsters submit one or two low-amount transactions to test whether a payment account is active. If the account is confirmed active, the fraudsters will later use it to commit fraud. In most cases, the attack happens on multiple payment accounts with the same issuing BIN. In some instances, payment accounts that have been successfully tested are sold to others to commit fraud. This attack is also known as BIN testing, card stuffing, card tumbling or a credit master attack.

Don’t Panic, Prepare

As a merchant, there are some best practices you can put in place to protect yourself. Here are some tips directly from Visa:

  • Implement anomaly detection, which identifies anomalies early. Sudden spikes in the daily average and declined transactions should be investigated. These spikes could indicate that the business has become a target.
  • Put an alert on transactions with a large volume of approvals or declines from a similar BIN. Also have an alert on any increase in reversals being sent. Occasionally, fraudsters will immediately send a reversal after an authorization receives an approval.
  • Analyze time zone differences and browser language inconsistency with the cardholder’s IP address and device. Classify these transactions as higher risk and perform a more stringent review.
  • Make sure to include IP addresses with multiple failed card payment data in a fraud detection blacklist database for manual review, and look for multiple tracking elements in a purchase linked to the same device — for example, multiple transactions with different payment accounts that use the same email address and same device ID. These may be a trigger for fraud classification or review.
  • Look for logins for a single payment account coming from many IP addresses.
  • Review logins with suspicious passwords, or unique encrypted hashes of passwords, that hackers commonly use. Some merchants can detect fraud based on a gray list with a set or combinations of passwords used in fraudulent transactions.

Be in Control

Velocity controls are also helpful in the fight against fraud. Monitor the velocity of small and large transactions, in particular low-amount authorization-only transactions. Account testing transactions are often less than $10. Thresholds should also be set on the number of transactions within a specified timeframe. Also, always monitor the velocity on various data elements such as an IP address, device or email.

Keep an eye on things right from the start during user account creation. Make sure to limit the number of cards that can be added per account and per session, and limit the number of accounts that can be created per IP within a set time frame. Monitor the frequency of payment method changes on accounts. Be sure to utilize Captcha for user registration, since it enables web hosts to distinguish between human and automated access to websites. Lastly, terminate guest user sessions that are pending for longer than a designated amount of time.

Know Your Tools

There are many technical tools out there that can help, and most likely at least some of these are already in place through your payment facilitator or gateway. Most are set up to prevent merchants from being hit by enumeration and testing attacks, and to make it easy to quickly identify an attack and block it. With a block, garbage transactions are stopped before they are sent to acquirers and issuers, which also stops unwanted authorization fees.

Take the time to talk to your provider and ask them what tools they have in place to protect you. The best approach is to institute as many safety measures as possible on your site, and leverage all the robust tools your service provider has in place to fight these types of fraud.

Cathy Beardsley is president and CEO of Segpay, a merchant services provider offering a wide range of custom financial solutions including payment facilitator, direct merchant accounts and secure gateway services. Under her direction, Segpay has become one of four companies approved by Visa to operate as a high-risk internet payment services provider. Segpay offers secure turnkey solutions to accept online payments, with a guarantee that funds are kept safe and protected with its proprietary Fraud Mitigation System and customer service and support. For any questions or help, contact sales@segpay.com or compliance@segpay.com.

Related:  

Copyright © 2024 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More Articles

profile

VerifyMy Seeks to Provide Frictionless Online Safety, Compliance Solutions

Before founding VerifyMy, Ryan Shaw was simply looking for an age verification solution for his previous business. The ones he found, however, were too expensive, too difficult to integrate with, or failed to take into account the needs of either the businesses implementing them or the end users who would be required to interact with them.

Alejandro Freixes ·
opinion

How Adult Website Operators Can Cash in on the 'Interchange' Class Action

The Payment Card Interchange Fee Settlement resulted from a landmark antitrust lawsuit involving Visa, Mastercard and several major banks. The case centered around the interchange fees charged to merchants for processing credit and debit card transactions. These fees are set by card networks and are paid by merchants to the banks that issue the cards.

Jonathan Corona ·
opinion

It's Time to Rock the Vote and Make Your Voice Heard

When I worked to defeat California’s Proposition 60 in 2016, our opposition campaign was outspent nearly 10 to 1. Nevertheless, our community came together and garnered enough support and awareness to defeat that harmful, misguided piece of proposed legislation — by more than a million votes.

Siouxsie Q ·
opinion

Staying Compliant to Avoid the Takedown Shakedown

Dealing with complaints is an everyday part of doing business — and a crucial one, since not dealing with them properly can haunt your business in multiple ways. Card brand regulations require every merchant doing business online to have in place a complaint process for reporting content that may be illegal or that violates the card brand rules.

Cathy Beardsley ·
profile

WIA Profile: Patricia Ucros

Born in Bogota, Colombia, Ucros graduated from college with a degree in education. She spent three years teaching third grade, which she enjoyed a lot, before heeding her father’s advice and moving to South Florida.

Women In Adult ·
opinion

Creating Payment Redundancies to Maximize Payout Uptime

During the global CrowdStrike outage that took place toward the end of July, a flawed software update brought air travel and electronic commerce to a grinding halt worldwide. This dramatically underscores the importance of having a backup plan in place for critical infrastructure.

Jonathan Corona ·
opinion

The Need for Minimal Friction in Age Verification Technology

In the adult sector, robust age assurance, comprised of age verification and age estimation methods, is critical to ensuring legal compliance with ever-evolving regulations, safeguarding minors from inappropriate content and protecting the privacy of adults wishing to view adult content.

Gavin Worrall ·
opinion

Account-to-Account Payments: The New Banking Disruptor?

So much of our industry relies upon Visa and Mastercard to support consumer payments — and with that reliance comes increased scrutiny by both brands. From a compliance perspective, the bar keeps getting raised until it feels like we end up spending half our time making sure we are compliant rather than growing our business.

Cathy Beardsley ·
profile

WIA Profile: Samantha Beatrice

Beatrice credits the sex positivity of Montreal for ultimately inspiring her to pursue work in adult entertainment. She had many friends working in the industry, from sex workers to production teams, so it felt like a natural fit and offered an opportunity to apply her marketing and social media savvy to support people she truly believes in and wants to see succeed.

Women In Adult ·
opinion

Understanding the Latest Server Processors

Over the last decade, we mostly stopped talking about CPU performance. Recently, however, there has been a seismic and exciting change in the CPU landscape, due to innovation by a chip company called Advanced Micro Devices (AMD).

Brad Mitchell ·
Show More