CNP Fraud

Occurs when a fraudster falsifies an application to acquire a credit card using an individual’s personal information. (Eg: postal intercept) Mail redirect request Replacement/Lost Card claim Hacking, data breach Identity theft affected more than 9.93 million people during Average costs per victim was $1,200, 175 hours needed to rectify the problem. ID Theft, Application Fraud & Account Takeover

Typical Online Identity Theft Fraud Cycle

Phishing Method used to acquire sensitive data (usernames, passwords and credit card details) by masquerading as a trustworthy entity in an electronic communication. Communications which purport to be from popular social web sites, auction sites, banks, online payment processors Person thinks the is genuine and clicks on link provided Normally message requests the user to authenticate or validate their banking data Redirected to website which mirrors authentication site Online

Site Cloning/Phishing Example of a Phishing Site Posing as the Official HSBC Website

Pharming Method used to redirect a website's traffic to another, fake website. Conducted by : Changing the “hosts file” on victim computer Exploitation of vulnerable DNS server software (Poisoned Server) Circumvents name lookup with its own local name to IP address mapping. A legitimate request for a sensitive website can direct the user to a fraudulent copy Eg Bank Name Online

Pharming Online

Spy-phishing combines phishing and spyware Vishing combines social engineering and telephone, mostly using Voice over IP (VoIP) to gain access to private personal and financial information Online Scams

Compromising systems and networks where CHD is stored, processed and/or transmitted Not necessarily difficult High rewards – low risk Hacking & Data Compromise

Collaborative networks of individuals with specific skills and/or access to information. They interact on Forums & Blogs where they trade: Track Data, Authentication Data, CV2, exp.date, etc… Account Numbers Personal Information Counterfeited Notes Credit Card Number Generators Software & Hardware (readers/writers, skimming equipment…) Underground Market

Identity Theft (Third Party): Large purchases; bust-0ut activity (maxing out of cards in short time periods) Social Engineering (Third Party): Attempting to find information by asking questions, or to change information through social interaction. Hijack orders by changing shipping information or changing billing data on an existing credit card account. Convenience (Third Party): Testing cards to see if they work by making small purchases at safe locations like gas stations, electronic download services, or fee-for-service locations. Identifying Fraudulent Activities

Internal Fraud: Organized fraudulent activity by person or persons working in a company, sharing information on how to perpetrate fraud on conducting actual theft. Affiliate Fraud: The creation or facilitation of bad transaction in or to receive commission payments. Friendly Fraud (First Party): Transactions where fraud is claimed but the consumer is actually the legitimate account holder. Identifying Fraudulent Activities

Merchant Collusion Merchant Collusion particularly when there is a recession, times are hard etc. can be a problem. Very much seen in the past in the physical world But now happening in the internet world, where it can be carried out be triangulation where a real site links back to a fraudster site as the transaction occurs, allowing card data to be trapped and then cloned. July 16Caribbean Electronic Payments LLC13

High Risk Merchants High Risk merchants like gambling sites, pornography providers etc. have always been a target for fraudsters. If a persons card is compromised on this type of site there is reluctance to complain. This is now moving into other types of high risk areas, like prescription drugs, gaming sites and even sites like low cost airlines. July 16Caribbean Electronic Payments LLC14