The Mass Market Lacks Online Trust

The mass market simply does not trust the internet channel. And why should they? Every day Americans see horror stories in the news of identity theft and credit cards scams orchestrated by high-tech online fraud rings (annual fraud losses have hit the $ billions). http://www.forbes.com/sites/kellyphillipserb/2012/02/20/irs-warns-taxpayers-to-avoid-scams/

GDC Expo, March 7-9

Online sales represents only 7% of total US retail sales. http://techcrunch.com/2010/03/08/forrester-forecast-online-retail-sales-will-grow-to-250-billion-by-2014/. The Federal Reserve reports that credit cards are used more than 20 billion times a year in the U.S., with the total value of these transactions at about $1.9 trillion. A growing majority of Americans 64% report they have not made an online purchase from a specific website because of security concerns. When asked to explain why they did not make that purchase, 60% said it was because they were not sure if the site was secure, 51.4% were worried about providing information requested, and 48.4% felt a website requested more information than was necessary for the transaction. The pool found that 69.3% research potential purchases over the Internet. All this may be spun into good sounding news, but at the end of the day, the bottom line is this - after all our efforts to grow eCommerce it still only represents 7% of the total annual US credit card spend.

Top-3 Mobile Fraud Attack Vectors

1. Stolen Credit Cards: Fraudster buys a new phone using a stolen credit card. Then uses the phones for 30-45 +/- days until the victim spots the fraudulent purchase on their bank statement.

2. Account-Takeover: Fraudsters “hacks” the victims phone account online (phish username::password) so and provisions addition phones on the victims “family” plan. They then use these phones for 30 +/- days until the victim spots the fraud on their cell-phone statement.

3. Corporate Accounts: Same scenario as #2 only this is within corporate accounts, not personal accounts.

iDate-West Conference (SLS Hotel, Beverly Hills)

I just attended the iDate-West conference last week down in Los Angles. And anything and everything “mobile” seemed to be hot-hot-hot in the dating and social networking spaces. According to Courtland-Brooks, browsing and application usage on mobile phones have both risen 110% over the past 12mo. And according to Morgan-Stanley, by the year 2014 mobile devices will overtake PCs as the primary device people use to access the web. That really is not that far off into the future…

Proxy Piercing: "to pierce" or "not to pierce"?

Proxy Piercing has an interesting “marketing spin” to it, but it simply means we can acquire a PC’s actual local IP address.

In order to read a PCs local IP address and deliver it reliably back to your own servers you must execute some native code on the PC e.g. Java applet, a toolbar, or an application which will then send that IP Address back to your own servers using a TCP/IP or UDP socket connection, by-passing the HTTP data stream being sent through the proxy server. This is because all IP addresses that are passed within the x-forwarded-for string will be scrubbed (deleted) by the proxy. Alternate methods for transferring an IP address “transparently” might include methods of encrypting the IP Address using JavaScript or ActionScript into some target data field on the PC that will be transmitted within the HTTP stream’s user-agent-string. But since a “smart” proxy is going to re-write ALL of the attributes within the user-agent string, your encrypted IP data is simply going to get dropped on the floor, and lost! So this fraud management technique comes with challenges.

But is knowing the actual PC’s IP address ultimately beneficial for fraud management? If it was possible to reliably acquire the IP Address transparently (and it’s not a unroutable IP address) the answer is going to be yes only sometimes, and its usefulness is going to be temporary at best. Because, as you probably know, IP addresses are not “owned” by a PC. They are not like license plates assigned to an automobile by the DMV. IP addresses are extremely temporary, assigned by an ISP for a real-time connection. But they can be re-cycled as frequently as every time the user reboots their router e.g. possibly everyday. And when another PC is re-assigned an IP address that you have put on your block-list, then you will introduce a false-positive potentially blocking a good customer. Also if a PC is sitting behind NAT (network address translation) firewall then the PC itself will have an unroutable “local” IP Address e.g. in the range of 192.168.xxx.xxx or 10.x.x.x etc., which will basically tell you nothing.

What I have found in my experience to be the most effective fraud management technique relating to IP Addresses and their subsequent geolocation is to monitor for suspicious activity generated by the use of a proxy server, that is what will be most telling. I look for suspicious velocity changes in geolocation that is the actual result of a fraudster’s activity while using an anonymizing proxy for fraudulent and abusive objectives.

PhoCusWright Conference 2009

Are you going to the PhoCusWright Conference? If yes, then come attend my workshop on fraud http://www.miamiherald.com/business/press-releases/travel/story/1336006.html

Well I’m sitting here at SFO waiting for my flight. This is always a fun place to sit with my headphones on and doing fraud investigations; because, I’m always glancing up wondering, “have any of these people been caught by our system before?”