Account Takeovers And Digital-Goods Fraud Attacks Show No Signs of Abating

Merchants selling digital goods were dealt a heavy blow last year as the fraud rate for the category soared 167%, finds the Fraud Attack Index from online-fraud prevention specialist Forter and the Merchant Risk Council, a merchant group that addresses fraud prevention.

Released Tuesday, the index also found that account takeovers, when criminals use consumer credentials, often stolen, to pose as legitimate customers, are on the rise. This activity increased 31% year-over-year as of the 2017 third quarter.

The increase in digital-goods fraud attack rates, at 167% from the 2017 first quarter to the 2018 first quarter, was the highest among the merchant categories cataloged in the report. The next largest increase, 66% for electronics merchants, was followed by food and beverage, 60%; jewelry and luxury goods, 38%; online travel agencies, 37%; and apparel and accessories, 7%.

One factor contributing to the increase in digital-goods frauds is the ease with which criminals can liquidate these goods, Forter says in the report. “Fraudsters favor this industry as customers are required to provide less information in comparison to physical goods,” the report says. “Retailers aim to ensure that the purchase process for digital goods is streamlined, careful not to include any friction at points where customers are expecting instant gratification.”

Fraud in the electronics sector routinely runs high. In the previous Fraud Attack Index, released in November, the rate increased 55%. The appeal of knowing these typically high-ticket items can easily be resold pushes criminals to the merchant category, Forter says.

Another major threat—account takeovers—loomed large for merchants. While Forter noted different rates of increases in 2017 (the third quarter saw a 53% increase while the fourth quarter growth rate was 8%), the vendor cautioned that account takeovers are consistently on the rise.

“Identity manipulation, however, is decreasing equivalently during the same time period,” the report says. Identity manipulation is when a criminal alters account details, such as a phone number or address, without the action being flagged as suspect. “This indicates that fraudsters seem to have figured out that stealing one’s account is more profitable than stealing an identity.”

Such activity might enable the criminal to, for example, deplete a consumer’s rewards or loyalty account without the account owner being notified, Forter says. “Fraudsters have realized this and are capitalizing on retail sites that have weak preventative methods.”