19 August 2017
David Divitt

David Divitt

David Divitt - VocaLink

19Posts 69,741Views 14Comments

Don't underestimate the online fraudster

05 May 2010  |  3115 views  |  0

From the beginning, banks have protected their online banking businesses with basic authentication methods that required users to log-in with a username / ID number and a password to verify their identity. However, fraudsters quickly started to evade these early online fraud prevention methods by obtaining users’ passwords using social engineering techniques, keyloggers, or any number of other tools.

As a result, banks moved to multifactor authentication that required users to apply more than one form of authentication to verify the legitimacy of their log-on. However, ‘man-in-the-middle’ attacks allowed fraudsters to intercept traffic and route funds to accounts controlled to them.  To combat this, banks turned to tools such as IP profiling which identified the actual IP address of the computer being used to access an online bank account, to check it against a known blacklist of suspicious addresses, and also to see if it matches the user’s standard pattern of access.

Once fraudsters realised they couldn’t connect directly with a banks system without being detected, they began to focus more on hijacking a legitimate user’s machine by implanting code in the user’s browser to gain control of the banking session. These ‘man-in-the-browser’ attacks are capable of moving funds out of a customer’s account without the bank or the user being aware. The attacker also uses techniques to spoof windows in the real browser on a given computer meaning that the user can be completely fooled into believing their actual transaction has occurred. The presence of the Trojan is not visible to the user, as it does not interfere with normal use of the browser when visiting websites and engaging in transactions on those sites.

Banks can tackle this threat through a layered fraud prevention approach – one that analyses the log-in, the transactions, and risky sequences of events. This gives them the best chance to minimise online banking fraud and enables them to capture a broader view of customer activity to gain a complete understanding of a particular customer’s profile. This expanded view, coupled with additional fraud prevention techniques such as out-of-band communication with customers, allows institutions to better detect and prevent fraud. Only by staying one step ahead of the fraudsters will banks be able to live happily ever after.

TagsSecurity

Comments: (0)

Comment on this story (membership required)

Latest posts from David

What's the link between the price of electronics and fraud?

11 November 2013  |  2527 views  |  0 comments | recomends Recommends 2 TagsSecurityPayments

Lifecycle of a fraud

28 October 2013  |  1743 views  |  0 comments | recomends Recommends 0 TagsPaymentsRisk & regulation

Bayesian v Neural Networks

22 October 2013  |  3025 views  |  1 comments | recomends Recommends 0 TagsPaymentsRisk & regulation

What's really behind the Courier Scam?

19 August 2013  |  2781 views  |  0 comments | recomends Recommends 0 TagsSecurityPayments

Blurring the line between risk and fraud

11 March 2013  |  2803 views  |  1 comments | recomends Recommends 0 TagsSecurityRisk & regulation

David's profile

job title Senior Fraud Product Manager
location London
member since 2009
Summary profile See full profile »

David's expertise

Member since 2009
19 posts14 comments
What David reads
David's blog archive
2013 (5)2010 (10)2009 (4)

Who's commenting on David's posts