Prepaid & Digital Goods FraudThe Misuse of Fraud Prevention Tools

Irene Brime

Head of B2B Communications

irene.brime@cashrun.com

CashRun Pte Ltd

Hillel Krajzman

VP of Operations

hillel@openbucks.com

Openbucks Corp.

Prepaid & Digital Goods FraudThe Misuse of Fraud Prevention Tools

Gain a Competitive Advantagethrough

Fraud Prevention

Merchant A Merchant B

Fraud Sales Fraud Sales

Who has an advantage?

Lesson 1

Hard Limits vs Dynamic Limits

Relying on hard limits stops fraud

Misconception

Hard Limits

3

Amount Based Time Based

Merchant only allowscustomers to buy

3 times/week or no morethan $150/month

Merchants freezecustomers account for a

period of time

Easy for fraudsters to find out threshold &

exploit

Risk losing genuine customers,

Fraudsters can create multiple accounts

Same limits onall customers

Hard Limits

Prone to exploitation by fraudsters

Lose genuine customers

X

X

Dynamic Limits

Complex for fraudsters to exploit

Capitalise on high-spending customers

Tailored limits foreach & every customer

Lesson 2

The Misuse of ManualVerification & Additional Tests

EyeballingLack of

Standardisation

Non-InstantUnacceptable

standards for Digital Products

Manual Verification

Additional Tests

SMS or OTPs

Calling customers

Requesting personal ID

Frustrated CustomersTest customers’ patienceLose genuine customers

ScalabilityFraud teams requiremore time & resources$

BottleneckLarge volume to manually verifyFraud teams overwhelmed

Negative Impacts

Merchant A

Fully automated verification

Delivers instantly

No extra tests

Merchant B

Manual verification

Calls customers

Extra tests

Manual Verification

Harms conversion rates

X

Non ScalableX

100% Automation

Retain customers

Scalable

BackwardX Increasingly relevant

Summary

Fingerprint ModuleLesson 3

The Misuse of Device Fingerprint

Modify fingerprintFraudsters

Bots &Softwares

Unsophisticated Fingerprint Detection

Module

Accepted

Deploy

Multilayered Fingerprintto detect these micro-changes

The trend is to move towards simplicity

Info from devices reduced

Plugins through NPAPI gone

Google removed NPAPI support from Chrome

Future of Device Fingerprint: Browsers

Future of Device Fingerprint: Mobile

Same screen size

Shared operating systems

Increasingly hard to return theplugins to the verification module

Increase in false positives

Simplification

Limited info returned

Summary

Combine results acrossmultiple verification areas

Comprehensive verification

Identity MappingLesson 4

The Misuse of Identity Mapping

Systems tend to score negatively when acustomer has multiple information

Fail to recognise returning customers

3 examples

Same Customer, Multiple Email Addresses

irene@gmail.com

irene@yahoo.com

irene@cashrun.com

irene@hotmail.com

Same Customer

Positive Risk Points

January2014

Same Customer, Multiple Payment Methods

X

September2014

Order #1

Name: Mr. Paul John Smith

Order #2

Name: Dr. Paul J Smith

Same Customer, Multiple Names

X

What should systems do instead?

Identify customers who use different information

Find out connections between customers

Avoid scoring negative points for such customers

Misuse of IP Blocking Rules

Lesson 5

Cyber Criminals

Fraud teamspanic

Blanket ban all orders from

specific IP address

Genuine customers

blocked

FRAUD!

When Fraud Happens…

Proxies

EvadeVerification

CorporateIP Disguise “Genuine Customer”

GenuineCustomers

MERCHANT

FraudsterGenuine

Customers

118.200.222.33127.570.232.11

FRAUD!

X

X

X X XMERCHANT

Examples

X X X X

Misuse of Information

FraudVerification

Tools

Summary of Problem

What’s the Solution?

Avoid Over Relianceon IP information:

Detrimental to Sales

IP Abnormalities are Common

IP Penetrating Technology to detect:

VMwares Fake Corporate IPs

Proxies Hosting IPs

Detrimental to sales

Over reliance on a certain area

Lesson 6

Web of Securitiesvs.

Wall of Isolation

IP Address

Blacklist

Whitelist

DeviceFingerprint

VelocityChecks

3DS

Etc.

Fraudsters Merchant

Wall of Protection Fraud Rate

MISCONCEPTION!

Fraud can be predicted with aMulti-Layered Security System

Fraud and chargebackhappen in waves

Peak Periods of Fraud

Calmer Periods

What happenswhen the wave ishigher than yourwall of protection?

The wall blocks outgenuine customers

Solution?

Web of Securities

Accepted transactions

buying limit imposed

Accepted transactions

Dynamic limit imposed

Accepted transactions

It’s not aboutHow many fraud tools you have

but

How you use them

Optimization is the key

Thank you!

Questions? Find us at booth 41

WE WANT YOUR FEEDBACK!

Please complete your session evaluation within the MRC mobile app or return a paper evaluation on your way out.

Prepaid & Digital Goods Fraud: Misuse of Fraud Prevention Tools

Speakers:Irene Brime, CashRun Pte LtdHillel Krajzman, Openbucks Corp.

Key Takeaways1) Takeaway 12) Takeaway 23) Takeaway 34) Takeaway 4