Cybercriminals are no longer just lone actors looking for technology weaknesses; they're strategists and technicians who take advantage of every opportunity to profit by stealing customer data, taking over accounts, and infiltrating internal business systems to rob and plunder. Today’s fraudsters can break through tough security measures to commit their crimes and disappear before you even knew they were there.

If you own or run an ecommerce website, every transaction, every new account, and every click on your website is a potential entry point for the well-armed cybercriminal. Are you prepared to handle this threat?

Ecommerce fraud is an umbrella term used to describe any form of cybercrime that occurs around online shopping. Today, about 20% of all retail transactions now occur online, while the total ecommerce industry is expected to grow to over $8 trillion in the next few years. As we make our way into 2024, the stakes couldn’t be higher when it comes to identity security and ecommerce fraud.

How Identity Threats Impact Ecommerce Fraud

With more people using ecommerce sites for common, everyday tasks like grocery shopping and purchasing clothes, fraudsters have more opportunities than ever to commit crimes. No matter the type of ecommerce business, identity is often the gateway used by bad actors to penetrate networks and access sensitive data.

The two most pervasive types of identity fraud in the ecommerce space are account takeover (ATO) and new account fraud (NAF). With ATO, bad actors seize control over established accounts by way of compromised credentials, session-hijacking, and more. When it comes to NAF, fraudsters create new accounts using fake or stolen identity information for the purpose of monetary gain.

The rise of ecommerce fraud is due, in part, to the overwhelming surge in internet traffic. This increased activity makes it challenging for ecommerce website retailers and consumers to monitor every online action. Compounding the problem is the ease with which fake online storefronts can be created and dismantled. This ability helps scammers dupe customers into believing they’re on a legitimate website so they can take over their accounts and steal their data. 

If you own or run an ecommerce site, it’s essential for you to understand the dangers that come from increased digital adoption and how cybercriminals are using advanced fraud techniques on a global level. In today’s digital world, ecommerce fraud detection is not something you can do without.

Accelerated Digital Adoption

As more of us turn to the web for everything from shopping to banking, the bad actors are upping their game. More online transactions mean more opportunities for fraudsters to wreak havoc.

Below are some recent statistics on cyber crimes and the losses they cause:

• In 2018, the Internet Crime Complaint Center (IC3) received 351,937 complaints, causing $2.7 billion in losses. In 2022, complaints received escalated to 800,914 and losses rose to $10.4 billion.²

• Internationally, Cybersecurity Ventures predict “global cybercrime damage costs” to reach “$10.5 trillion USD annually by 2025, up from $3 trillion USD in 2015.”³

These numbers speak for themselves: As we embrace the digital future, a proactive commitment to cybersecurity is not optional – it's imperative for any business with an online presence.

Advanced Fraud Techniques

New, high-tech methods have augmented tactics for committing new account fraud and account takeover (which lead to identity theft and data breaches). Today’s cybercriminals use artificial intelligence, machine learning, and bots to pull off scams on a large scale. To stay ahead of today’s fraudsters, you need to outsmart them at their own game with an aggressive fraud prevention strategy.

The Growth of Globalization

While globalization offers immense opportunities for your ecommerce business to reach international markets, it also presents a unique set of challenges when it comes to fraud prevention.

The internet’s borderless nature has given fraudsters a wider international stage to operate. Given that cybercriminals can be based in one country, use infrastructure in a second, and target victims in a third, the complexity of investigating and prosecuting these criminals has skyrocketed.

While victims of ecommerce fraud often only realize it has occurred with charges to credit cards or bank accounts, the actual crime begins much earlier. Whether it be fraudulent transactions or chargeback scams, it often begins with identity.

Before any financial transaction occurs, identity often plays a pivotal role in the earliest stages of ecommerce fraud. Whether it be ATO or NAF, identity is the gateway that allows criminals to penetrate an ecommerce site long before they ever see a buy button.

How Identity Threats Impact Ecommerce Fraud

Identity threats such as account takeover and new account fraud can impact online retailers in a variety of ways. The following are some frequent challenges that retailers face as a result of these identity-centric attacks.

There is no denying the fact that ecommerce shopping is here to stay. The more reliant the general public becomes on online shopping, the more opportunities fraudsters will have to commit crimes.

For ecommerce sites to offer the convenient and seamless experiences customers demand today, they must focus on identity. In turn, stopping fraudsters at earlier stages of their crimes will prevent fraudulent transactions and chargeback scams from occurring in the first place.

Here are a few key fraud detection and prevention strategies for the modern ecommerce space:

1. Biometrics and Behavior Analysis

Biometrics and behavior analysis are powerful tools for detecting and preventing fraud. By using physical biometrics like fingerprints to verify identity, it’s possible to avoid problems that come with compromised credentials like passwords, while behavioral biometrics look at the way users interact with their devices to help identify fraudsters and bots. For its part, behavior analysis scrutinizes user actions and transactions to detect anomalous activities that are indicative of fraud.

2. Machine Learning and AI

With the ability to quickly analyze massive amounts of data, machine learning and AI are increasingly important in the field of fraud prevention. Machine learning and AI use algorithms to identify unusual patterns in user behavior in the detection of fraud. By noting this criminal activity and making adjustments, this technology improves future fraud prevention efforts.

3. IP Tracking and Geolocation

IP tracking and geolocation also monitor user activities for irregularities to detect identity fraud in ecommerce. IP tracking traces an online transaction directly to its origin IP address. If multiple user accounts are accessing a site from the same IP address, it could be indicative of fraud. Similarly, geolocation verifies the physical location of a login or activity and compares it to locations normally used.

4. Device Tracking and Reputation

Software development kits (SDKs) can also be used as safeguards against ATO and NAF. Device tracking and reputation systems employ client SDKs to collect hardware, OS, and software attributes from devices. This information is then utilized to establish a unique device fingerprint, which enables the tracking of devices across transactions. As such, fraud is prevented when bad actors attempt to access ecommerce accounts from unfamiliar devices.

5. Velocity Checks

Velocity checks are another powerful tool for detecting malicious ATO and NAF activity. While today’s cybercriminals are both shrewd and smart, they are still often forced to attempt multiple ecommerce transactions within a short amount of time. These quick bursts of activity allow fraudsters to maximize purchases before a credit card or account is shut down. Velocity checks raise red flags for this type of activity.

6. Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) is a great option for stopping fraudsters in their tracks. With MFA, additional login methods are required in addition to standard credentials like usernames and passwords. To illustrate, authenticator apps like PingID generate one-time passwords (OTPs) on a user’s mobile device to verify their identity. Without the possession of the device associated with the user account, the fraudster is unable to authenticate.

7. Avoid Relying on Passwords

Relying on passwords to verify identity is an increasingly risky proposition. When a bad actor penetrates an account on a merchant site, it harms both the business and the consumer. Today, over 75% of data breaches occur due to lost or stolen credentials. Even more, 70% of people report using the same passwords across multiple sites. Examples of passwordless solutions include biometrics, magic links, and FIDO2.

8. Employee Training

Employees at ecommerce businesses play an essential role in keeping customer data secure from ATO and NAF. Proper training for your staff can go a long way in both detecting and preventing fraud. Things to consider for training are fraud indicators and appropriate actions to take when suspicious activity occurs. In turn, well-trained employees will help protect your company from financial losses, while also bolstering your reputation among customers.

9. Customer Education

Since ecommerce fraud is a major problem for both customers and online businesses, it's in everyone’s best interest to educate consumers on best practices for ecommerce. Topics to cover include password security practices, the use of secure Wifi sources, and caution in dealing with sensitive data in public areas. It’s also advisable to educate consumers on common threats like phishing scams to prevent NAF. Tell-tale signs of phishing scams include spelling errors, low-quality graphics, and suspicious email addresses that don’t match merchants.

10. Layered Protection

The average retailer uses 5 fraud detection tools to keep their customers safe and their business secure. Given that fact, you want to layer in your protection and make sure your fraud prevention strategy considers every source of data when making a fraud mitigation decision – and evaluates user activity from the beginning of the session, not just at the point of sale. Ultimately, using multiple tools and signals and integrating real-time mitigation will lead to better results in the battle against fraud.

The ecommerce industry has reached a critical point. On one side, there are more people than ever relying on the internet for their shopping needs. On the other end, there are sophisticated fraudsters with new and powerful tools like AI at their disposal. Some might say this is the perfect storm for cybercrime.

Advances in AI allow bad actors to scam users out of their credentials with much more efficiency. Phishing attempts are getting more sophisticated every day, and those created with generative AI may no longer exhibit telltale signs like poor grammar, spelling, or formatting. Similarly, AI-powered bots often appear quite legitimate when interacting with ecommerce sites. In the end, new AI-powered threats are emerging all the time. For ecommerce merchants, detection and prevention will likely need to be built on AI as well.

The best way to defend against fraudsters in this new environment is to embrace the fact that fraud prevention is integral to the entire user journey – from account creation to checkout. To account for this holistic approach, we will see increasing collaboration between fraud teams, DX teams, and identity teams.

As online transactions become a more significant part of our lives, the threat of fraudsters wreaking havoc grows along with it. This is why a threat prevention service like PingOne Protect is so important. PingOne Protect acts like a 24/7 security guard who's always on the lookout, offering real-time defense against fraudulent accounts and unauthorized access.

Real-time Behavior Analysis

Using a mix of artificial intelligence, machine learning, and self-learning, PingOne Protect assumes all digital traffic is a bot and starts immediately evaluating user behavior, even before the point of login or registration. This is essential for rapidly identifying potential fraud, even when cybercriminals have managed to secure valid login details.

Risk Scores

PingOne Protect generates a real-time “risk score” for every single session. Suspicious users are flagged, given a high or medium risk score, and need to pass extra layers of verification before they can continue. Low-risk scorers enjoy a hassle-free shopping experience with no additional verification. 

Unexpected Geographical Locations 

Sarah, a frequent online shopper, has always accessed her account from her hometown in the United States. Out of the blue, there's an account login from Italy – a country she has never visited. This sudden geographical shift triggers alarm bells and a high-risk score in PingOne Protect.

Rather than allowing potentially fraudulent activity to proceed, the fraud solution instantly challenges the login by sending Sarah a push notification for additional verification, such as an OTP or SMS alert. This real-time intervention ensures that Sarah's account remains secure while offering her the peace of mind that her account is protected.

New Accounts From Suspicious IP  

John is a new user, and within five minutes of creating an account, many other accounts are created from the same IP. This burst of new accounts with the same IP is an immediate red flag with PingOne Protect. 

Such rapid, high-volume account creation is a key indicator of a new account fraud scheme. The fraud solution triggers mitigation steps to freeze the accounts and begin a verification process. John receives a prompt to answer security questions and confirm his email address before any transactions can occur.

Abnormal Device Behavior

Emily has been a consistent customer, always using the same buying patterns for her mobile purchases. Suddenly, her account starts sending multiple orders to multiple, differentiated addresses, and the mobile device touches, swipes, and keyboard entries are not the movements of a “normal” human. Such activity can often signal an account takeover, where a fraudster gains control of a user's account to ship items to various locations.

Recognizing the uncharacteristic behavior, PingOne Protect immediately invokes mitigation steps that suspend the shipping process and place the transactions under manual review. By taking swift action, the automated behavioral evaluation in PingOne Protect prevents Emily from becoming a victim of account takeover and stops potentially fraudulent shipments.

Device Fingerprints

Alex is an account holder who usually accesses his online shopping account via his iPhone using the ecommerce app. PingOne Protect’s device-layer security leverages Alex’s iPhone’s device fingerprinting technology to evaluate normal and abnormal patterns. However, within a short time span, there are multiple login attempts to his account from a Windows computer and others from an Android device using the Chrome app. These vastly differing device fingerprints are a significant departure from his usual behavior.

In response, PingOne Protect scores this as a security risk and the fraud solution prompts immediate additional verification steps. Alex receives a push notification on his registered mobile device, asking him to confirm or deny the login attempts. Once Alex denies them, the account is locked down to prevent unauthorized access and Alex gets an email asking him to change his password for enhanced security. This real-time intervention allows Alex to keep control of his account and serves as an effective deterrent against fraudsters who might be attempting to gain unauthorized access.

Integrated Mitigation

Online retailers often require more than fraud detection to keep their platforms secure. With integrated mitigation, organizations strengthen their security posture by identifying and immediately responding to suspicious users and sessions.

At Ping Identity, we offer a fraud-fighting toolbox of products to complement and enhance fraud detection – such as identity verification, MFA, orchestration, and more. With PingOne for Customers, you can deliver dynamic, secure, and convenient user journeys that change with risk levels. In turn, exceptional user experiences translate into dedicated customers.

As cybercriminals grow increasingly sophisticated, businesses can no longer rely on yesterday’s security measures. Statistics point to a grim reality: ecommerce fraud is not just a possibility – it's an ever-growing threat with dire financial implications. Threat protection services like PingOne Protect offer a comprehensive response to this urgent issue.

¹ https://cybersecurityventures.com/top-5-cybersecurity-facts-figures-predictions-and-statistics-for-2021-to-2025/

² https://www.ic3.gov/

³ https://cybersecurityventures.com/cybercrime-to-cost-the-world-8-trillion-annually-in-2023/