DRAFT DRAFT DRAFT THE STATE OF PHONE FRAUD A GLOBAL, CROSS-INDUSTRY THREAT

Transcription

1 THE STATE OF PHONE FRAUD A GLOBAL, CROSS-INDUSTRY THREAT

2 TABLE OF CONTENTS Executive Summary... 3 Introduction... 4 WHITE PAPER A Global Threat... 4 Fraud Rates Within And Across Borders Phone Fraud in Developing Countries 4 6 Fraud Targets: Who Is At Risk?... 7 Financial Institutions 7 Retail & E-Retail 7 Consumers 8 Cross-Industry Fraud The Bottom Line: What Is At Risk? What is Fraud Exposure? Fraud Exposure In Financial Institutions Fraud Exposure In Retail Consumer Fraud Losses Conclusion Methodology About Pindrop Labs About Pindrop Security PINDROPSECURITY.COM

3 EXECUTIVE SUMMARY Phone fraud is a multi-million dollar industry that crosses international and industry borders. Attackers target call centers, as well as consumers, in attempts to gain access to funds, steal merchandise, and phish for identities. Phone fraud is now so prevalent that the average enterprise call center is exposing more than $9 million each year to fraud. This does not include the damage fraud and other security breaches can have on the reputation of an enterprise. Pindrop Security reviewed phone fraud activity affecting financial institutions, retailers and consumers between to understand the frequency of attacks and the potential consequences of fraud. This report provides a unique view into the risk facing call centers, as well as international consumers. KEY FINDINGS: Phone fraud crosses international borders, enterprises and industries Across financial and retail institutions, 1 in every 2,200 calls is fraud, an increase of more than 30 percent since Rates of phone fraud are similar across economically developed countries, regardless of security regulations and legislation in place. Phone channel assailants use multi-pronged attacks, targeting consumers, retailers and financial institutions simultaneously. Phone fraud poses a significant fiscal risk to financial institutions Credit card issuers face the highest rate of fraud, with 1 fraud call per every 900 calls. Financial institutions risk exposing an average of $7-15 million to phone fraud per institution. When attackers are able to pass knowledge-based authentication (e.g. personal security questions), financial institutions risk major monetary losses, as well as regulatory compliance and privacy issues. Attackers are using robodialers to increase efficiency in targeting consumers 1 in 6 phone numbers calling a consumer is a robocaller. 2.5 percent of U.S. phones receive at least one robocall every week. More than 86.2 million calls per month in the U.S. are phone scams. 3 PINDROPSECURITY.COM

4 INTRODUCTION Phone fraud is a multi-million dollar industry that crosses international and industry borders. Since 2013, the rate of phone fraud has increased over 30 percent, from 1 in 2,900 calls to 1 in 2,200 calls. A GLOBAL THREAT Fraud Rates Within and Across Borders Pindrop Security s analysis shows that phone fraud rates are essentially the same in all major economically developed countries, especially the U.S. and U.K. Considering the U.K. s strict privacy and security regulations, including the broader European Union s Data Protection Directive, one might expect to see a reduced phone fraud rate. However, the similarity in the rates of U.S. versus U.K. phone fraud highlights the shortcomings in call center authentication technology, which is essentially the same across the world. Phone channel attackers are not bound by geography. In fact, 64 percent of fraud calls originate in a country other than the country of the attack target. Attackers call across international borders at 10x the rate of legitimate callers. Spoofing technology allows attackers to hide their true automatic number identification (ANI) and appear as a local call on Caller ID. This contributes to the preponderance of international fraud calls. 4 PINDROPSECURITY.COM

5 FIGURE 1: International vs. Domestic Fraud and Non-Fraud Calls Non Fraud Calls Domestic Int. Fraud Calls Domestic International 0% 20% 40% 60% 80% 100% Another factor in the increase in international fraud calls is Voice over IP (VoIP) calling. VoIP has minimized or eliminated the cost of phone calls, both domestic and international. There is evidence to suggest that VoIP service is easier to steal than other kinds of telephony service as well. VoIP is Attackers take advantage of cheap, free, and stolen VoIP, using it at a much higher rate than the general publicattackers use VoIP lines for 53 percent of their calls, compared to 7.8 percent of the general public. FIGURE 2: Device Type in Fraud vs. Non-Fraud Calls Non Fraud Calls Cell Landline VoIP Fraud Calls Cell Landline VoIP 5 PINDROPSECURITY.COM % 20% 40% 60% 80% 100%

6 Fraud Device Type Trends Attackers have been using VoIP as their preferred calling method for at least the past five years. Meanwhile, fraud originating on a mobile device has steadily risen since 2011, surpassing landline fraud to become the second most popular fraud device type. This trend mimics the rising use of mobile phones over landlines for the general public. FIGURE 3: Mobile Phone Use In Fraud and Non-Fraud Calls 50% 40% 30% 20% 10% 0% Fraud Calls Non Fraud Calls Also contributing toward this trend is the use of cheap burner phones. These are prepaid mobile phones that attackers replace frequently to avoid leaving a trail of evidence. 6 PINDROPSECURITY.COM Phone Fraud In Developing Countries In comparison to economically developed countries, phone fraud statistics are much different in developing countries. The overall phone fraud rate is markedly lower in developing countries, and the phone fraud that does occur is more local in origin. There are several reasons that could contribute to this difference: Language In countries with a lesscommon language, call centers will naturally experience more localized fraud. International attackers are most likely to attack English-speaking countries. Account Value Accounts in developing countries generally have lower account balances than those in economically developed countries. Attackers tend to target high-value accounts to get the most return for their efforts. Information Availability In economically developed countries, attackers can search social media and other Internet sites for information to socially engineer or impersonate account holders. In addition, the population of economically developed countries is more likely to use a credit card or e-payment method that can be easily stolen and sold on the black market. Countries with lower rates of Internet accessibility, or more cash payment systems experience less phone fraud.

7 FRAUD TARGETS: WHO IS AT RISK? Financial Institutions Banks, brokerages and other financial institutions are a perennially attractive target for phone fraud. These entities offer the most direct route for attackers to a profit because they deal with money directly. Yet, different types of financial institutions experience different rates of phone fraud. Banks report a fraud call rate of 1 in every 2,650 calls. Brokerages report slightly less, with only 1 in 3,000 calls being fraud. Card processors, however, experience phone fraud at nearly 3x the rate of other financial institutions, reporting 1 fraud call for every 900 calls. FIGURE 4: Fraud Rates By Financial Institution Type.12%.10%.08%.06%.04%.02% Banks Brokerages Credit Cards The high rate of phone fraud for card processors can be attributed to the fact that credit cards are one of the most common ways for the public to complete transactions, and thus card numbers are more at risk for theft. Compared to credit card numbers, banking or brokerage account numbers are less widely distributed. The less an account number is distributed across channels, the less likely it is to be at risk for fraud. Retail & E-Retail Though not quite as high as card processors, retailers and e-retailers experience phone fraud at higher rates than other industries. Retailers report one fraud call per 1,000 calls. Retailers face a specific type of phone fraud, known as chargeback fraud. Chargebacks occur when an attacker places an order using a stolen credit card. When the cardholder sees the fraudulent charge, he or she disputes it with the credit card processor and 7 PINDROPSECURITY.COM

8 receives a refund. By this time, the merchant has often already shipped the product to the attacker, ultimately losing the cost of the merchandise as well as associated shipping and administrative costs. Retailers walk a fine line in screening for potential chargeback fraud. If they receive too many chargebacks, payment processors will deem them high risk and charge increased transaction fees. However, retailers who refuse suspicious orders risk alienating legitimate customers. FIGURE 5: Retail Chargeback Fraud Consumers Attackers Favorite Products Though the rate of phone fraud for most retailers is 1 in 1,000 calls, that number changes drastically for certain product lines. Popular, expensive products that are easy to resell see much higher rates of phone fraud. For example, one large consumer electronics retailer saw phone fraud rates for Apple product orders as high as 1 in 300 calls. Attackers don t limit themselves to targeting enterprise call centers. Another lucrative path is to target consumers directly. Consumer phone scams are a growing problem and have gotten more publicity as scams, such as those spoofing the IRS and Microsoft Technical Support, have received global press coverage. More than 36 million calls per month in the U.S. can be traced to one of the 25 most popular phone scams, but Pindrop has found that there are more than 86.2 million scam calls total each month. Consumer phone scams rely on attackers casting a wide net and hoping to catch someone who is not informed of a current scam, or someone who is otherwise vulnerable (i.e. the elderly, recent immigrants, young college students, etc.). One of the most common ways attackers cast their wide net is to utilize cheap robocalling services. Some attackers use messages promising prizes, trips, free money or other goods and services to entice consumers to call back and interact. Other fraud tactics include using threatening messages, telling consumers they are behind on taxes, have missed jury duty, or are in jeopardy of being deported. 8 PINDROPSECURITY.COM

9 Pindrop research shows that 1 in 6 phone numbers calling the average consumer is a robocaller. Furthermore, 2.5 percent of U.S. phones (8.1 million in total) receive at least one robocall per week. FIGURE 6: Most Popular Phone Scams by Avg. Monthly Call Volume 9M 8M 7M 6M 5M 4M 3M 2M 1M IRS Scam Tech Support Payday Loans Auto Insurance Verizon Bank Scams Political Survey Gift Cards Government Grants Home Security Systems Auto Warranty Craigslist Scam Canadian Pharmacies Student Loans What Is Spoofing? Spoofing is the practice of manipulating the phone network to hide a true caller ID or ANI. Attackers manipulate their caller ID data to display the phone numbers of people or organizations they wish to impersonate. One of the most popular consumer phone scams involves spoofing a financial institution to phish for personal information. In the past six months, Pindrop has found over 330,000 complaints related to spoofing financial institutions. 9 PINDROPSECURITY.COM

10 Phone Fraud & The IRS In , reports of the IRS phone scam skyrocketed. Attackers impersonate IRS agents over the phone, telling taxpayers they are under investigation for tax fraud. They threaten victims with arrest if they don t immediately pay. Federal authorities claim this is the largest IRS scam they ve ever seen swindling consumers out of more than $15 million in the past two years. The US Treasury estimates the thieves have successfully victimized more than 3,000 people. The average victim loses $5,000 to this scam. Pindrop tracks IRS Scam complaints, and has found that the scam spiked in February of this year, just as tax season was beginning. FIGURE 7: IRS Scam Complaints By Month 80,000 60,000 40,000 20,000 0 Dec-14 Jan-15 Feb-15 Mar-15 Apr PINDROPSECURITY.COM Cross-Industry Fraud Phone channel attackers rarely limit their targets to a single institution, industry, or consumer. Attackers use every piece of data they can find to put together sophisticated, multi-pronged phone channel attacks. Many attacks are not looking for money directly, but rather will be phishing for information needed to successfully impersonate a consumer or institution. For example, an attacker may dial a consumer and impersonate a financial services company, claiming to be able to negotiate for lower rates on credit card debt. (In the past six months, Pindrop has found over 330,000 complaints about this scam alone.) This attacker won t ask the consumer for money. Instead, he or she will ask for account numbers, passwords, social security numbers, etc. The attacker can then call the credit card processor and pass knowledge-based authentication (KBA) for the credit card account using that information gleaned from the consumer phone call, leading to complete account takeover. As another example, a retailer might experience a point-of-sale (PoS) system data breach, like those reported to have affected Home Depot and Target in Phone channel attackers are buying information from those breaches in online black markets and using it to perform phone fraud on banks and consumers. 1 1 Krebs on Security, In Wake of Confirmed Breach at Home Depot, Banks See Spike in PIN Debit Card Fraud, September 2014.

11 FIGURE 8: Cross-Industry Fraud Example THE BOTTOM LINE: WHAT IS AT RISK? What is Fraud Exposure? When attackers are able to get past initial authentication, the entire value of the account is exposed. It is exposed not only to simple theft, but also to non-monetary attacks like account takeovers and social engineering. In addition, these accounts are exposed to regulatory privacy breaches. Fraud Exposure in Financial Institutions Fraud exposure is different than actual fraud claims or fraud losses. An attacker who impersonates a financial institution s customer over the phone and passes KBA processes may have access to an account worth $10,000 (the fraud exposure), but the attacker will often only try to move a fraction of that money to avoid a potential auto-alert system or consumer realization. Attackers understand that higher-value transactions trigger enhanced authentication challenges. The amount of money that is reported stolen is known as the fraud claim. After a fraudulent transaction has been initiated, depending on the type, institutions may be able to reverse all or part of the transaction. Only the final net loss is considered the fraud loss. 11 PINDROPSECURITY.COM

12 Few financial institutions are able to accurately measure losses to phone fraud because they simply do not tie fraud activity back to the phone channel. There are multiple levels of authentication and regulation involved in any transaction, and tracking losses as far back as the phone channel can be difficult. Furthermore, institutions that are already using Pindrop Phoneprinting TM solutions experience very little actual loss. Therefore, in this report, Pindrop measured and reported on fraud exposure. FIGURE 9: Fraud Exposure FRAUD EXPOSURE The total value of the account to which the attacker gains access FRAUD CLAIM FRAUD LOSS The amount of money the attacker moves out of an account The amount of money a bank is unable to recover following an attack The amount of fraud exposure varies according to the type of financial institution. Attackers are highly attuned to the account values at an institution. Higher account values mean more lucrative targets. Brokerages, which often hold the highest account values, lead with $15 million fraud exposure per institution annually. Credit card issuers see the second largest fraud exposure at $11 million annually, and banks the lowest at $7.6 million. 12 PINDROPSECURITY.COM FIGURE 10: Fraud Exposure By Financial Institution Type 20M 15M 10M 5M Banks Brokerages Credit Cards

13 Fraud Exposure, Orders, and Losses in Retail In the retail industry, it is slightly easier to measure the financial implications of phone fraud. In these scenarios, instead of gaining access to money in an account, attackers target material goods by placing phone orders. Here, the exposure risk is equal to the limit an attacker can place on his or her presumably stolen credit card, or the amount of credit a store is willing to allow to a caller. On average, retail call centers expose $2.40 to fraud per incoming call. Few attackers will attempt to max out their credit, as these orders would be extremely suspicious to any call center representative. Therefore, retailers report the equivalent of closer to $0.65 in actual fraudulent orders per call. One point that separates retailers from financial institutions is that retailers typically have a period of time between taking a fraudulent phone order and actually shipping the product. This gives them space to further investigate and sometimes cancel suspicious orders. For this reason, retailers actual fraud loss per call is closer to $0.17. FIGURE 9: Fraud Exposure Per Call in Retail Call Centers $2.40 $0.65 $0.17 Fraud Exposure Fraud Claim Fraud Loss Consumer Fraud Losses Consumer fraud losses are nearly impossible to identify. This is because comparatively few consumers will admit to losing money in a scam and many do not even realize that they have been scammed. When the average consumer takes a call from an attacker, their fraud exposure is only limited by the amount in his or her own bank accounts or credit. A 2014 survey found 17.6 million Americans lost $8.6 billion to phone fraud 2. The average reported loss was $ BGR, Phone scams cost Americans $8.6 billion last year - here s how to protect yourself, August PINDROPSECURITY.COM

14 CONCLUSION Fraud in the phone channel poses a significant risk to financial institutions, retailers, and consumers globally. Criminals are launching sophisticated, cross-industry attacks and are highly attuned to account value. Over the next year, as the U.S. moves to chip-and-signature card protocols, card-present fraud will become more difficult. As such, Pindrop expects attackers will shift even more attention to the phone channel, which is traditionally the least protected of the card-notpresent (CNP) channels. Call centers should begin preparing now for the increasing rate of attacks. As a first step in combating phone fraud, financial institutions and retailers should begin measuring fraud losses that can be connected to the phone channel. This will help businesses understand the true extent of their problem. In looking for solutions, Pindrop recommends that financial institutions and retailers implement fraud detection solutions that maximize their return on investment by selecting technology that is most versatile and widely effective. The technology should be usable on every call, regardless of call quality, previous enrollment or lack of voice content. It should be highly accurate, regardless of obfuscation such as voice distortion, background noise, packet loss or other common issues. Fraud detection technology should leverage many data sources, both other enterprises as well as third parties and law enforcement. This combination of requirements presents the best solution available. METHODOLOGY Phoneprinting TM Pindrop Security s patented phoneprinting technology analyzes the audio content of a phone call. Phoneprinting measures 147 characteristics of the audio signal in order to form a unique fingerprint for the call. This information provides an unprecedented level of insight into the phone channel. For this report, Pindrop analyzed millions of calls globally, using phoneprinting to dissect the details of attacker techniques and behavior. 14 PINDROPSECURITY.COM

15 Phoneypot TM The Pindrop Phoneypot is a large-scale telephony honeypot that allows researchers to collect data from millions of calls to unlisted numbers. Pindrop uses the phoneypot to detect calling patterns for unwanted callers, such as robocallers, debt collectors and telemarketers. This provides researchers with a new understanding of telephony abuse and attack patterns. Topic Modeler Pindrop collects phone scam complaint data using its Topic Modeler, a proprietary online complaint collection tool. This tool aggregates data on suspicious numbers from hundreds of complaint sites, online communities, and web forums in order to determine the types of scams affecting consumers, as well as the volume of those scams. Monitoring online complaints gives researchers access to a wealth of information: fraudulent phone numbers and ANIs, date and time of complaints, and the text content of the complaint itself. ABOUT PINDROP LABS Pindrop Labs is focused on threats and vulnerabilities in the audio and telecommunications realms. This area, traditionally neglected from a security perspective, is increasingly favored by attackers for reconnaissance, exploitation, account takeover, and other attacks. Pindrop Labs research falls into two main areas: phone fraud prevention and securing the increasingly ubiquitous voice interface. Phone fraud prevention includes security for call centers, telecommunications infrastructure, and phone-reliant systems, organizations, and consumers. Securing voice interfaces includes providing authentication, threat detection, and fraud prevention for voice-enabled infrastructure. Pindrop Labs Research Team 15 PINDROPSECURITY.COM Matt Garland, VP Research David Dewey, Director of Research Raj Bandyopadhyay, Chief Data Scientist Cesar Gonzalez-Flores, Software Engineer Matt Anthony, VP Marketing Valerie Bradford, Product Marketing Manager

16 ABOUT PINDROP SECURITY Pindrop Security, headquartered in Atlanta, Ga., is a privately-held company that provides enterprise solutions to secure phone and voice communications. Pindrop solutions reduce fraud losses and authentication expense for some of the largest banks, brokerages and retailers in the world. Pindrop s patented Phoneprinting technology can identify, locate and authenticate phone devices uniquely just from the call audio thereby detecting fraudulent calls as well as verifying legitimate callers. Named SC Magazine 2013 Rookie Security Company of the Year, a Gartner Cool Vendor in Enterprise Unified Communications and Network Services for 2012 and one of the 10 Most Innovative Companies at the 2012 RSA conference, Pindrop Security s solutions restore enterprises confidence in the security of phone-based transactions. 16 PINDROPSECURITY.COM