Solving Online Credit Fraud Using Device Identification and Reputation

Transcription

1 Solving Online Credit Fraud Using Device Identification and Reputation White Paper July 2007

2 Solving Online Credit Fraud Using Device Identification and Reputation About this White Paper iovation has pioneered a unique device (PC, PDA, etc.) recognition and reputation technology that has been successfully used for online fraud prevention and user authentication for the past five years. This white paper describes how iovation ReputationManager can help financial institutions address the need for effective fraud management when processing online credit applications and financial transactions. The Case for Fraud Management The Internet has become a strategic customer acquisition and services distribution channel for financial services companies. Consumers are now able to apply and obtain credit online, transfer funds, trade commodities and pay bills by simply clicking a few buttons from anywhere at any time. Unfortunately, in this customer-not-present environment, it is difficult to discern real customers from fraudsters. Online fraudsters hide behind multiple virtual identities either hijacked or forged. Fraudsters work alone or in rings and repeatedly target one or multiple Web sites. Often, they apply for numerous credit accounts using different identities to avoid detection. Even if one of the accounts is caught and shut down, fraudsters simply open a new account(s) using a vast supply of easily obtainable stolen identities/credentials. As fraudsters are getting more sophisticated in their schemes, they are able to avoid getting caught by commonly deployed screening tools such as address verification systems (AVS), IP geolocation and block lists. Without the ability to uncover the hidden associations among these new credit applications and accounts, it is impossible to effectively control fraud. iovation s unique and proven fraud management approach is helping financial services companies stay ahead of fraudsters. iovation ReputationManager exposes hidden associations among credit applications/financial transactions and accounts that would otherwise appear completely unrelated. The solution identifies whether the applications/transactions originated from the same or related device(s) and uses the reputation of the device(s) to screen for fraud. ReputationManager accomplishes this without alienating legitimate customers due to the false-positive errors common with other fraud management tools. iovation technology is staying at least one step, maybe more, ahead of the fraudster community. This addresses the concern that the fraudsters will be able to circumvent the fingerprint. -Fraud Manager, iovation customer 111 SW Fifth Avenue, Suite 3200 Portland, Oregon info@iovation.com

3 Criteria for Staying Ahead of Fraudsters Given ever-changing online fraud techniques, staying ahead of fraudsters without impacting legitimate customers can be an ongoing challenge. When fighting online fraud using device identification and reputation technologies, the solution must: > Work well as a stand-alone solution and also complement existing tools > Be scalable for real-time fraud prevention > Offer forensic analysis and reporting, including velocity and suspicious activity reports > Have the ability to efficiently expose and shut down entire fraud rings > Have proven accuracy in its underlying device identification technology > Provide a range of device identification options to address differences in client environments > Have proven fraud prevention track record and negligible false positives > Have the ability to maintain the reputation of known devices and accounts > Be able to share fraud information across multiple subscribers Web sites and applications > Offer high resistance to attacks > Provide flexible integration options for supporting online processes and workflows Any solution worthy of consideration must have a proven track record that addresses these requirements. Until online businesses can verify a user s reputation without compromising personally identifiable information (PII) online fraud will continue to flourish. -Greg Pierson, iovation CEO Using Reputation to Expose Fraud: A Proven Approach Best practice fraud prevention processes often include multiple layers of fraud screening tools that complement one another. Automated screening tools and processes are fundamental to effective fraud management given the real-time and near real-time nature of most online transactions. Online fraudsters are getting very good at disguising themselves and making sure that each of their transactions appear completely unrelated. iovation catches them by focusing on the identification and the reputation of the devices that initiate the transactions. It is this unique approach of focusing on the user s device as opposed to the user behind the device that gives our clients an effective and necessary mechanism to stay ahead of fraudsters. Employing proprietary device identification and reputation technologies, iovation ReputationManager uniquely identifies Internet-enabled devices without relying on any personally identifiable information (PII). Once identified, a reputation begins to be developed for each device as it transacts online. iovation uses its device reputation repository to associate each device with account(s) or transaction(s). When fraud is suspected or confirmed against a device or account/transaction, evidence can be entered and stored against it. This information contributes to the device or account s reputation to prevent further fraudulent online transaction attempts from the offending device or account. Also, the system identifies hidden associations between the offending device or account and all other devices and accounts in the iovation repository. This process can lead to the discovery of additional fraudulent accounts that have not been discovered by existing fraud screening tools. iovation ReputationManager is a software as a service (SaaS) that can be used both as a real-time fraud management solution and a forensic fraud analysis tool. The solution is completely transparent to online users. 2

4 Existing fraud screening tools allow many related but cleverly disguised fraudulent credit applications/accounts to be approved.they can catch a small subset of fraudulent accounts without the ability to identify the hidden relationships among these accounts which are only exposed when the identification of the common device used to submit/create them is revealed.: ReputationManager augments existing tools by exposing hidden associations among accounts and devices that help identify previously undetected suspicious accounts( ) thus preventing future fraudulent transactions from those accounts and their related devices. Catching Fraud With ReputationManager A recent study by Gartner Group indicates a significant rise in new account fraud. Online thieves are able to apply for new accounts by using either stolen or fictitious identities. iovation ReputationManager guards against both new and existing account fraud. Below are some examples of how the solution can help fraud analysts become efficient in investigating fraud and automating fraud management processes: 3

5 > Velocity Analysis: Fraud analysts can monitor the ratio of device-to-account associations using the system s extensive reporting capabilities. Typically, a fraudster armed with stolen or fictitious identities uses the same or a common set of devices to open multiple new accounts. With iovation ReputationManager, the financial institution can easily establish thresholds of how many accounts may be opened by a particular device within a specified time period, thus triggering an investigation when the threshold is breached. Similarly, the financial institution can investigate a particular online account that is being accessed by too many devices over a set period of time another potential indicator of fraud.. > Device Reputation: Existing screening tools do not provide or rely on the identification and reputation of the user s device used during account origination or moving funds to/from an existing account. iovation ReputationManager leverages its historical repository containing millions of devices and associated reputations along with known suspicious associations to help stop these types of fraud. > Information Sharing: The solution further strengthens and enables proactive fraud detection for existing and new accounts. The system can use fraud evidence/reputation and associations, as entered by all subscribers in its global fraud repository, to prevent fraud even the first time a device is used to originate an account on a protected Web site. > Augmenting Existing Tools: Adding unique device identification to existing fraud screening tools enhances a fraud manager s ability to locate and catch current and potential fraud. While block-listing known fraudulent sources such as IP address, address, or account can stop fraud from previously identified sources, it does not prevent fraud from related but cleverly disguised sources that contain hidden associations to known fraud. With the help of device identification, previously assumed legitimate IP addresses, addresses and accounts that appear unrelated could be exposed as fraudulent (and added to block lists) based on the use of a common device to commit fraud. Summary iovation ReputationManager s approach of exposing hidden and suspicious associations among credit applications and accounts that otherwise appear legitimate and completely unrelated enables our clients to efficiently stop individual fraudsters and shut down entire fraud rings without impacting genuine customers. Our solution s ability to work both as a stand-alone system and also complement existing fraud screening tools supports best practice, multi-layered fraud management processes. Additional Information For more information on iovation ReputationManager, please visit or contact: iovation sales@iovation.com About iovation iovation, based in Portland, Ore., provides the Internet s first device reputation authority for companies requiring strong multi-factor authentication or experiencing significant online fraud activity. iovation has pioneered unique online frauddetection technologies that link users and their accounts with physical devices, and can share the reputation of those devices with other subscribers. iovation currently manages the reputation of millions of devices. Legal Notice: 2007 All rights reserved. iovation AccessManager, AccountLock, Device Reputation Authority are either trademarks or registered trademarks and the iovation logo is a service mark of iovation. Other product or service names mentioned herein are the trademarks of their respective owners. WP200707/01 4