The many ways fraudsters abuse online retail platforms

The Covid-19 pandemic has changed how most people go about their daily routines and how businesses approach their day-to-day operations. Ecommerce and online retail, in particular, have been significantly affected by current conditions and the need to digitally transform to meet this new era of remote shopping.

Prior to the pandemic, ecommerce was the biggest driver behind Southeast Asia’s flourishing digital economy, which is projected to hit US$300 billion in gross merchandise value (GMV) by 2025. Covid-19 has accelerated this trend, with 30% of the region’s consumers increasing their online spending since we entered this new reality. In Indonesia, for example, the GMV of e-groceries is estimated to grow by 400% this year.

This growth has been helped along by many quality-of-life features, such as free-return policies and loyalty programs. Of course, promotional campaigns don’t hurt, either.

Unfortunately, the growing reliance on online retail tends to attract unsavory characters: fraudsters and abusers.

Fraud can result in losses that add up to billions of dollars and a lot of potential problems with retailers’ payment processing partners. It can also lead to false declines, where legitimate customers are declined just because anti-fraud systems are set up to reject anything that looks remotely suspicious. The pandemic has only exacerbated the situation, as many consumers have been forced to use a shipping address that isn’t tied to their bank account. This change can trigger the anti-fraud measures of legacy or rules-based fraud prevention systems when they make a purchase.

False declines result in lost revenue. According to the latest edition of Forter’s Fraud Attack Index, new customer accounts increased five-fold in the first half of the year and legacy fraud prevention systems are not equipped to accurately identify these new customers. This results in good customers being falsely declined and greater exposure to instances of fraud. On top of this, new customers are five to seven times more likely to be falsely declined than existing customers due to a lack of historical data. When a legitimate shopper is declined falsely, it can have an irreversible negative impact on revenue as it’s not just one transaction that’s lost, but potentially the lifetime value of that customer as well.

But that’s just one aspect of the modern-day fraud landscape.

Potential blind spots

“People sometimes forget that fraudsters can be sophisticated and sneaky,” says Michael Reitblat, CEO and co-founder of fraud prevention company Forter. “They understand that all the focus is on the point of transaction, so they switch their attention and try to find what’s vulnerable with any other touchpoint on the consumer’s shopping journey.”

Michael Reitblat, CEO and co-founder at Forter / Photo credit: Forter

One of these touchpoints is easily taken for granted – the simple act of having an account with the retailer. Storing credit card and shipping details in these accounts streamlines the shopping experience, but the means of authentication are usually just a username and a password. “Big data breaches are happening all the time, and a lot of those lead to username-password combinations being compromised,” says Reitblat.

He also points out that many people use the same username-password combination for different accounts on various platforms. When one account is compromised, the others also become vulnerable to security breaches.

“We’re actually seeing a major increase in account takeover cases in the last five to six months,” he adds.

Reitblat points out that contrary to popular belief, hackers aren’t always aiming for credit card details. Instead, they’re going after gift cards or stored value in user accounts, which banks can’t help to recover.

Loyalty programs are another popular target, with fraudsters taking advantage of users’ points and benefits. Consumers are far less likely to check their loyalty points the same way they would their credit card or bank accounts, so this form of fraud typically flies under the radar. Retailers are also less likely to monitor these programs, but compromised loyalty accounts can lead to increased costs. When scammers redeem points, merchants have to replace the stolen points, doubling the loss to the business.

Additionally, marketplace platforms, which are popular in Southeast Asia, present unique fraud vulnerabilities.

“Fraud happens when a fraudulent seller creates a lot of fraudulent buyer accounts to buy non-existent items from themselves using stolen credit cards,” explains Reitblat. These fake sellers can also impersonate legitimate ones to fool shoppers into purchasing from them. “It’s very hard to prevent this from the platform’s perspective. You can’t just look at the point of transaction. You really need to monitor the entire history of engagement of both sides and look for the fact that it’s actually the same person doing multiple actions,” he says.

“Savvy shopping”

Shoppers aren’t the only victims of ecommerce fraud. Retailers can suffer as well from abuse by legitimate customers. When talking about fraud, the common assumption is that it’s perpetuated by well-funded criminal organizations out to get money. However, a lot of financial damage is caused by people who simply think of themselves as “savvy shoppers.” For example, an individual can exploit a referral discount promotion by creating multiple accounts using new email addresses.

To the retailer’s marketing team, this looks like the promotion is doing well, even though the company’s actually losing money by subsidizing the same existing users repeatedly without acquiring any new ones. Because of these seemingly good results, retailers don’t think to investigate or even suspect that something has gone awry.

Another target of abuse are free-return policies. Due to the pandemic, more retailers are offering this option and more flexible returns in general to encourage sales, according to Reitblat.

“People can abuse this by buying a suit for an event or a TV for a game, and then returning it the next day,” he says. “They’re essentially using retailers as a rental store but without paying for anything since they get a full refund.” The costs of restocking products and shipping fees can add up for retailers.

Photo credit: Ivan Kruk / 123RF

Rethinking fraud prevention

Combating fraud shouldn’t be about looking for anomalies among shoppers, Reitblat says. Every customer is unique, and it can be very difficult to discern between what’s an attack and what’s just a shift in consumer behavior. Fraud prevention should also be approached as an overall problem and not just the responsibility of any single team.

“We like to think about how to detect the bad guys, but retailers need to remember to care about the good customers and their experiences,” he adds.. “Don’t let the 1% of bad actors ruin things for everyone else.” And to win in the ecommerce game, it’s more important than ever to provide a great overall experience for shoppers.

Employing a comprehensive approach to fraud prevention that monitors every point of interaction with consumers at all times is key, as fraudsters will try to sneak in between the jurisdictions of different teams. Forter provides a comprehensive solution by leveraging its Global Merchant Network, which can detect over 800 million unique users and oversees more than US$200 billion in ecommerce transactions.

“We have multiple digital vantage points on what they’re doing and their behavior, so we have a material advantage in understanding who’s who,” Reitblat points out. Having this network in place helps in another way: The moment an attack happens on one client, the others are all immunized against the same tactics.

Ultimately, despite the competitive nature of the ecommerce industry, the Forter CEO thinks that it’s important to take a big-picture view of the battle against fraud.

“Retailers don’t need to reinvent the wheel for every new kind of fraud that comes up,” Reitblat says. “We should fight fraud as a whole ecosystem so that fraudsters don’t have anywhere to run. We’re all united in this.”

Forter is a fraud prevention company whose mission is to build trust in ecommerce by eliminating fraud for online merchants and marketplaces. Find out how its approach makes the customer experience easier and more secure by visiting its website.

This content was produced by Tech in Asia Studios, which connects brands with Asia’s tech community. Learn more about partnering with Tech in Asia Studios.