Latest fraud schemes targeting the payments ecosystem

Threat actors have continued to exploit technical misconfigurations through various fraud schemes, according to a new report from Visa.

These include the use of malingering and search engine optimization (SEO) techniques to cultivate engaging and effective phishing and social engineering campaigns, the use of emerging advanced language modeling (ALM) technologies, and the increased targeting of verification processes.

While the global fraud rate was lower than normal expected fraud levels during the report’s time period (January – June 2023), Visa shared that it helped proactively block $30 billion in those periods. However, threat actors have been successful in executing targeted and sophisticated fraud schemes that have affected specific institutions, technology and processes.

Ransomware attacks continue to evolve

March 2023 surpassed previous ransomware attack records for most attacks in one month with nearly 460 attacks; a 91% increase over February 2023 numbers and up 62% compared to the same period in 2022. A 2023 Ransomware Report identified that exploited vulnerabilities were the most common (36%) root cause of ransomware attacks, followed by compromised credentials (29%) .

Interestingly, ransomware attacks and related threat actors do not always target payment data specifically, but will compromise any data accessible during their attacks, including payment data or personally identifiable information. The period covered in the study saw a 40% increase in summary seizures over the previous six months.

Online merchants accounted for 58% of total fraud and breach investigations, while brick and mortar merchants accounted for 20%, and ransomware/fraud scheme 7%.

Notable surge in retail specific schemes

Retail specific schemes have seen a measurable rise in the past six months, including:

Fake, Fraudulent or Counterfeit Merchants: Consumers are targeted by websites that look like their favorite merchants. These websites are set up to take customers’ orders, but do not fulfill the goods or services ordered and instead steal customers’ payment account information. The rise of malingering: Some scammers develop fake ads to try to collect personal information. Victims of these schemes are targeted by search engine optimized scams that prey on what they may be interested in buying legitimately. Flash fraud scams: Flash fraud merchants, also known as breakout schemes, which are when threat actors establish a legitimate merchant and process a small number of legitimate payments to establish credibility, are also on the rise. Once a satisfactory payment processing history is established, the seller suddenly submits a large number of fraudulent transactions – often using stolen payment account data – and quickly disappears after obtaining the funds from the stolen accounts. Free Gift Scams: An emerging crypto scam in the retail space is the “free gift” scam, where bad actors offer a “free gift” through a pop-up that asks the victim to confirm the transaction. When clicked, the malicious payload is executed, which includes a file with malicious NFT, which allows fraudsters to interact with the victim’s wallet and make cryptocurrency transfers from the victim’s wallet to the fraudster’s authorize.

Suppression of cyber crime activities

Visa’s efforts over the past six months have resulted in significant suppression of cybercriminal activity with the assistance of global law enforcement and government agencies.

Visa has also helped bring fraudsters around the world to justice. In May 2023, the US Secret Service took down a major cybercrime platform called Try2Check. A local enforcement action called Operation Urban Justice was launched in California to target electronic benefit transfer (EBT) fraud, resulting in the arrest of 20 suspects believed to be part of an Eastern European crime syndicate. In April 2023, an international law enforcement coalition led the Genesis Market Takedown and arrested 119 people involved in the cybercrime platform.

“While we are pleased with the lower-than-expected fraud rate over the last few months, this edition of the Biennial Threat Report highlights how savvy fraudsters continue to be,” said Paul Fabara, Chief Risk Officer at Visa. “The same way that criminals take advantage of technological advances, so does Visa, and the $30 billion in fraud prevented in the last six months alone is good proof of that.”