the state of retail phone fraud 2014-2015info.pindropsecurity.com/.../retail-phone...slides.pdf ·...

2015 Pindrop Security™. Confidential.

THE STATE OF RETAIL PHONE FRAUD 2014-2015 David Dewey, Director of Research Pindrop Security July 23, 2015

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

METHODOLOGY

PhoneprintingTM

100m+ Enterprise Calls Topic Modeler

45m+ Consumer Complaints PhoneypotTM

500k+ Unlisted Numbers

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

Fencible Goods Electronics, Phones, Toner

Business Accounts

Schools, Hospitals, Enterprise

RISK FACTORS

Customer Service

Phone Orders, Help Line

2015 Pindrop Security™. Confidential.

RETAIL PHONE FRAUD ATTACKS

2015 Pindrop Security™. Confidential.

Attacker orders with stolen card Retailer ships order Consumer disputes

charges Chargeback is

issued

CARD NOT PRESENT FRAUD (CNP)

Lost Merchandise

2015 Pindrop Security™. Confidential.

CARD NOT PRESENT FRAUD (CNP)

Attacker orders with stolen card Retailer ships order Consumer disputes

charges Chargeback is

issued

Lost Merchandise Lost Shipping And Handling

2015 Pindrop Security™. Confidential.

CARD NOT PRESENT FRAUD (CNP)

Attacker orders with stolen card Retailer ships order Consumer disputes

charges Chargeback is

issued

Lost Merchandise Lost Shipping And Handling

Lost Reputation

2015 Pindrop Security™. Confidential.

CARD NOT PRESENT FRAUD (CNP)

Attacker orders with stolen card Retailer ships order Consumer disputes

charges Chargeback is

issued

Lost Merchandise Lost Shipping And Handling

Lost Reputation Lost Chargeback Fees & Penalties

2015 Pindrop Security™. Confidential.

FRIENDLY FRAUD / CHARGEBACK FRAUD

Consumer places order Retailer ships order Consumer disputes

charges Chargeback is

issued

Lost Merchandise Lost Shipping & Handling

Lost Chargeback Fees & Penalties

2015 Pindrop Security™. Confidential.

BUSINESS ACCOUNT TAKEOVER

Attacker impersonates

business to place Purchase Order

Retailer ships order Business disputes charge

Chargeback is issued

Lost Merchandise Lost Shipping & Handling

Lost Chargeback Fees & Penalties

Lost Reputation

2015 Pindrop Security™. Confidential.

Shipment Intercept Reshipping In Store Pickup

ACQUIRING THE SHIPMENT

2015 Pindrop Security™. Confidential.

DATA BREACHES

• Reconnaissance over the phone is the first step in a data breach

• 4 out of 5 fraud calls are not money transactions

Recon Weapon- ization Delivery Exploit Install C&C Action

Lockheed Martin Cyber Kill Chain

2015 Pindrop Security™. Confidential.

RETAIL PHONE FRAUD BY THE NUMBERS

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

THE THREAT IS GROWING

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

1 IN 1,000 CALLS IS FRAUD

.02%

.10%

.08%

.06%

.04%

.12%

Retail Avg. Call Center

Fraud Calls

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

FRAUD LOSS

• The actual monetary loss

$0.17

• Average fraud loss per call • Does not include:

•  Operational Costs •  Processing Costs •  Shipping Costs

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

FRAUD ORDERS

• Average value of fraudulent orders per call

• Some fraud is caught before the items are shipped

$0.17

$0.65

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

FRAUD EXPOSURE

$0.17

$0.65

$2.40 • The value of the stolen

account • The amount of in-store credit

offered • Non-monetary attacks

•  Social Engineering •  Reconnaissance •  Privacy Breaches

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

BEST PRACTICES

COLLABORATIVE Share info across

organizations

EVERY CALL Function in adverse conditions, on all or

most calls

ANOMALY DETECTION

Detect fraud on the first call

TRANSPARENT Fast, behind the

scenes MULTIFACTOR Examine multiple aspects of call for

accuracy

2015 Pindrop Security™. Confidential. 2015 Pindrop Security™. Confidential.

LOSS • Packet loss • Robotization • Dropped frames SPECTRUM • Quantization • Frequency filters • Codec artifacts NOISE • Clarity • Correlation • Signal-to-noise ratio

147 audio features

Phone Type Geo-Location Other Risk Factors

PHONEPRINTING™

Phoneprint™

Call Audio Requires 15 seconds

of call audio

86 Risk Score

2015 Pindrop Security™. Confidential.

PINDROP SECURITY Phone Fraud Stops Here. For more information contact info@pindropsecurity.com