Online Fraud: An Insider's View of Today's Top Threats

Credit EligibleAs a GovInfoSecurity.com annual member, this content can be used toward your membership credits and transcript tracking. Click For More Info

Trojans. Harvesters. Mules. They're the backbone of the underground fraud economy, which is "vibrant" and worth billions, according to one international researcher.

And don't be swayed into a false sense of security by the recent indictment of Albert Gonzalez, who is charged with masterminding the Heartland Payment Systems breach of 130 million credit and debit cards. Gonzalez is but one representative of a thriving hidden network of fraudsters who are plying ever trickier tools of the trade, says Uri Rivner, lead researcher at RSA's Anti-Fraud Command Center in Israel.

"When I started my research, I believed, as many others did at the time, that a single fraudster could perpetrate fraud on their own," says Rivner. But after a decade spent researching the fraud economy, he now sees a sophisticated business model, replete with specializations and multi-levels of participants. "It's no longer the romantic notions of Matthew Broderick's character in 'War Games' penetrating the Pentagon's war computer."

Indeed, fraud is an international business - preying upon businesses internationally.

RSA alone stopped $1.2 billion worth of online fraud in 2008, Rivner says - and this represents what experts believe to be just a fraction of the crime's extent. "The economy of fraud is estimated into the billions, just in the U.S. alone," he says. "It is a very big issue."

Click to Get Updates on the Latest Information Security News

Company* Title* Email* Subscription Type: HTML Text Government Enews General Government Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Banking Enews General Banking Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Credit Union Enews General Credit Union Enews Blogs Enews Careers Enews Training Enews Webinars Enews Podcasts Enews White Papers Enews Need Help?

Careers in Fraud

The two main "career paths" in the online criminal economy are harvesting and cash-out, Rivner says.

Harvesting is where criminals are after credentials -- typically from a single user. These credentials are gained through skimming, phishing and trojans. "The harvesting fraudsters are interested in one thing -- access credentials to online bank accounts, pin numbers, account numbers, credit card numbers," Rivner says. Rivner says the number of incidents hitting regular online users each month is in the millions.

There are forces, such as the group Gonzalez is accused of masterminding, that, rather than focusing on individuals, try to breach payment processors and retailers such as Heartland and TJX. "These fraudsters are bent on getting into large databases to try and get as much information as possible, sometimes using an insider in the retail side or company," he observes.

The harvesting fraudster's weapons of choice are phishing kits and Trojans. Once the harvesting is done, Rivner says, "At the end of the day, they have to empty these accounts they've taken. They have stolen 1000 credit card numbers, but they don't know how to cash them out. Or they have information on 10,000 online bank accounts, but they don't have the infrastructure to cash in on those accounts."

The harvester will then turn to sell the information to the cash-out side of the criminal model. Cash-out fraudsters are adept at getting money either through ecommerce transactions or online banking transfers, without leaving a trail that can be traced back to them.

How the fraudsters do this is by using the cards online. Or in the case of ATM fraud, if they have the pin number, they clone the card and use it to remove money from ATMs. In online banking, they remove the money from the victim's account and send it into an account that they control. It does not have to be their own account, otherwise they would be caught very quickly, Rivner says. "But, instead, the cash-out fraudster will use another online banking account (hired money mules) to transfer the money to the fraudsters.

Sadly, Rivner says, most times the unwitting money mules don't realize they are part of a money laundering ring until their bank or law enforcement agencies contact them. Typically, money mules are recruited, "given some story, receive money transfers, take the money out and wire it internationally to a money drop. Then the money goes to the cash-out fraudsters," he says.

The two sides of the fraud economy -- the cash-out and the harvesting fraudsters -- know each other only virtually, Rivner says. "They do all of their business online, they collaborate, establish business relationships in fraud forums or chat rooms." There are dozens that are active these days, with thousands of users all looking for business ventures. The fraudsters share tools, give advice, sell information and basically do business on these sites. All makes for an interesting "dark" economy that has sprung up in the last couple of years.

Tools of the Trade