increase

now browsing by tag

 
 

#cybersecurity | #hackerspace | In-store Payments via Mobile Apps Can Lead to Increase in Card Not Present (CNP) Fraud

Source: National Cyber Security – Produced By Gregory Evans

Consumers love the convenience of paying for goods and services in store by using their NFC enabled smartphones and stored credit cards. This is demonstrated by the fact that you can download retailer specific apps for your smartphone to pay for everything from coffee, to movie tickets, to poutine using a retailer specific mobile app.

As more and more retailers embrace this technology and release their own mobile apps with in-store payment options, the threat of fraudsters looking to benefit from flaws in the implementation, or by exploiting the human component must be carefully considered. The following are a few example Card Not Present (CNP) fraud schemes that retailers who offer in-store purchasing using a store branded mobile app should be aware of.

In these scenarios, we will use the imaginary retailer Smoothie Shop. Smoothie Shop has a mobile app that allows customers to save their credit card in the app in order to facilitate easy in-store purchases. Consumers log into their Smoothie Shop account using an email address and password. Smoothie Shop has recently seen an increase in CNP fraud and chargebacks, but is unable to pinpoint the root cause.

(Smoothie Shop mobile app login)

CNP Fraud Scheme #1 – Fraudster takes over a Smoothie Shop account that has a Credit Card saved in the app

In this scenario, the fraudster has to take over an existing Smoothie Shop account. This is known in the industry as Account Takeover (ATO) which is explained here.

In this scenario the fraudster has lucked out! Since the account that was taken over by the fraudster already has a credit card saved in the app, the fraudster can simply walk over to a Smoothie Shop, present the mobile app with the saved credit card information and enjoy a refreshing smoothie that was paid for via some other Smoothie Shop customer’s stored credit card.

CNP Fraud Scheme #2 – Fraudster takes over a Smoothie Shop account that does not have a Credit Card saved in the app

Again this scenario requires the Frauster to take over an existing Smoothie Shop account, however this scenario requires a little bit more legwork, and is less profitable as Fraud Scheme #1 above. Since the Smoothie Shop account that was taken over does not have a credit card saved in the app, the fraudster will instead need to buy a stolen credit card off the Dark Web or some other electronic market*, and then add the freshly purchased credit card to the Smoothie Shop account and app. Once this is done, the fraudster proceeds in-store to obtain smoothies using the stolen credit card.

Why would the fraudster go through the trouble of taking over an existing Smoothie Shop account you ask? Good question! Fraudsters are aware that aged accounts (e.g. accounts more than 3-6 months old) with a good transaction history are usually given more leeway and transactions from these accounts are less closely scrutinized when compared to a brand new account with no transaction history.

*Stolen credit cards can be acquired for as little as $3 or as much as several hundred dollars depending on the credit limit, zip/postal code, issuing bank, etc.

https://securityboulevard.com/

(screenshot from Dark Web Credit Card market)

CNP Fraud Scheme #3 – Fraudster creates a brand new Smoothie Shop account

This scheme doesn’t require taking over an existing account, but instead requires the fraudster to use a bot tool or a human clickfarm to create hundreds of “fake” Smoothie Shop accounts. Once the fraudster has access to multiple Smoothie Shop fake accounts, he can then add in as many stolen credit cards as he pleases in order to make in-store purchases at Smoothie Shop, each one being a unique incident of CNP fraud.

https://securityboulevard.com/

(In-store payment via Smoothie Shop mobile app and stored credit card)

What can Retailers and Consumers do to protect themselves?

Prevention Methods for Retailers

1) Prevent Account Takeover. This is easier said than done. There are many ways to prevent or at least significantly reduce the amount of ATO, such as by eliminating Credential Stuffing. The goal of the organization should be to eliminate the economic advantage that fraudsters obtain from taking over an account. If the cost/effort of taking over an account outweighs the value of said account, there will be no incentive for the fraudster and he/she will likely go elsewhere to commit fraud.

2) Maintain control of Account Creation process. Creation of accounts by bots and scripts can be limited by using a CAPTCHA, however captchas can be bypassed by mid-level sophistication fraudsters, and consumers generally dislike captchas. Preventing bulk creation of accounts requires collecting device level information in order to restrict the number of new accounts that can be created by a single device. There are device farms available for rent, but forcing the fraudster to leverage a device farm could make their rate of return less desirable and push the fraudster elsewhere.

3) Ensure your customers are not logging into your site/mobile app with credentials that have been compromised in 3rd party data breaches. This is a NIST recommendation that makes a lot of sense in today’s world of daily breaches. The customers that are logging in to your website or mobile app with compromised credentials are most likely the accounts that will be taken over and defrauded first.

4) Build controls around misuse of credit cards in the mobile app. Legitimate customers will likely need to add 1, maybe 2 unique credit cards to their account/device. Any account/device trying to add 3, 4, 5, or more credit cards to an account should be closely inspected and possibly restricted from adding any more. The stored credit card should also be tied to the device, rather than the account. That way, if an account is taken over from a new device, there will be no stored credit card information available for the fraudster to use. Both of these require a strong and unique identifier on the device level.

Prevention Methods for Consumers

1) Don’t reuse passwords across multiple sites! – This is the single most important piece of advice consumers should follow. If you reuse the same password across multiple sites, it is no longer a question of if, but rather when you will become a victim of Account Takeover and fraud. Using a Password Manager to create strong and unique passwords will greatly improve your personal security posture.

2) Be mindful of the sites and apps that you enter your username and password in to. Many fraudsters are now relying on phishing scam sites that look eerily similar to the real retailer/airline/bank site but are in fact under the control of the fraudster and are meant to harvest credentials in order to commit fraud.

3) Make sure you have a reputable antivirus on your Smartphone and uninstall any apps that are flagged as suspicious or malicious.

4) Use a virtual credit card. Virtual credit cards are now available from a number of organizations. These are beneficial as you can create a single use virtual credit card with a credit limit for a specific retailer. That way if the retailer suffers a data breach, or your account is taken over, your fraud exposure is contained and your real credit card is still secure.

5) Ask the retailer about their security controls and practices, and how they prevent Account Takeover. If they give you a sub-par canned answer, maybe you should think twice before saving your credit card information in their app.


*** This is a Security Bloggers Network syndicated blog from Shape Security Blog authored by Carlos Asuncion. Read the original post at: https://blog.shapesecurity.com/2020/02/13/in-store-payments-via-mobile-apps-can-lead-to-increase-in-card-not-present-cnp-fraud/

Source link

The post #cybersecurity | #hackerspace |<p> In-store Payments via Mobile Apps Can Lead to Increase in Card Not Present (CNP) Fraud <p> appeared first on National Cyber Security.

View full post on National Cyber Security

Salaries Will #Increase for #Cybersecurity #Jobs, Survey #Says

Source: National Cyber Security – Produced By Gregory Evans

After another record-setting year for cybercrime, security professionals are in line for a well-deserved raise, according to recent research.

The “Robert Walters Salary Survey 2018” predicted that salaries for cybersecurity jobs around the world will rise by 7 percent in 2018. In addition, the recruitment firm estimated that all IT roles will see an average increase of 2 percent in salary.

Read More….

The post Salaries Will #Increase for #Cybersecurity #Jobs, Survey #Says appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

Salary #increase likely for #cybersecurity, #HR workers: study

Source: National Cyber Security – Produced By Gregory Evans

Professionals in cybersecurity and human resources are likely to get salary increases next year, while e-commerce and IT-related jobs will be in demand, underscoring the economy’s shift to digital, a consulting firm said Tuesday.

Robert Walters Southeast Asia said that based on its study, salaries of mid-level human resource officers could increase by as much as a 30 percent while cyber security experts could see their incomes go up 20 percent.

Companies in Southeast Asia are hiring experts in these fields as they create online and mobile platforms in to enhance competitiveness and increase market share, said Toby Fowlston, Managing Director for Robert Walters Southeast Asia.

“As a result of these transformations, many companies were looking to hire professionals with digital expertise, across both marketing and information technology, especially those who are proficient with back office digital infrastructure or niche with technology skills,” Fowlston said .

Experts in digitalization and e-commerce will be in demand, especially those skilled in cloud computing, platform-based solutions, cyber security and big data, Fowlston said.

Jobseekers who are changing companies in the HR industry, IT and accounting and finance are also likely to get 15 to 30 percent wage increases, according to the study.

However, Robert Walters also noted that companies in Southeast Asia were having difficulty attracting and retaining talented professionals.

“To attract and retain (talent) in this candidate-driven market, hiring managers will have to look beyond competitive salary packages and be more creative in their offers to potential hires,” said Eric Mary, Robert Walters Philippines Country Manager.

He added that employee training, clear career progression plans and communication on top of competitive salaries, and strong employer brand will help companies retain their best people.

The post Salary #increase likely for #cybersecurity, #HR workers: study appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

Cultural change required in organisations to increase cyber security, says US Secret Service

Source: National Cyber Security – Produced By Gregory Evans

The US Secret Service says current human factors are restricting the progression of cyber security Ronald Layton, the deputy assistant director of the US Secret Service, said “cultural change” is needed in organisations to cut the number of cyber attacks caused by human error. Speaking at NetEvents’ Global Press &…

The post Cultural change required in organisations to increase cyber security, says US Secret Service appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

“Virtual Infant Programs” Actually Increase Teen Pregnancies

In some communities, teens participate in “virtual infant parenting,” where they must care for robotic dolls that look and act like real babies. Participants spend a few days feeding, changing diapers, and supporting the dolls to experience the challenges of life as a teen parent. However, a new study of Australian girls has found these programs are not effective. Seventeen percent of girls who cared for virtual babies ended up becoming pregnant during their teen years, compared to 11 percent of those outside of the program. Teen pregnancies are at an all-time low in the United States. Experts believe the reason is education and use of contraception.

Read More

The post “Virtual Infant Programs” Actually Increase Teen Pregnancies appeared first on Parent Security Online.

View full post on Parent Security Online

Tripwire Study: Energy Sector IT Professionals Overconfident in Cyber Security Capabilities as Attacks Increase

4-12-2016-9-14-47-am-7453362

Source: National Cyber Security – Produced By Gregory Evans

Tripwire Study: Energy Sector IT Professionals Overconfident in Cyber Security Capabilities as Attacks Increase

Tripwire, Inc., a leading global provider of security and compliance solutions for enterprises and industrial organizations, today announced the results of an extensive study conducted for Tripwire by Dimensional Research. The study evaluated the confidence of IT professionals regarding the

The post Tripwire Study: Energy Sector IT Professionals Overconfident in Cyber Security Capabilities as Attacks Increase appeared first on National Cyber Security.

View full post on National Cyber Security

Common Core opt-outs increase slightly in Nevada – Education Week

View full post on Education Week: Bullying







#pso #htcs #b4inc

Read More

The post Common Core opt-outs increase slightly in Nevada – Education Week appeared first on Parent Security Online.

View full post on Parent Security Online

Does Legal Marijuana Increase Teen Access to the Drug?

Health experts feared that legalizing marijuana would make it easier for teens to acquire the drug. But a new study has found that teens in Washington State do not find it any easier to get marijuana today than they did in 2012, when the state made it legal for adults age 21 and older to possess small amounts of the drug. However, as pot’s availability has remained steady, teens report that availability of most other drugs has dropped.

View full post on THW | In the News