Cybercrime study finds global human-initiated digital attack rate up 19%

The expanding scale of cybercriminals' activity —  particularly in e-commerce and across North America — is reflected in a new report from LexisNexis Risk Solutions. 

The company’s annual cybercrime report, “Confidence Among Chaos,”  is an analysis of data from 92 billion transactions processed through its LexisNexis Digital Identity Network throughout 2023. It revealed a 19% year-over-year increase in the global human-initiated digital attack rate compared to the previous year. 

The LexisNexis Identity Abuse Index, which records the percentage of attacks per day, shows that attack rates spiked at both the beginning and end of 2023. A significant factor was that North America's attack rate rose to meet and then surpass that of Latin America throughout the year.

The number of e-commerce transactions increased modestly by 7% in 2023, as rising interest rates and global inflation cooled consumer spending. However, where consumers held back, fraudsters became more active, the report noted. 

The volume of human-initiated attacks surged 80% year-over-year, resulting in an attack rate of 2.8% (up by 59% year-over-year). A key component of this growth in attacks was fraudsters' focus on account takeover of e-commerce accounts, with the attack rate at login reaching 3.3% (an increase of 119% year-over-year).

Key findings from the LexisNexis report are below.

•Third-party Account Takeover Takes Top Spot Third party account takeover fraud was the leading type of fraud reported by clients in 2023, contributing 29% of fraud classifications reported, aligning with the strong attack rate growth seen at account login in 2023 (up 18% year-over year)

•Human-Initiated Attacks Experience Rapid Growth While bot-initiated attacks maintained a steady 2% year-over-year growth to reach 3.6 billion, human-initiated attacks surged by 40% in volume to 1.3 billion.

•Remote Scam Centers Drive Fraud Device data, including high-altitude behavioral biometrics telemetry, reveals that parts of South-East Asia are established homes for dedicated remote scam centers. Cybercriminals favor border areas in Cambodia, Myanmar and remote parts of Thailand, according to data from the Digital Identity Network.

•New Challenges Confront Bot Attacks Automated bot attack rates remained steady in 2023, partly due to the threat posed by advanced bot detection capabilities to this attack vector. These capabilities involve detecting bot traffic that mimics the locations of legitimate customers via IP proxies, along with identifying abnormal timing of events and unusual on-page or in-app behaviors.

Businesses are increasingly employing proxy piercing technology to break the anonymity of cybercriminals attempting to conceal their behavior through the use of virtual private networks (VPNs).

"Cybercriminals continue to increase the scale and complexity of their illegal operations, with dedicated scam centers becoming a permanent fixture to mount digital attacks on consumers worldwide," said Stephen Topliss, VP of fraud and identity, LexisNexis Risk Solutions. "While these scam centers will continue to drive the threat of human-initiated attacks, organizations cannot afford to be complacent about the growing sophistication of bots, which can display more human-like behavior to evade traditional prevention solutions. By focusing on identifying advanced bots in real time, businesses can mitigate their ability to create fraudulent accounts or test stolen login credentials for future account takeover attacks."