Sophisticated fraud ring costs online retailers over $600 million
Losses suffered by U.S. retailers from a major global cybercrime effort totaled an estimated $660 million in November 2022 alone.
According to data from e-commerce security platform Signifyd, a criminal enterprise believed to be based in Southeast Asia has been launching a series of online fraud attacks against U.S. retailers throughout the 2022 holiday season. During November 2022, Signifyd estimates that the fraudsters illegally obtained $660 million worth of laptops, cell phones, computer chips, gaming devices, and other goods through phony purchases.
According to Signifyd, the fraud ring, operates with sophistication similar to that of a “Fortune 500 company,” exhibiting expertise in data science, fraud detection, online payments, and e-commerce operations. The company first detected activity from the cybercrime ring in 2021, when the criminals began testing the security of various e-commerce retailers with small attempts to make fraudulent purchases.
However, in early November 2022, the criminal organization began placing billions of dollars’ worth of fraudulent online transactions. At its height, Signifyd estimates the fraud ring was attempting more than one fraudulent transaction a minute at one large retailer on its network for a full day.
The criminal group’s fraudulent transaction attempts persisted through Black Friday and into early December 2022. Although Signifyd says the “vast majority” of the ring’s fraudulent orders were turned away, enough succeeded to create significant inventory losses.
“What was unique about this fraud ring was that they revved up really quickly. They’re fast and strong,” said Ping Li, Signifyd VP of risk and chargeback operations. “They probably had been preparing for it for a long time and then they launched a war just before our holiday season. This is the first time I have seen an attack of this size and scale in our network.”
Although Signifyd says it has shut down the Southeast Asian ring’s fraud scheme, the group is making little effort to hide itself and it is expected to modify its strategy and launch future cyberattacks against online retailers.
Online holiday fraud rises in four areas
According to the recent “2022 Holiday Bad Bot Report” from cybersecurity company Kasada, online retailers should pay extra attention to posed by gift card fraud, fake account creation, “freebie bots,” and scraping attacks this holiday season.
Kasada saw a 6x spike in automated gift card lookups during the 2022 holiday shopping season, which it identifies as a key indicator that fraudsters are using bots to identify and steal gift card balances.
In addition, the company monitored a 3x increase in fake account creation the week before Black Friday and a 40% increase from Black Friday to Cyber Monday, along with surges in the use of bots that detect and purchase mispriced items in bulk and scraping bots that capture real-time data for use in cyber fraud.