Fraud & Identity Management

By: Maria Moynihan At a time when people are accessing information when, where and how they want to, why aren’t voter rolls more up to date? Too often, voter lists aren’t scrubbed for use in mailing, and information included is inaccurate at the time of outreach. Though addresses and other contact information becomes outdated, new address identification and verification has not typically been a resource focus.  Costs associated with mandated election-related communications between government and citizens can add up, especially if messages never get to their intended recipients and, in turn, Registrar Offices never get a response. To date, the most common pitfalls with poorly maintained lists have been: Deceased records — where contact information for deceased voters has not been removed or flagged for mailing Email and address errors — where those who have moved or recently changed information failed to update their records, or where errors in the information on file make it unlikely for the United States Postal Service® to reach individuals effectively Duplicate records — where repeat records exist due to update errors or lack of information standardization With resources being tighter than ever, Registrar Offices now are placing emphasis on mailing accuracy and reach. Through third-party-verified data and advanced approaches to managing contact information, Registrar Offices can benefit from truly connecting with their citizens while saving on communication outreach efforts. Experian Public Sector recently helped the Orange County Registrar of Voters increase the quality of its voter registration process. Click here to view the write-up, or stay tuned as I share more on progress being made in this area across states.

More than ever before, there may now be credence in the view that the majority of consumers’ personally identifiable information (PII), user names and passwords, and even some authentication tokens have been, or are, at risk of compromise.  Between sophisticated hacking schemes and regularly reported and sometimes unreported data breaches, those charged with implementing and maintaining identity authentication and management systems must assume this to be true.  In doing so, the need for layered authentication becomes readily apparent.  Layered authentication can mean many things to many people, but I would offer it up as diversifying authentication and risk assessment techniques and processes across multiple elements and attributes throughout the customer lifecycle.  These elements and attributes corresponding techniques can include: traditional PII validation and verification identity transaction link analysis and risk attribute derivation credit and non-credit data and risk attributes identity risk scores knowledge-based authentication question performance device intelligence and risk assessment credentials biometrics and should be layered proportionally by inherent risk per application, addressable population, transaction history and types, current transaction, and access channel for example.  Industry guidance such as the FFIEC Guidance of Authentication in an Internet Banking Environment is a solid foundational direction that calls out the need for institutions to move beyond simple device identification — such as IP address checks, static cookies and challenge questions derived from customer enrollment information — to more complex device intelligence and more complex out-of-wallet identity verification procedures.  I would suggest that while this is a great start, it is by no means comprehensive.  Institutions across all markets, both private and public sectors, should be exploring all available services and technologies in an effort to reduce reliance on one or only a few methods of authentication and identity management.  Particularly, again, assuming that the one method an institution may rely on could be greatly weakened or without value if subject to mass compromise. Make sure to read our Comply whitepaper to gain more insight on regulations affecting financial institutions and how you can prepare your business.   Learn more about how your business can authenticate consumers confidently.  

As data breaches continue to attract publicity, consumers are expecting more from impacted organizations.

Online crooks are getting more sophisticated by the second. Nowadays, fraudsters have the ability to conduct “clean fraud,” obtaining legitimate identities of users from the black market or data breaches to compromise a victim’s card account. Malware, too, is becoming more sophisticated both in the mobile and non-mobile space. But how can organizations fight such high-level tactics in such a broad, complex space? John Sarreal, Senior Director of Product Management at 41st Parameter, an online fraud prevention player, sat down with PYMNTS after the recent release of the white paper “Surveillance, Staging, and the Fraud Lifecycle” to reveal the inner workings of a cyber criminal’s mind, what should be done before and after data is snatched, and which aspects of account takeover are the most overlooked and dangerous. Interview excerpts Take us through the mind of a cyber-criminal. What are the most sophisticated tactics used today to capture account information from corporate systems? JS: The amount of clean fraud that we see with our customers is unprecedented. By focusing on obtaining legitimate credentials and identities, fraudsters are more easily able to bypass traditional controls. This means that fraud tools need to adapt and gather additional attributes to augment their fraud screening. Although the techniques they’re using now to obtain these credentials are increasingly sophisticated, the MOs are still rooted in basic phishing and social engineering attacks. Fraudsters will use identity information obtained from the black market or data breaches to conduct very convincing phishing attacks to reveal everything that is needed to compromise a victim’s card account. There’s also increasing sophistication in the use of malware to steal sensitive credentials in both the mobile and non-mobile arena. In Android, for example, Google recently passed a vulnerability that allows sophisticated malware to impersonate digital certificate signing authorities. This vulnerability allowed the malware to install itself on a mobile device without any user notification or intervention – obviously, a very dangerous attack. Link to the podcast and transcript here.

Companies are facing incredible difficulties identifying fraud risks at the point of origination. Setting up accurate fraud detection processes has become more and more challenging as mobile and online channels have become widely used by consumers. At the same time, fraudsters’ techniques are becoming increasingly sophisticated. To compensate, organizations have had the choice of either: a) Implementing very tough identity-proofing standards — risking turning away legitimate customers. b) Lessening their criteria and opening themselves to increased risk. Any business that functions in a web connected environment that has a need to recognize new or returning consumers must look beyond the simple credentials that have been provided by the user such as usernames, passwords, email addresses, phone numbers, handles, secret questions or secret answers. To increase assurance businesses need to start need to start looking at authenticating users through their devices that are being used to present those credentials. The underground is awash in legitimate but stolen credentials and should be treated with a great deal of skepticism by the businesses attempting to authenticate their customers. There will always be a pendulum swaying in the echoes of this kind of news – with businesses locking down access with more stringent policies and in doing so they begin to undo all the work that has been done to create a frictionless consumer experience.  The industry may now begin to realize the ultimate dream of the consumer: completely effortless access. Rather than requiring consumers to type in credentials that may have been compromised why not leverage the various technologies that exist to simply recognize the consumer when they access the site in question? Digital consumers interact with businesses via their digital proxies – their devices – which must come in digital contact with the web servers in order to gain access. The industry should require the machines to do heavy lifting (rather than consumers) when it comes to “recognizing” them when they return. The right technology offers a more robust, privacy-compliant and transparent way for businesses to recognize their digital consumers. As we’ve discussed previously the authentication process will shift from a single view to a layered, risk-based authentication approach that will include comprehensive and real-time updates of consumer information. This is done through technology that has been tested over the years and protects millions of customer accounts today with incredible results in terms of both fraud detection and frictionless consumer experience. The time has come to embrace the realities and the possibilities of the new digital environment in which we operate. Learn more about how your business can authenticate consumers confidently.  

Experian’s fraud prevention and identity management business helps clients combat the global fraud epidemic costing businesses hundreds of billions of dollars every year. Ori Eisen, founder of the 41st Parameter, a part of Experian, and Frank Abagnale Jr. talk to Bloomberg TV about the major new fraud threats emerging and how Experian can help protect organisations and their customers from becoming victims. Account takeover is a mainstream fraud issue as virtually any web site leveraging username and password authentication can be affected. As we wrote about earlier, another cybersecurity concern served as a reminder that managing fraud and protecting customer identities is becoming more complex as we are fighting creative and motivated people - not predictable systems. Watch the interview here:                         Learn more about Experian fraud intelligence products and services from 41st Parameter. 

A recent survey reveals that 30 percent of travelers have experienced identity theft while traveling or know someone who has.

Your password is weak, whether you use 40 random characters or your dog’s name. With so many large data breaches leading to hundreds of millions of compromised credentials and payment cards in the past two years, it's no surprise that e-commerce account takeover attempts have grown dramatically in recent months – to a degree we have never seen before. Previously, account takeover was primarily a banking issue, not something merchants had to deal with. Account takeover fraud is an alarming trend that spans global airline loyalty programs, e-commerce transactions, social networking logins and virtually any web site leveraging username and password authentication. News of the latest cybersecurity concern should serve as yet another reminder that we live in a heightened state of risk where establishing online trust based solely on username and password or identity data is not sufficient. There are a number of factors that are contributing to the evolving fraud landscape namely that the Internet was not designed for security.  This places pressure on organizations to continually adopt new approaches to managing fraud like this growing account takeover threat. In this case, multiple layered controls including device intelligence are essential. As merchants extend more services online and allow customers to store payment information or get more convenient checkout via logged in vs. guest access, we'll continue to see fraud migrating deeper into the e-commerce ecosystem. The account takeover problem will continue as consumers share usernames and passwords across dozens of online profiles and e-commerce logins, opening the door for attackers to access multiple accounts through a single compromised credential. Most of the account portals used by e-commerce merchants and loyalty programs were not built with the same level of security that their online transaction and fraud management systems have in place. So it's a bit of a new risk, but fraudsters are aggressively exploiting the security gaps around things like simple username/password authentication. What can consumers and organizations do to protect themselves? Our recommendation for consumers is that they have unique username and password combinations for every online profile. This protects against attackers compromising one site and leveraging the same credentials to access all of the victim's accounts and online profiles across the web. For businesses, we recommend implementing technology solutions that increase visibility to and recognition of devices for every online interaction so the organization can differentiate attackers from legitimate consumers. Some businesses believe that their products, services and loyalty offerings do not require the same level of protection as online bank accounts, so they leave them exposed to cyber criminals via simple authentication controls. As we’ve seen fraudsters will migrate to the path of least resistance and exploit the fact that most consumers re-use credentials out of convenience. In the digital age where consumers are increasingly represented by their devices the ability to know when there are authentication discrepancies between the data presented by the user and the device presenting those credentials is absolutely important to effectively controlling the threat. The authentication process will shift from a single view to a layered, risk-based authentication approach that will include comprehensive and real-time updates of consumer information. Conversations around the fact that the password is dead or dying have been circulating in the industry recently. What we don’t want is consumers getting tired of constantly changing passwords and giving up trying to protect themselves online. That is the worst case scenario that is becoming more of a reality as the days pass. Educated and aware consumers are still the best way to identify fraudulent attacks, and to keep identity data safe from hackers and devices free of malware. Increased adoption of biometrics, device intelligence and the sharing of authenticated and credentialed identities across industries will become commonplace to help combat account takeovers as they increase. Until then we need to find a password replacement.   Learn more about 41st Parameter: https://www.experian.com/decision-analytics/41st-parameter.html?INTCMP=DA_Blog_Post072414   Related: The World Cup of Fraud  

Your password is weak, whether you use 40 random characters or your dog’s name. With so many large data breaches leading to hundreds of millions of compromised credentials and payment cards in the past two years, it’s no surprise that e-commerce account takeover attempts have grown dramatically in recent months – to a degree we have never seen before. Previously, account takeover was primarily a banking issue, not something merchants had to deal with. Account takeover is an alarming trend that spans global airline loyalty programs, e-commerce transactions, social networking logins and virtually any web site leveraging username and password authentication. News of the latest cybersecurity concern should serve as yet another reminder that we live in a heightened state of risk where establishing online trust based solely on username and password or identity data is not sufficient. There are a number of factors that are contributing to the evolving fraud landscape namely that the Internet was not designed for security.  This places pressure on organizations to continually adopt new approaches to managing fraud like this growing account takeover threat. In this case, multiple layered controls including device intelligence are essential. As merchants extend more services online and allow customers to store payment information or get more convenient checkout via logged in vs. guest access, we’ll continue to see fraud migrating deeper into the e-commerce ecosystem. The account takeover problem will continue as consumers share usernames and passwords across dozens of online profiles and e-commerce logins, opening the door for attackers to access multiple accounts through a single compromised credential. Most of the account portals used by e-commerce merchants and loyalty programs were not built with the same level of security that their online transaction and fraud management systems have in place. So it’s a bit of a new risk, but fraudsters are aggressively exploiting the security gaps around things like simple username/password authentication. What can consumers and organizations do to protect themselves? Our recommendation for consumers is that they have unique username and password combinations for every online profile. This protects against attackers compromising one site and leveraging the same credentials to access all of the victim’s accounts and online profiles across the web. For businesses, we recommend implementing technology solutions that increase visibility to and recognition of devices for every online interaction so the organization can differentiate attackers from legitimate consumers. Some businesses believe that their products, services and loyalty offerings do not require the same level of protection as online bank accounts, so they leave them exposed to cyber criminals via simple authentication controls. As we’ve seen fraudsters will migrate to the path of least resistance and exploit the fact that most consumers re-use credentials out of convenience. In the digital age where consumers are increasingly represented by their devices the ability to know when there are authentication discrepancies between the data presented by the user and the device presenting those credentials is absolutely important to effectively controlling the threat. The authentication process will shift from a single view to a layered, risk-based authentication approach that will include comprehensive and real-time updates of consumer information. Conversations around the fact that the password is dead or dying have been circulating in the industry recently. What we don’t want is consumers getting tired of constantly changing passwords and giving up trying to protect themselves online. That is the worst case scenario that is becoming more of a reality as the days pass. Educated and aware consumers are still the best way to identify fraudulent attacks, and to keep identity data safe from hackers and devices free of malware. Increased adoption of biometrics, device intelligence and the sharing of authenticated and credentialed identities across industries will become commonplace to help combat account takeovers as they increase. Until then we need to find a password replacement. Learn more about 41st Parameter fraud detection and prevention solutions here.

Your password is weak, whether you use 40 random characters or your dog’s name. With so many large data breaches leading to hundreds of millions of compromised credentials and payment cards in the past two years, it’s no surprise that e-commerce account takeover attempts have grown dramatically in recent months – to a degree we have never seen before. Previously, account takeover was primarily a banking issue, not something merchants had to deal with. Account takeover is an alarming trend that spans global airline loyalty programs, e-commerce transactions, social networking logins and virtually any web site leveraging username and password authentication. News of the latest cybersecurity concern should serve as yet another reminder that we live in a heightened state of risk where establishing online trust based solely on username and password or identity data is not sufficient. There are a number of factors that are contributing to the evolving fraud landscape namely that the Internet was not designed for security.  This places pressure on organizations to continually adopt new approaches to managing fraud like this growing account takeover threat. In this case, multiple layered controls including device intelligence are essential. As merchants extend more services online and allow customers to store payment information or get more convenient checkout via logged in vs. guest access, we’ll continue to see fraud migrating deeper into the e-commerce ecosystem. The account takeover problem will continue as consumers share usernames and passwords across dozens of online profiles and e-commerce logins, opening the door for attackers to access multiple accounts through a single compromised credential. Most of the account portals used by e-commerce merchants and loyalty programs were not built with the same level of security that their online transaction and fraud management systems have in place. So it’s a bit of a new risk, but fraudsters are aggressively exploiting the security gaps around things like simple username/password authentication. What can consumers and organizations do to protect themselves? Our recommendation for consumers is that they have unique username and password combinations for every online profile. This protects against attackers compromising one site and leveraging the same credentials to access all of the victim’s accounts and online profiles across the web. For businesses, we recommend implementing technology solutions that increase visibility to and recognition of devices for every online interaction so the organization can differentiate attackers from legitimate consumers. Some businesses believe that their products, services and loyalty offerings do not require the same level of protection as online bank accounts, so they leave them exposed to cyber criminals via simple authentication controls. As we’ve seen fraudsters will migrate to the path of least resistance and exploit the fact that most consumers re-use credentials out of convenience. In the digital age where consumers are increasingly represented by their devices the ability to know when there are authentication discrepancies between the data presented by the user and the device presenting those credentials is absolutely important to effectively controlling the threat. The authentication process will shift from a single view to a layered, risk-based authentication approach that will include comprehensive and real-time updates of consumer information. Conversations around the fact that the password is dead or dying have been circulating in the industry recently. What we don’t want is consumers getting tired of constantly changing passwords and giving up trying to protect themselves online. That is the worst case scenario that is becoming more of a reality as the days pass. Educated and aware consumers are still the best way to identify fraudulent attacks, and to keep identity data safe from hackers and devices free of malware. Increased adoption of biometrics, device intelligence and the sharing of authenticated and credentialed identities across industries will become commonplace to help combat account takeovers as they increase. Until then we need to find a password replacement. Learn more about 41st Parameter fraud detection and prevention solutions here.

In our most recent webinar, I had the pleasure of moderating a panel session with four fraud experts spanning across many diverse backgrounds. The consistent theme throughout was that cyber criminals have become quite proficient at stealing data or account credentials. Once a cyber criminal has valid account data, they have incredible access to a broad range of possibilities. How an account is used; a real-time view of deposit and withdrawal patterns and what types of alerts and notification settings are in place. A determined fraudster may observe accounts for long periods to ensure they are able to make their move at the optimal time. One of the biggest issues is being able to tell “friend from foe”, particularly in light of the endless supply of perfect, disposable data. I posed this scenario to our panel and asked what organizations can do now to protect themselves: SCENARIO – Telling friend from foe Credit card companies encourage travellers to alert them in advance of unusual travel to avoid red flags or declines while out of town. This can be a double-edged sword. A fraudster with appropriate credentials can contact a credit card company a few weeks before a “trip” to alert them of planned travel. At the start of the “trip” the distraught fraudster can then contact the credit card company to report a stolen card and request a replacement be expedited to them at their “destination.” The result is a fraudster armed with a completely legitimate card they can use at their leisure and with little risk of detection. There were three key take-aways the expert panel recommended: Enhance your visibility. Without this important tactic, you won’t know what hit you. Fraudsters are armed with pristine identity data so they will look and act more like your best customers. Employee multiple security layers. You may be focused on ensuring that you know your customer, but does the transaction pattern fit normal behavior for the user? Malware could be embedded on the device. Are items such as language and other settings consistent with what you’d expect for your legitimate customers? Protect profile setups / online enrolment and reward programs the way you protect transactions. While the financial risk to your business may be limited, the potential regulatory exposure and brand reputation hit can be significant. It takes years to build your reputation with your best customers – but only seconds to destroy it. Undermining their trust in online or mobile interactions with your business has an immediate and destructive impact on loyalty. What do you think? Let us know.

A recent study conducted by the Ponemon Institute found that a data breach is among the top three occurrences that affect brand reputation, along with poor customer service and an environmental incident.

Today I co-hosted a TweetChat with Experian on mobile fraud trends. To be honest, it was the first Twitter Chat I took part in. It was fun, informative and a great way to connect with folks in our industry – from our customer base, partners and more. The discussion was fast paced and the 140-character limit for tweets means I wasn’t able to elaborate on many of the points I made. Thus, thought I would share my insight through a blog post. What are the most common types of mobile fraud?   Malware. According to Forbes, 97 percent of mobile malware is on Android devices. That’s not to say that Apple isn’t seeing it, too. They are, but at a much reduced scale due to their validation processes. Forbes also states that android malware rose from 238 threats in 2012 to 804 new threats in 2013 and continues to rise. Mobile malware has a couple of varieties that everyone should be aware of. They’re increasingly common and you’ve likely seen the first one making media headlines like rapid fire in recent months: Ransomware: locks a user’s phone and fraudsters demand payment to unlock it. Credential stealing malware: attempts to capture the credentials of the victim as they access a service. Premium dialing/texting malware that uses victim phones to increase traffic and charges to rogue accounts. Mobile fraud, as a category, also needs to include the use of the mobile device by fraudsters as the attacking instrument. Fraudsters exploit the fact that organizations may not have applied the same security measures to their mobile access points that they have in their traditional online access. Big mistake. All organizations should make sure that they are not exposed to fraud originating from the mobile channel (either mobile app or mobile web based.) Companies need to ensure they can identify the device regardless of platform. Am I more at risk on my mobile device than I am on my computer?  As a consumer, industry data has illustrated that there is no significant difference between the risk of the PC and a mobile device. The PC is still a much more valuable target to fraudsters, considering its wide use. But as the mobile platform continues to grow, mobile exploits are also growing, forcing the industry to build in more robust strategies around mobile access. This includes the platform providers, app developers and businesses that want to increase their mobile offerings. The bigger point here is that the Apple platform has much less malware activity than the Android platform does today. Apple has stringent developer policies and scrutiny. For businesses, as a relative percentage of device activity, we are beginning to see that there is more fraud in the mobile channel than in the traditional channel. Bear in mind that mobile volumes today are still much smaller than the traditional PC. Mobile can also be a fraud staging area, where fraudsters can see balances and activity and then takeover your account… But this is not a vulnerability with the consumer using their device, rather it’s with the fraudsters using the mobile channel since it’s a separate channel where the banks may not have effective cross-channel visibility. How do I know if you have a legitimate app vs a fake / fraudulent app?  There are a few simple steps to verify the legitimacy of apps – check for typos, grainy logos and images and check user reviews on the app store. Moreover, this is an issue of where users are getting their apps. Make sure you are only downloading apps from the platforms’ authorized app environments. And keep in mind that the prevalence of malware on the Google Play platform is much higher than that on the AppStore. What other risks do mobile devices pose to personal identity? The phone doesn’t necessarily present greater risks than PCs, but people do tend to use them more frequently, and with less of a thought toward security. My advice: make a habit of locking your phone and don’t buy apps from sketchy platforms. What are the methods that banks and retailers are choosing to secure mobile payments? It’s a device access versus personal access issue. Need for business is to recognize devices regardless of payment type.  In the NFC space, there’s also a question of liability… who is on the hook when happens? Is it the merchant? The card issuer?  There are still some gray areas when it comes to mobile wallet (NFC) transactions being used for physical purchases. For NFC (in person) payments, the POS makers use industry standards – but they can still be vulnerable to attack based on malware distributed via POS terminals, as we have seen lately. For mobile bank payments – some banks use device recognition and device behavior– but all banks really should use it – best way to detect rogue activity from the device. Most retail mobile payments are tied to a wallet – so wallet providers must also secure access to the wallet ensure that it doesn’t become the weakest link. Will passwords ever die? What other forms of identification might be used?   For businesses, passwords are already dead, since most have been stolen over the years. Businesses should be using device recognition – it’s one of the strongest tools to differentiate between good and bad users. Any final tips on how people can protect themselves from mobile fraud?  Don’t buy apps from sketchy third party platforms. Don’t click on links from untrusted parties, lock your device, make sure your device is backed up and don’t pay ransomware demands. If you have any other questions that weren’t answered in the #TweetChat, please leave a comment here or tweet to me at @DBritton41st.  

It’s no secret that e-commerce merchants, retailers, and financial institutions are prime targets for these digital ghosts as they look to quickly monetize their recent data heist. Unfortunately, many organizations are still scrambling to deploy proper defenses. So how do you defend against an unregulated, networked enemy intent on inciting chaos and filling their bank accounts? Following any data breach, it is essential that organizations gain complete visibility of their customers and transactions across channels. Once a breach has occurred, it is critical for organizations to perform a forensic review of the attack to identify and understand all of the potential points of vulnerability, what data was stolen and how that data was transmitted back to the attackers. What can be more concerning is that the initial scope may quickly expand into something much larger. This makes it essential that retailers and financial institutions rapidly gain complete visibility of their customer data and transactions across channels and keep drilling-down until the root cause can be identified and protected against a repeat attack. Unfortunately, that type of consolidated view does not exist in most companies. Organizations need to ask themselves some serious questions. Do you really know who is logging into your customers’ accounts? Without realizing their data has been compromised, consumers can fall prey to personalized phishing attacks and “give away the keys” to their accounts. How can you be certain a VIP customer is really behind a high-dollar transaction being rushed to an overseas address? No one wants to decline legitimate orders from loyal customers; but with revenue, reputation and brand equity at stake, no one can afford to ignore the potential risk. What controls are in-place to ensure that a fraudster in Malaysia isn’t using legitimate identity data and an anonymous proxy to submit credit card applications that are a perfect match to credit bureau data? Or to alert when a long-standing offline banking relationship suddenly enrolls online? Once access is established, address and other data can be updated and sold to the highest bidder in underground forums. All of these questions can be addressed through the combination of complex device intelligence, a powerful risk engine and support from industry-leading experts in fraud and risk management. Even after a breach has occurred, the risk can be managed. First, consumers need to be informed on how to protect themselves from sophisticated use of their data. Second, arm your organization with a layered security strategy that includes device intelligence. This will prepare you for the onslaught of compromised card usage, fraudulent enrollments, phishing attacks and attempted account takeovers that follow in the wake of a data breach.

The World Cup of Fraud By David Britton The World Cup “kicks” off this week in Brazil and is a tremendous business opportunity for merchants around the world to sell merchandise, apps, tickets and even the caxirola - this year’s version of the Vuvuzela. This opens the doors for cross-border business transactions and as the doors open for more business, they also open for fraudsters to take advantage of cracks in the system or unsuspecting shoppers. Businesses should remember that the Internet was never designed with security in mind, and that it also affords great anonymity, regardless of the locale of the buyer. International ecommerce studies have shown that ecommerce cross-border fraud can be 7 times higher than fraud within your own country. The anonymity of the Internet allows fraudsters to extend their reach to do damage – and to do so with greater confidence than they might in their own country. Here are some fraud tips for businesses to consider with cross-border ecommerce: Marketing budgets are typically 15% of total costs and require time to plan – don’t let those efforts get hurt by your fraud system. The marketing team needs to work closely with the fraud team. Share those marketing goals with your fraud team so they are aware of marketing projects. Are campaigns on mobile, is there a special sale, package, promotions, gift card, etc. The fraud team needs to know what is out there. Know your target international market to help recognize fraud outliers.   Know ahead of time what the measured attack rate is against your business.   Have appropriate countermeasures and business rules in place when attacks surface.  High risk products require a different strategy than low risk products. Have good data from within your business to understand the threat and to be ready to change course rapidly based on that data. There is also a major shift occurring in the mobile environment where users are rapidly adopting the practice of both perusing and shopping from their pocket-based devices. This shift includes fraud. More credit cards available on the underground than ever before.  Estimates put the total number of compromised identities at over 1 billion records over the past 2 years, many of which include credit card information. Combine this  information with the fact that the card issuers, for cost reasons do not proactively re-issue new cards – it is up to the merchants to be extra diligent when it comes to looking for fraud. Because the data breaches do not just divulge card data, but also the personal identity data elements of the victims, the fraudsters are able to create transactions that look very legitimate.  Merchants must employ technologies that allow them to see beyond the data presented by the user, to the data about the device that is transmitting that data, in order to have real visibility into the transaction.  The data may be completely legitimate; it just may not belong to the person using it.  Conversely, this same insight and capability can allow merchants to safely expand into new geographic markets, by allowing legitimate international transactions, without disruption, and without requiring an army of personnel to do the investigative work. Companies like 41st Parameter, a part of Experian, have spent a decade perfecting the art of how to detect the fraudster in the online anonymous environment.  See how we can help bolster your business defenses, while allowing your business to grow safely into new regions – and take advantage of the millions of customers that might have a hankering for your products.  After Heartbleed: are you vulnerable?