0:00
Good morning everyone and thanks for joining us today. We really appreciate
0:03
you taking the time to be here. We’re going to spend the next 30 minutes
0:06
unpacking some of the most interesting findings from CIF’s latest digital trust
0:10
index report which looks at fraud trends across a global network of digital
0:13
businesses. My name is Brent Sleeper and I’m a
0:16
senior product marketing leader here at Sift and I’m so fortunate to be joined
0:19
by Jeremy Cannon. Jeremy leads CIF’s managed services team and he works
0:23
directly with companies across industries to tackle these challenges
0:26
every day. Jeremy, welcome.
0:27
>> Thanks Brent. I’m excited to be here. Excited to be doing this again with you
0:31
and I’m really excited about the content of this one. I think this has a lot of
0:34
the stuff that our customers, our prospects and people in the fraud
0:37
industry really care about. No, I totally agree. This is a fantastic
0:41
report with lots of really deep insight and data. And Jeremy, as always, I’m
0:45
looking forward to learning from you as you help us translate what we’re seeing
0:47
in the data into what it means in practice. We’ll also have a couple quick
0:51
polls along the way to get perspective from our audience today and to compare
0:54
it to what we’re seeing in the report. So with that, why don’t we jump in? So
0:59
some context today. Though today’s webinar isn’t simply a rehash of the raw
1:03
data, I did want to share a couple topline numbers. Transaction volume
1:07
across SIP’s network grew more than 15% this year. And that means that revenue,
1:12
transactions, and the attack surface are all rising together. Jeremy, did
1:16
anything stand out for you in this edition of the report?
1:20
>> No, I think it’s a little bit what we expected. We’ve often talked about that
1:24
even though we feel like all of our commerce happens online, it’s still a
1:28
small percentage, but it’s growing and that’s what companies are betting on,
1:32
we’re betting on. So, this isn’t surprising. And as it grows, the tax
1:36
surface becomes larger. So, I think in some ways, while there’s some
1:40
interesting findings in here, I don’t think there’s anything that is super
1:44
surprising when it comes to just growing. Fraud’s growing because the
1:49
landscape is growing.
1:51
>> Yeah, I hear that. And for me, there’s a thread in this quarter’s report that
1:54
that hit home. It’s what the criminal organizations, the fraud rings kind of
1:58
behind these attacks look like as exposed through the data. As attacks are
2:02
not individual incidents in isolation. They tend to be part of a larger
2:06
pattern. And that’s something that really can only be revealed because the
2:09
breadth of our customers network across industries and geographies. And
2:14
sometimes I like to think of it as strength in numbers. Today’s report also
2:18
reveals the perniciousness and the persistence of ATO’s and why fraud rates
2:23
can have wildly different impacts at different kinds of businesses, different
2:26
price points and so on and how consumer behavior is affected post incident. So
2:32
this quarter report features two fraud rate examples that come directly from
2:35
our data science team’s analysis of the SIFT global data network. And so these
2:39
are real not hypotheticals. The first is a card testing ring that stood out for
2:44
me for a couple reasons. So Ter, is there anything you’d like to highlight
2:46
in this particular proof of the text?
2:48
>> I think there’s a few things here that are really interesting. One is 94 cards
2:54
from one email. So this is one account, maybe one person testing cards at mass,
3:01
right? So we always think the average person might have a few cards, maybe one
3:05
fails, they move to the next one. But at 94, no one has 94 cards. So you would
3:10
need to think about what are your thresholds and what are your stopping
3:14
where you want to draw the line on how many cards a person can use or try in
3:20
one tying. I also think that while a lot of us know this in the f space is worth
3:26
calling out that the average transaction value is pretty low, right? It’s four
3:30
bucks. That’s maybe a soda, maybe a smoothie. That’d be a cheap smoothie. So
3:34
maybe a soda. And I think what’s trying to happen here is they’re trying to fly
3:39
under the radar, right? Not only to you as the consumer. A lot of us have alerts
3:44
set up on our phone, but they have thresholds, right? I don’t get an alert
3:47
for every time I spend $4. I get it for every time I spend $400. Right? So,
3:51
they’re trying to keep things off of your radar. In addition, they’re trying
3:54
to keep things off the radar of the business. I once with a customer I was
3:58
working with, they were getting these sorts of orders for single cans of soda
4:05
and we believe the reason they chose that was because one, it’s cheap, right?
4:10
It hits those thresholds we were talking about, but two, it actually involves no
4:14
effort from the store. You’re going to come in, you’re going to pick that up
4:17
out the cooler, you’re going to walk maybe show your receipt, walk out the
4:20
door if it was valid, right? So, no one’s noticing that these aren’t getting
4:24
picked up because they’re not something that they have to prepare or make or bag
4:29
for you. So, it’s also trying to fly under everyone’s radar, not just the
4:34
card, the legitimate card holder, but also the store.
4:38
>> Yeah, that makes a lot of sense. Let’s sort of make our order small enough and
4:41
space them and so on so they don’t trip any flags. And candidly, one email
4:46
address cycling through 94 different cards really is a bit sus, right? And if
4:50
that were hitting my business all at once, of course we’d notice that that
4:53
would rip all kinds of flags. But in this case, it’s spread across multiple
4:58
target businesses. And so I think this is yet another example of strength and
5:01
numbers. I’m likely not being hit by all 94 cards in rapid sequence, but across
5:06
my peer businesses and competitors and targets in other industries, that could
5:11
start to become undetectable, but it’s something that of course a network like
5:14
CIS can notice and and can strengthen numbers. The other thing that stands out
5:18
to me, Jeremy, is in this particular ring, they were targeting five different
5:23
food and delivery businesses with a number of fraudulent chargebacks. What’s
5:27
the recommendation that you’d have if you detected this as a practitioner or
5:31
if you were advising one of your customers? How should they respond? Just
5:35
slow this down, block it. What do you say?
5:38
>> Yeah, I think with card testing, it’s pretty easy to block. I don’t think
5:42
there’s a lot of at some point there’s a threshold customer experience is not a
5:47
thing you need to worry about as much as with what we’ll talk about later with
5:50
some atto stuff right I think you can block these you can be aggressive
5:54
>> I work with a lot of companies where we are seeing what the average amount of
5:59
cards that someone has are and blocking just above that right at some point you
6:04
have to make the decision if someone needs to test if even if a legitimate
6:09
user needs to try their nine credit cards to order this thing. At some
6:12
point, you just have to make a decision. Is that worth it? And I think in this
6:16
case, blocking is really being aggressive about this card testing. I
6:20
think generally a good stance. Like most things, there’s nuances. There’s certain
6:24
types of businesses where you might need to think about things a little
6:27
differently, but overall for card testing, I think we can try to be
6:30
aggressive at some point. There’s another thing to point out about card
6:34
testing. I imagine a lot of people on this call know, but what they’re trying
6:37
to accomplish here is exactly what it says. is testing the card. That’s why
6:42
they’re targeting restaurants places that have these small value items. What
6:47
they’re trying to see is of these 94 cards, how many of them went through so
6:51
I can then sell them on as valid for some of these bigger transactions that
6:56
we might talk about a little bit later in this. So, they’re not trying to get
7:01
the soda. They’re trying to test the card. And I think it’s an important
7:05
distinction when we think about who we’re dealing with and why.
7:10
Yeah, that makes a lot of sense and it requires in some ways putting yourself
7:14
in the mindset of an attacker. So, we’re all incentivized to make sure that Coke
7:18
or Pepsi doesn’t get stolen, but at the end of the day, we’re trying to protect
7:22
our business from some bigger issues.
7:23
>> I think it’s important to think about your normal customer, right? Like, is
7:26
someone really ordering from your sandwich shop a single soda to be picked
7:31
up? That person’s more than likely going to the gas station, the bodega to pick
7:37
that up, right? So, this is not a normal customer behavior to be ordering a
7:43
single drink at your sandwich shop for pickup, right? They already have to
7:46
leave their house, they have to go pick it up. Why wouldn’t they just go by the
7:50
store where there’s a better selection, frankly?
7:52
>> Oh, Jeremy, I’m really thirsty.
7:56
>> Looking now at a different kind of ring. This particular visualization was
8:01
detected on SIF data network, but tied to user account takeover attempts. And
8:07
one thing I took from the report, Jeremy, is that atto rings look a little
8:10
different than card testing patterns may be a little messier and in particular
8:14
showing that both legitimate accepts and blocks can happen on the same sort of
8:19
cluster of users and identities. What does that mixed signal profile change
8:24
about how a team should respond compared to a uniform risk of card testing?
8:28
>> Yeah, I think we all know that atto is the trickier one, right? There’s a lot
8:34
of signals that look really good. they look like a normal user doing a normal
8:40
thing even if they are actually then in turned sometimes people will take over
8:44
accounts to do card testing right because they know that this is an
8:48
account with an established history that might be under less scrutiny and that’s
8:54
why while we talk a lot about atto as a type of fraud it’s important to think
8:59
often you need a tool like sift that has separate models for detecting these
9:04
things because with atto it’s really more about the session where they logged
9:08
in. Is that anomalous to them? Because the accounts are good. Sometimes the
9:12
payment methods are the payment methods that were on the account. Sometimes
9:16
they’re spending points or rewards depending on what your brand is.
9:20
Sometimes their goal is to get to the next level, right? They’re selling these
9:24
accounts on and like I mentioned, sometimes they’re using them for card
9:27
testing because they think, oh, this will have less scrutiny because this is
9:30
Brent’s account, right? So, we really have to look at atto differently. And
9:35
while sometimes some of the same actors are doing both the things, the
9:38
behaviors, the signals, everything looks a lot differently. And if you look at it
9:42
solely on transaction level, it can look a lot like a real user.
9:46
>> Yeah. So is the strategy here friction putting some brakes on the process? Do
9:50
you continue to block? What would you advise if your customers encountering
9:53
this particular ring?
9:55
>> Yeah, that’s a great question and I think you’re right on the money, right?
9:57
We talked about the last one where we can block. the damage to your business
10:01
is a lot less to block a card tester, someone that’s trying to buy a $4 thing,
10:07
even if they were legitimate. What is the damage? It’s minimal. But here,
10:10
these are real accounts for real customers who have done business with
10:15
you in the past, and they have been compromised, right? And they can look a
10:18
lot like a real user. So I think this is the place where adding friction, some
10:23
sort of step up authentication, emails, alerts, things that kind of make
10:28
it harder for them to get through. Maybe revalidating the code on the back of
10:32
your card for what certain anomalous behavior is met. Things like that can be
10:37
really helpful here in filtering out the compromised accounts versus the France
10:42
account, but he just happens to be traveling or he’s using his
10:46
mother-in-law’s credit card for this order, which the two of those things can
10:49
look very similar, but that extra step can help you sift through those and get
10:54
the separate the good from the bad.
10:57
>> Yeah, I appreciate and as a user, as a consumer, sure, sometimes we have to
11:01
enter that CBC again. It’s a little bit irritating, but frankly a very minor up
11:06
as compared to either being locked out completely or even worse having my
11:10
account stolen from me and bad things happen. And we talked about this in a
11:14
previous webinar and I think your opinion is becoming the prevailing
11:19
opinion. People don’t mind an extra step, especially if you’re transparent
11:23
and clear about what’s happening and why you’re doing it. I think people are more
11:26
than happy to take that extra step. And I think we’re going to get into some of
11:30
that consumer response a little bit later today. But before we do, I wanted
11:34
to go a little deeper on this particular ring that was detected in the data. So
11:39
this ring targeted more than 90 businesses across multiple industries
11:43
and generated nearly 13,000 attempted transactions. That’s that’s a big
11:48
number. Are there other attributes here that stand out to you that might be a
11:51
lesson for a team that’s encountering a similar kind of attack?
11:54
>> Yeah, I think there’s a few things here. One thing I want to highlight is you’ll
11:57
notice the average transaction volume is a lot more right the goal here is to
12:01
actually extract value right so this is different than what we saw before
12:06
average transaction volume it’s generally tends to be a little bit
12:10
higher we see than your average transaction volume but depending on what
12:14
you sell it’s still not going to be so anomalous that alone is a signal but it
12:19
is something you should consider if your average transaction volume is
12:22
consistently 150 bucks and those larger orders just might be something that you
12:26
need a little more scrutiny on. Another one that I think is really important is
12:30
this a loyalty account email changes as a leading indicator. Right? What often
12:36
is trying to happen here is people are trying to take full control of the
12:39
account. They want the email sent to them. They want the receipt sent to
12:42
them. They want all the things sent to them. And if they can slip that one
12:48
email change notification that you might get by you, then they have control of
12:52
your account. I think most of us there are obviously valid exceptions to change
12:58
your email and we need to allow that but a lot of us we have the same email we’ve
13:02
had it for a long time and I think it’s a good signal to think about what is the
13:06
common sense of fraud what is a valid use case for someone to change their
13:11
email and if they change it from brent sleepergmail.com
13:15
to jeremy cannongmail.com that feels like a misalignment.
13:19
>> It does. Jeremy he’s a bad actor. I would not want him to take over my
13:23
account. So, one of the things that you already noted this, but I just want to
13:26
underscore it is the fact that there’s manual accepts and manual blocks
13:31
happening in the same cluster of events is really interesting to me. That feels
13:35
like a different kind of pattern than the card testing and type attacks that
13:40
we just talked about a couple slides ago.
13:41
>> Yeah, this is what we were talking about before where they look a lot like real
13:45
transactions. Their goal is to make them look like real transactions. So that’s
13:48
why you need other signals other than just the transaction, right? Especially,
13:52
let’s say you are that sandwich shop we talked about earlier. If you’re a chain,
13:57
it’s reasonable that someone might be moving. So just cuz they ordered in
14:01
Massachusetts and then in California, that’s not suspect. But if you can tie
14:04
that to some other things where they ordered from a different device, they
14:08
ordered from a different IP than normal or an IP that doesn’t match because
14:12
they’re going through a VPN, you can tie the session things together and make
14:18
better decision if it’s fraudulent or not. But if you’re looking at
14:21
transaction level and I take over your account and I’m place a pretty standard
14:25
order even across state lines, it looks legitimate. So, we talked a little bit
14:31
about, for example, changing an email address on a loyalty account. Is a big
14:34
tell of a compromise. You also suggested when we were talking about card testing
14:39
that the goal there is to quickly test the card and then presumably resell it
14:43
on the market or whatever. How often is that done handinhand with ATO’s? And
14:49
maybe I’m being a little bit too speculative here, but if I’m a criminal
14:52
organization testing a bunch of cars, get a bunch of valid numbers, do I then
14:56
try to reuse those and extract value in a compromised account? Do I just sell
14:59
them? What’s
15:00
>> I think it can go a lot of ways, but we generally see that the people testing
15:04
the cards are not the people using the cards, right? They have a system set up
15:08
to kind of test them at mass, put them on the web for sale, and then someone
15:12
else will buy them in batches or individually and use them. But what we
15:18
do see a lot of times is those same cards that are tested will show up on
15:22
atto accounts. And it’s for all the reasons that we talked about before. If
15:26
I spin up a new account with a stolen credit card, synthetic ID, all of those
15:30
things, there might be signals in there that at least I’m worried about as a
15:35
fraudster that could get me blocked. But if I’m able to take over a good account
15:38
with a good user history that’s probably changed credit cards a couple times for
15:43
various reasons and then I can put this credit card on there, then there’s a lot
15:50
lower chance, especially if you’re just looking at the payment side of it, a lot
15:54
lower chance that I’m getting caught. So it leads me to do maximal damage.
16:00
>> Yeah. Yeah, I hear that for sure. And I think again it proves the value of
16:03
having a big picture perspective. A number of these things can look okay
16:07
potentially in isolation and yet when you put everything together into a
16:10
pattern things don’t add up. Jeremy our friend Kevin Lee who’s field CTO
16:16
observed that a 3% block rate at one merchant might be just the tail of an
16:20
attack that started elsewhere. What does he mean by that?
16:23
>> We have we talked about this before like in some of the data that you’re talking
16:27
about there is not they’re not just testing this at one place right this is
16:31
going across this is going across the board. So maybe this merchant, they saw
16:35
their block rate go up because they have a good tool in place, but it could be
16:40
the tail end of an attack that started somewhere completely outside of your
16:45
ecosystem.
16:46
>> Yeah.
16:47
>> Or started somewhere else in your user journey, meaning they took accounts over
16:51
and then used them with the fraudulent payment methods that eventually got
16:55
blocked. Right. So it’s we can’t look at any of these signals, any of these
17:01
rates, really anything in isolation. We have to, like you said, look at
17:06
everything big picture. And even better, if you have a network, look at it across
17:12
a network so you can understand that this probably isn’t just happening to
17:16
you.
17:17
>> Yeah. Got it. That that makes a lot of sense. So we are going to ask our
17:22
audience now to put yourself in your customer shoes. So, I know you spent all
17:26
day thinking about fraud and can sometimes get into that headsp space,
17:29
but we’d like you to think about yourself as just a consumer, a shopper
17:33
who’s maybe trying to buy something online. You’re somebody in your family
17:36
who’s doing this. So, think about it from that perspective. So, question I
17:39
have for you as a consumer is how have you first found out about ATO’s? Were
17:44
you notified by the company? Did you yourself notice some suspicious
17:48
activity? Maybe a friend or a family member told you about it or you tried to
17:52
log in and couldn’t access your account? So, if you could just give us a moment
17:56
and let us know how you found out about it.
17:58
>> Yeah, I think this is an interesting question because I think we often as
18:02
practitioners think about like how we would address something and not like how
18:07
we would feel as consumers
18:09
>> and I think the way that you find out about stuff is really important and it
18:14
can change the way that you feel about the attack. So, I’ll be interested to
18:17
see what people say. All right. Well, it looks like the results are in there,
18:21
Brandon. Looks like it’s mostly a tie between notice suspicious activity or
18:26
unauthorized and friends and family members or a
18:30
colleague let you know. I find this interesting. No one in the audience said
18:35
the company or platform notified them. And I think that’s really interesting
18:37
and I think we’ll talk a little bit more about that on the next slide.
18:41
>> Yeah, that surprised me too. Makes me wonder if those companies maybe weren’t
18:45
quite doing what they needed to. Now comparing what our audience just said
18:48
here uh in our research and our broad broad consumer survey more than a third
18:52
hear from the company first and in a sort of tailing off here at the notice
18:57
themselves are alerted by friends just interesting distinction there Jeremy do
19:01
you think in the case of our audience the sites the businesses that they were
19:04
trying to do business with didn’t tell them did those companies let them down
19:08
>> I think so yeah ATO’s happen right that’s the world we live in it’s they
19:13
happen for a number of reasons the worst feeling is for you to find it on your
19:17
own, for you to catch something, right? You want to feel like the company has
19:21
your back and that they’re on top of this. And by being the ones that notify
19:26
you, I feel like it does kind of give you a little more trust in them. Yeah.
19:31
Yeah. I fundamentally agree. We’re going to now ask a similar question. How would
19:35
you as a consumer, as a user, how would you feel about interacting with our
19:40
platform sort of post fraud incident? So after you find out this is happening or
19:44
after you’ve been notified, what would you do? Would you keep on using them
19:47
without any hesitation? Would you be cautious but still do it because they’re
19:51
for whatever reason a place you want to do business with?
19:54
>> I think this is also important, right? At the end of the day, we’re all in the
19:56
trust business. And if someone stops using you permanently or continues using
20:01
you with less trust, then I think that hurts your brand, right? A lot of this
20:05
is not just about the financial losses. It is about the brand reputation and
20:10
those things. So, I think I’ll be interested to see what people say, but I
20:14
know me personally, I think anytime I have a something like this happens, how
20:19
the company handles it is really, really key to where I
20:24
go in the future and if I choose to prioritize them.
20:28
>> Yeah, totally agree with that. I think a company’s response shows a lot about how
20:32
it wants to treat me as a customer. I’m curious. Let’s see what our audience
20:37
themselves experienced here their perspectives on it. What do you see in
20:41
these numbers?
20:42
>> Yeah, I think it in some ways is pretty expected. It really is across the board.
20:47
They’re all pretty even. The one that sort of edges out the others is
20:51
dependent on how the company handles it, which is just what we were just what we
20:55
were saying.
20:56
>> Yeah.
20:56
>> I also think that there’s some context and continue using but with less trust
21:00
because some places have a captive audience, right? If it’s a bank or it’s
21:03
a institution that you can’t divest from as easily, I think it you might have
21:10
chose to stop using it permanently but are just feel that you kind of don’t
21:14
have anywhere else to go.
21:16
>> Yeah, that’s right. And if just briefly look at the results from our our broad
21:20
survey here in the current vision of going forward, I think it actually
21:23
aligns pretty well what we just saw in our poll that distribution is spread
21:27
pretty evenly across all those actions. One thing I did want to get to though,
21:31
Jeremy, is how and this this really builds on what we were just chatting
21:34
about, how a company response affects a consumer’s perception of it. This I’ll
21:38
verbally quickly explain the chart and Joe, I’d love to hear your point of view
21:41
on it. So for each of the actions on the left here, they resolved it quickly.
21:44
They communicate proactively and so on. How does that affect consumer response?
21:48
It significantly improves a consumer’s perception. It significantly worsens and
21:52
so on. Um, what do you see in this chart that that’s interesting to you? Well,
21:57
the first thing I see in this chart is that 2% of people think that resolving
22:01
their issue quickly makes it significantly worse. And I would really
22:04
enjoy having a conversation with some of these people cuz I have a lot of
22:08
questions. So, if any of you in the audience are that 2%, please email me
22:14
because I have questions. But all joking aside, I think what it really tells us
22:19
is that the way you handle this is really dependent on if customers come
22:23
back. If you look at the top three, they are all proactive. We handled it. We
22:31
were transparent and they collectively all the grain boxes. If you look at the
22:37
bottom three,
22:38
>> yeah,
22:38
>> reactive is a little bit like, well, they handled it, but after that, it’s
22:42
>> you basically see the inburst that by not communicating, by resolving it
22:46
slowly,
22:48
>> you lose customers. And so it’s really important to make sure that we are using
22:54
our teams like marketing or comms and customer support to make sure we’re
22:59
getting these messages out quick, proactively, and being as transparent as
23:03
we can because people appreciate that and it’ll make them think that you do
23:07
have their back even though this happened.
23:10
>> Yeah, 100%. I just did some quick math and if you add up sort of the
23:14
significantly improves and somewhat improves numbers a quick resolution
23:18
improves consumer perception for 80% of your user base that’s a significant
23:22
number and the inverse if you’re opaque in your communication if you’re not
23:26
transparent and so on it actually worsens it for almost half. So I think
23:29
that dynamic is pretty clear and so response quality is really it’s not just
23:35
emergency response uh procedure but it’s actually potentially a retention lever
23:39
for your business. Jeremy, quickly, do you have any advice on how fraud
23:44
professionals should think about these numbers and are there things they can do
23:47
in their own business to make sense of this or to act on it?
23:50
>> Yeah, I think this is one of those cases where it’s really important to have
23:54
advocates on other teams inside the business, right? I think a lot of times
23:58
we can feel siloed in the fraud world or like our job is to stop this, right?
24:03
It’s to make sure it doesn’t happen again. The resolution part is not always
24:07
in our remitt. So making sure that we have advocates on the comm’s team, the
24:12
CX team, the CX team is going to be fielding some of these things and that
24:16
we’re giving a clear, concise, and honestly the same message is going out
24:22
to everyone that reaches out
24:24
>> is really important here. And having people that are broad-minded on
24:28
marketing teams, experience, customer experience teams to really help you. I
24:33
think you said when we were talking about this, make friends in peace time,
24:36
right? You want to make friends with them in peace time because when this
24:39
stuff happens, you want to have your advocates ready. You don’t want to have
24:42
to be selling them on
24:45
>> here’s what we need to do and why.
24:47
>> Yeah, I think that’s very wise advice. We are just about at the end of our
24:51
time. First of all, thank you everyone for joining us. We focused on just part
24:55
of the data in this quarter’s digital trust index report and there’s a ton
24:58
more you can learn. You can either visit sip.com/broadcenter
25:03
or look for numeric and there you can read the full report and track other key
25:07
metrics and we really encourage you to check it out. I think this is a
25:10
fantastic addition. Lots of great insight. I really want to give my
25:13
supplements to the team that did that analysis and put it together. Jeremy,
25:16
before we do wrap up today, if the audience takes one action item away,
25:20
what would it be?
25:22
>> I still think at the end of the day it is use all the signals around you, use
25:26
everything, but also use all the people around you. make those make those
25:30
friends on other teams that you’re going to need to quote you in peace time. So,
25:34
it’s really aggregating all the right signals and all the right people that
25:38
help you.
25:39
>> Thank you, Jeremy. Very wise. And everyone in the audience, thank you so
25:43
much for joining us. On behalf of Jeremy and Bolstiff’s team, I hope you have a
25:46
really good day and we’ll see you next
