The occurrence of an unprecedented crime has rocked the American state of Idaho. In Boise, Ryan M. Tichy has pleaded guilty to committing wire fraud and identity theft against many individuals, from the period of at least May 2018 through November 2020. He illegally obtained the identification details of victims, which include their account numbers, full names, dates of birth, and social security numbers. This information was used to generate false identification documents, take loans, and make purchases that sustained his lifestyle. He frequently created fake driver’s licenses using the victim’s name and his own picture to travel around several states and carry out fraudulent purchases.
We see financial crimes happen, even in the most unsuspecting places. However, this risk would increase when faced with various circumstances. There is a need to understand account takeover fraud and how to prevent it.
The Basics: Account Takeover Fraud
Taking over an account by gaining access and control over a customer’s login credentials is known as Account Takeover Fraud. A bank account, credit card account, email account, or e-commerce account could be affected. Following a successful account takeover scam, the cybercriminal will use the stolen credentials to make unauthorised purchases, carry out fraudulent activities, and extract and sell account information. In this scenario, certain variables increase the likelihood of account takeover fraud.
Data breaches increase the risk of account takeover fraud taking place. Through data breaches, cybercriminals can gain the login credentials of customers and companies. When account usernames and passwords are exposed, hackers have an easier time gaining access to the accounts. The user likely has other accounts which have identical credentials, allowing them to breach more accounts.
Malware also contributes to the increased risk of account takeover fraud. Malware is a term used to describe unwanted software that is frequently downloaded from untrustworthy sources. Some malware will damage the computer system, while others will offer hackers access to anything the user types on the keyboard. Hackers can obtain the user’s login credentials using this method.
Phishing is a factor allowing account takeover fraud to thrive. Phishing scams can take place in a variety of ways, including emails, text messages, HTTPS, and more. Essentially, it would attempt to persuade consumers to click on a bogus link. If the visitor clicks on the link, it will take him to a sham website. A phishing email, for example, may spoof a well-known bank. When the user clicks on the link or opens an attachment, it will take the user to a fraudulent website where his login credentials will be stolen.
Consequences
Account takeover fraud affects both businesses and individuals. Businesses’ reputations would be harmed, leading to a loss of customer trust and, as a result, fewer customers. This is because such fraud immediately impacts customers, who will contact the company hoping to rectify the problem. As customers will be affected emotionally as well, these negative impacts need to be avoided.
How to Prevent Account Takeover Fraud?
There are multiple ways to prevent account takeover fraud for both consumers and companies. These includes:
- Strong Passwords: Companies should encourage their customers to create lengthy passwords with mixed characters so that scammers do not easily guess their passwords, thus preventing account takeover fraud. Similarly, the company itself should do so.
- Two-Factor Authentication (2FA) or Multi-Factor Authentication (MFA): Businesses and consumers alike often use only one-factor authentication since logging into accounts only requires a simple password; however, this is not secure enough. At a minimum, a two-factor authentication should be used instead, whereby a one-time password may be generated after the password is keyed in. Multi-factor authentication would be even better as it would require the use of applications such as Google Authenticator.
- Digital Onboarding and Know-Your-Customer (KYC): Businesses can check that the person in the live selfie matches the person in the other submitted identification documents by using a live selfie feature that may be available through digital onboarding. On the other side, KYC would offer an additional screen to ensure that the customer does not have a history of fraud or money laundering. By doing so, companies can identify suspicious individuals before working with them.
- Transaction Monitoring: Businesses can keep an eye out for any unusual activity, such as a sudden increase in substantial client transaction values, by continuously monitoring their transactions. They can then investigate the cause of the rise or halt the flow of funds after spotting this.
Taking extra precautions or engaging the various modules and services will keep fraud at bay. Through the construction of a robust anti-money laundering defence system, it would lessen the chance of being scammed. It is convenient yet essential to protect your business from such risks in the current digital environment.
