e-commerce fraud

The fraud definitions used by EAST are shown below.  These have been prepared by the EAST Payments Task Force (EPTF), with input from the EAST Expert Group on All Terminal Fraud (EGAF).

The aim is for these fraud definitions to be adopted globally when describing or reporting payment or terminal fraud.

These definitions are based on the Fraud Terminology published by EAST.  EAST also publishes Central/Host Fraud Definitions, Terminal Fraud Definitions , Terminology for the Location of Fraudulent Devices and Terminal Physical Attacks Definitions and Terminology

FRAUD TYPE

TECHNOLOGICAL FRAUD
(Attacks against Technology)
Any type of scheme that uses one or more components of the internet to distribute software, exploit systems, publish fraudulent solicitations, conduct fraudulent transactions, or transmit proceeds obtained through fraud
CNP – Card Not PresentA card not present transaction (CNP, MO/TO, Mail Order / Telephone Order, MOTOEC) is a payment card transaction made where the cardholder does not or cannot physically present the card for a merchant's visual examination at the time that an order is given and payment effected
CP – Card PresentA card present transaction occurs when a cardholder physically presents a card to request and authorise a financial transaction
Merchant FraudFraud that occurs when a merchant account is used without the intention of operating a legitimate business transaction.
Virtual Currency FraudFraud that involves virtual currency, or virtual money, which is a type of unregulated, digital money, issued and usually controlled by its developers and used and accepted among the members of a specific virtual community.
Cheque FraudA category of criminal acts that involve making the unlawful use of cheques in order to illegally acquire or borrow funds that do not exist within the account balance or account-holder's legal ownership. Most methods involve taking advantage the time between the negotiation of the cheque and its clearance at the cheque writer's financial institution to draw out these funds.
Cheque FraudFraud perpetrate via omni- channel means to digital banking or payments channels such as home banking or other electronic services.
Digital FraudFraud perpetrated via mobile devices to digital banking, payments channels such as home banking or other electronic services, or online merchants
Telephone FraudFraud perpetrated via land line telephone means to banking or payments channels such as home banking or other electronic services or merchants
Standing Order FraudFraud occurs when a standing order is falsely created or adulterated. A standing order is an automated method of making payments, where a person or business instructs their bank to pay another person or business, a fixed amount of money at regular intervals. Fraud occurs when a standing order is falsely created or adulterated.
Invoice FraudInvoice fraud happens when a company or organisation is tricked into changing bank account payee details for a payment. Criminals pose as regular suppliers to the company or organisation and will make a formal request for bank account details to be changed or emit false invoices.
Romance FraudRomance scam is a confidence trick involving feigning romantic intentions towards a victim, gaining their affection, and then using that goodwill to commit fraud. Fraudulent acts may involve access to the victim's money, bank accounts, credit cards, passports, e-mail accounts, or national identification numbers; or forcing the victims to commit financial fraud on their behalf.
CEO/BEC FraudA scam in which cybercriminals spoof company email accounts and impersonate executives to try and fool an employee in accounting or HR into executing unauthorized wire transfers, or sending out confidential information
Investment fraudA deceptive practice in the stock or commodities markets that induces investors to make purchase or sale decisions on the basis of false information, frequently resulting in losses, in violation of securities laws.
Money launderingAn illegal process of concealing the origins of money obtained illegally by passing it through a complex sequence of banking transfers or commercial transactions. The overall scheme of this process returns the money to the launderer in an obscure and indirect way.
BIN AttackCredit cards are produced in BIN ranges. Where an issuer does not use random generation of the card number, it is possible for an attacker to obtain one good card number and generate valid card numbers
Black Box AttackType of Jackpotting attack. Connection of an unauthorized device which sends dispense commands directly to the ATM cash dispenser in order to “cash out” the ATM – SEE FULL TERMINAL FRAUD DEFINITION
DoS - Denial of Service AttackIn computing, a denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet
MITM - Man-in-the-Middle AttackIn cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other
Transaction Reversal FraudUnauthorized physical manipulation of ATM cash withdrawal. Appears that cash has not been dispensed – a reversal message generated – SEE FULL TERMINAL FRAUD DEFINITION
Transaction Message AdulterationThe data contained in an authorisation message is manipulated to try to fool the payment processor.
NON-TECHNOLOGICAL FRAUD
(Attacks against the Victim)
Any type of scheme that uses components of deception or manipulation to realize fraudulent solicitations, conduct fraudulent transactions, or transmit proceeds obtained through fraud
Account Takeover FraudAccount takeover fraud is a form of identity theft in which the fraudster gets access to a victim's bank or credit card accounts -- through a data breach, malware or phishing -- and uses them to make unauthorised transaction
First Party (Friendly) FraudFraud committed against a financial institution by one of its own customers
Identity Spoofing (or entity hacking)Identity Spoofing refers to the action of assuming (i.e., taking on) the identity of some other entity (human or non-human) and then using that identity to accomplish a goal. An adversary may craft messages that appear to come from a different principle or use stolen / spoofed authentication credentials. Alternatively, an adversary may intercept a message from a legitimate sender and attempt to make it look like the message comes from them without changing its content. The latter form of this attack can be used to hijack credentials from legitimate users. Identity Spoofing attacks need not be limited to transmitted messages - any resource that is associated with an identity (for example, a file with a signature) can be the target of an attack where the adversary attempts to change the apparent identity
Authorised Push Payment FraudA form of fraud in which victims are manipulated into making real-time payments to fraudsters, typically by social engineering attacks involving impersonation.
Direct Debit FraudDirect debit fraud can take place in several ways. It is often associated with identity theft, where the scammer gains access to the bank account information by posing as the victim. They can pay for services and products via a direct debit option and use this account until its owner notices.
ExtortionObtaining benefit through coercion
Cash TrappingUnauthorised physical manipulation of a costumer’s cash withdrawal preventing costumer access to cash – SEE FULL TERMINAL FRAUD DEFINITION
Lost/Stolen CardThe loss of or theft of a card, which is subsequently used for illegal purposes until blocked by the card issuer.

FRAUD ORIGIN

SOCIAL ENGINEERINGIn the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access
PhishingTechnique of fraudulently obtaining private information. Typically, the phisher sends an e-mail that appears to come from a legitimate business—a bank, or credit card company—requesting "verification" of information and warning of some dire consequence if it is not provided. The e-mail usually contains a link to a fraudulent web page that seems legitimate.
Spear-phishingAlthough similar to "phishing", spear phishing is a technique that fraudulently obtains private information by sending highly customized emails to few end users. It is the main difference between phishing attacks because phishing campaigns focus on sending out high volumes of generalized emails with the expectation that only a few people will respond. On the other hand, spear phishing emails require the attacker to perform additional research on their targets in order to "trick" end users into performing requested activities.
VishingAlso known as "voice phishing", is the criminal practice of using social engineering over the telephone system to gain access to private personal and financial information from the public for the purpose of financial reward. It is also employed by attackers for reconnaissance purposes to gather more detailed intelligence on a target organisation.
SmishingAlso known as "SMS Phishing", is a form of criminal activity using social engineering techniques. SMS phishing uses cell phone text messages to deliver information and/or requests to induce people to divulge or to take action that will compromise their personal or confidential information.
Shoulder SurfingTechnique used to obtain information such as personal identification numbers (PINs), passwords and other confidential data by looking over the victim's shoulder
DistractionThe process of diverting the attention of an individual or group from a desired area of focus and thereby blocking or diminishing the reception of desired information.
Push PaymentsAuthorised push payment fraud happens when fraudsters deceive consumers or individuals at a business to send them a payment under false pretences to a bank account controlled by the fraudster. As payments made using real-time payment schemes are irrevocable, the victims cannot reverse a payment once they realise they have been conned.
DATA COMPROMISEA data compromise is an incident in which sensitive, protected, or confidential data is copied, transmitted, viewed, stolen or used for illicit means
MalwareSoftware which is specifically designed to disrupt, damage, or gain authorised access to a computer system
ATM MalwareUnauthorised software, or authorises software run in an unauthorized manner on ATM PC - SEE FULL TERMINAL FRAUD DEFINITION
Data BreachA data breach is a security incident in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used from a PC or Computer Network by an entity unauthorised to do so.
RansomwareA type of malicious software designed to block access to a computer system until a sum of money is paid
Fake WebsiteA website that is not a legitimate venue, the site is designed to entice the visitor into revealing sensitive information, to download some form of malware or to purchase products that never arrive
Fake AppApps in mobile devices that trick users into downloading them. They may also pose as quirky and attractive apps, providing interesting services. Once installed on a mobile device, fake apps can perform a variety of malicious routines.
e-SkimmingCyber criminals introduce skimming code on e-commerce payment card processing web pages to capture credit card and personally identifiable information and send the stolen data to a domain under their control.
Skimming - CPP ATMCPP analysis identifies the likely ATM location from where card numbers were stolen so that banks can mitigate fraud on other compromised cards - SEE FULL TERMINAL FRAUD DEFINITION
Skimming - CPP UPTCPP analysis identifies Payment Terminal parking, transport, fuel, etc. locations, from where card numbers were stolen so that banks can mitigate fraud on other compromised cards.
Skimming - CPP POSCPP analysis identifies the likely merchant, POS or ATM location from where card numbers were stolen so that banks can mitigate fraud on other compromised cards.
Skimming - CPP Virtual TerminalSame as e-Skimming
Card TrappingUnauthorized physical ATM manipulation, preventing card from being returned to customer - SEE FULL TERMINAL FRAUD DEFINITION

DUE DILIGENCE

DUE DILIGENCEDue Diligence is the care that a reasonable person or company exercises to avoid harm to other persons, their property or information.
Lack of Patching / SecurityPatch management is the best practice of upgrading existing software applications to remove any weak security patches that could be exploited by hackers. Lack of proper patching allows cyber criminals to exploit systems and networks.
Bad implementationProcess where an information system is deployed into a Production Environed with faults, errors or vulnerabilities
Deployment ErrorImplementation of a system, solution or service not according to defined and tested best practices.
Merchant NegligenceMerchants not following best practice procedures to avoid criminal or fraudulent activity,
Implementation not according to StandardsImplementation of a sstem, solution or service not according to defined and tested standards