Conversations for Change: How evolving technology enables the evolution of fraud

For a successful fraudster, agility is key. With technology advancing as quickly as it is nowadays, methods of attack will rarely ever work the same way twice – and committing to a single method is practically inviting the possibility of getting caught out.

However, while our ability to develop technology quickly is what makes our society so adaptable to change, it also gives fraudsters access to an increasingly diverse toolkit in turn. New methods of fraud are being developed constantly; with many combining multiple methods to keep targets off balance.

For an example, look no further than the pandemic – where multiple industries had to adjust their business models to incorporate e-commerce functions, or subscription services. Even post-pandemic, the convenience that comes with e-commerce remains unparalleled; with the ability to digitally save card details making transactions as easy as a touch of a button.

However, the prominence and convenience of e-commerce encouraged the abundance of a dangerous form of scam:  formjacking. This is when a fraudster gains access to an e-commerce site, and inputs malicious code to record the financial data of anyone who completes a transaction. With access to that data, the fraudster is free to use it themselves, or sell it on the Dark Web – which, when you consider the thousands of details stolen every day, is highly lucrative for them.

Formjacking is particularly dangerous, since there is no way to detect an attack until it has already been done. While some forms of prevention exist, formjackers are always on the lookout for an exploit – and since their attacks are subtle and easily buried in code, you likely never know whether you’ve been attacked until it’s too late.

This now puts e-commerce sites in a tricky position: though formjacking can be mitigated by adding extra layers of identity verification, the average consumer has become accustomed to the convenience of short transactions. Too many authentication steps could end up turning customers off, costing companies valuable business – meaning that many e-commerce sites are being forced to choose between business continuity and effective scam prevention.

However, consumers also expect complete data security – and will avoid companies who have been unable to prevent attacks from fraudsters in the past; showing that the consequences of an attack can extend far beyond the breach itself.

So with such a thin and precarious tightrope to walk, what can businesses do?

Well, naturally, technology is already adapting to prevent the problem. Nowadays, zero-trust networks and isolation technology seem to be our best line of defence – since they are both well-suited for anticipating and blocking new threats. It’s a good idea to research these to see which would suit your business best – and since it seems to be the best defensive measure we have access to for now, it’s advisable you invest in one sooner rather than later.

However, as mentioned, hackers are always looking for an exploit - so for optimum security, it’s important not to let yourself become complacent.

After all, while the nature of fraud attacks mean that we can only adapt reactively, we can still be proactive in our defences – and awareness of the signs of formjacking is one of our best tools we can use alongside isolation technology. Informing your customers and encouraging them to mask their credit cards just adds another extra layer of protection. Cultivating a system for notifying customers who may have been targeted by formjackers is another example – since it would at least increase the likelihood of customers being able to freeze their cards before any serious damage is done.

Ultimately, fraud will always exist – but the best, and only way we can combat it is by keeping ourselves informed on how technology is evolving, and continually finding ways to effectively incorporate that technology into how we protect our business.

For more news and insights from Apogee, follow us on LinkedIn.