2024 Fraud Trends: A Guide to eCommerce Threats & How to Mitigate Risk

How Phishing Happens

Deceptive emails

The most common phishing tactic involves sending emails that mimic legitimate communications from well-known brands, enticing recipients to click on malicious links or attachments.

Spoofed websites

Fraudsters create fake websites that resemble legitimate eCommerce platforms. Unsuspecting users enter their login credentials or payment information, which goes straight to the attackers.

Social media scams

Phishing attempts may also occur via social media, where fraudsters use direct messages or fake ads to trick shoppers into visiting phishing sites — fraudulent copies of a legitimate website — or disclosing personal information.

Smishing (SMS phishing)

Phishers will send text messages, posing as a store representative or shipping carrier, that prompt unsuspecting shoppers to provide sensitive information or download malware.

Spear phishing

Targeted attacks aimed at specific individuals or companies, often using personal information to make the scam more convincing.

Vishing (voice phishing)

Phone calls to deceive people into surrendering personal information.

How to Prevent eCommerce Phishing

Educate your team and customers

Regularly update your team and customers about the latest phishing schemes and social engineering techniques. Teach your team how to scrutinize emails, links, and attachments to ensure they are safe. Perform simulated phishing attacks to train employees to recognize and respond appropriately to phishing attempts.

Implement advanced security measures

Utilize email filtering, web filtering, and anti-phishing software to detect and
block phishing attempts.

Secure your website

Ensure your website uses HTTPS and educate customers to look for the security padlock in their browser before entering any personal information. 

Add an extra layer of security to ALL accounts

Require all customers to set up multi-factor authentication (MFA) for store accounts; require the same of employees for all the tools they use for work.

Regularly monitor and audit your systems

Regular checks can help detect any unusual activity and prevent potential breaches.

How First-Party Fraud Happens

“>Friendly fraud or chargeback fraud

When a consumer makes a legitimate transaction and then disputes it as fraud or unauthorized to avoid payment.

Return fraud or refund abuse

Customers exploit a merchant’s return policy by claiming a product was not as described, faulty, or that an item was not received (INR) to secure a refund or replacement while retaining the original item.

Overstating financial information

Individuals inflate their income or assets on credit or buy now pay later (BNPL) applications to qualify for purchases they have no intention of repaying.

How to Prevent First-Party Fraud

Monitor shopper behavior and block repeat offenders

Use advanced analytics to detect unusual shopping patterns like high return rates. Set alerts so your fraud analysts or customer service representatives can further investigate suspicious accounts. Add repeat offenders to your fraud prevention solution’s blocklist so future transactions are automatically rejected.

Report repeat offenders to their financial institution

Maintain an effective chargeback management process by keeping thorough records of all transaction details. Report repeat offenders to their bank or credit card company so they can take further action — and provide all the evidence you’ve compiled over multiple transactions. 

Create dynamic return policies

Tailor return policies based on customer history and risk profiles to prevent exploitation. For riskier customers, establish stricter refund policies, such as shorter return windows or requirements for original packaging and receipts, to deter fraudulent returns.

Regularly audit returns and chargebacks

Conduct regular audits of returned items to ensure they match the product descriptions and conditions as claimed by the customers. Audit chargeback transactions and look for patterns that may be indicative of fraud.

Follow chargeback prevention best practices

Before a customer makes a purchase, the best approach a business can take is to make sure they’re delivering a premium pre-purchase experience. Are your product descriptions clear and accurate? Is the return policy clearly posted and easy to understand? And after purchase, make sure to continue the experience by delivering white-glove-level customer service. A great customer experience can be a strong deterrent for friendly fraudsters, who may feel guilty scamming a brand they’ve grown to love.

How Stolen Identities & Unauthorized Purchases Happen

Phishing attacks

Cybercriminals acquire credit card details or account passwords through phishing, data breaches, or purchasing them on the dark web. Fraudsters may deceive shoppers — using manipulative social engineering tactics — into revealing their login credentials through fake emails or websites masquerading as legitimate businesses. Merchants can also become victims of social engineering as fraudsters trick eCommerce teams into granting access to a customer’s account. 

Data breaches

Cybercriminals hack into databases of eCommerce sites to steal the personal and financial information of customers.

Credential stuffing and automated testing

“>Cybercriminals hack into databases of eCommerce sites to steal the personal and financial information of customers.

Validation and exploitation

Once a card or account is verified as active, it’s used for larger fraudulent purchases or sold to other criminals.

Chargebacks and losses

Merchants face chargebacks from legitimate cardholders, incurring fees, losing out on merchandise, and consequences from exceeding chargeback thresholds.

How to Prevent Unauthorized Purchases

Monitor transactions and perform velocity checks

Implement systems to detect unusual transaction patterns, such as multiple attempts with different cards from the same IP address or logins from new devices or locations, which could indicate an ATO attempt. Use advanced fraud detection solutions that use real-time machine learning to identify and block suspicious activities.

Integrate CAPTCHA verification on payment gateways

The CAPTCHA mechanism can deter automated bots from testing card details on your site.

Employ multiple lines of authentication

Card verification value (CVV) and address verification services (AVS) can help verify that the customer possesses the physical card. Consider using MFA or 2FA for all transactions or those that are flagged as high-risk to ensure the cardholder is authorizing the purchases. 

Data encryption

Utilize robust encryption standards for storing and transmitting customer data to protect it from unauthorized access.

Keep up with the latest compliance standards

Adhere to data protection regulations like GDPR and PCI DSS to ensure the highest standards of data security and privacy.

Monitor for exposed information

Use services that monitor the dark web for leaked or stolen data, allowing for prompt action if customer information is compromised.

Impart account security best practices on customers

Educate customers about the risks of phishing and the importance of secure password practices, including not reusing passwords across sites. Encourage shoppers to install reputable antivirus and anti-malware solutions on their devices to prevent keylogging and spyware.

Stay apprised of where you stand in relation to chargeback thresholds

Chargeback thresholds are predefined limits set by payment processors or acquiring banks that determine when a merchant may face consequences due to excessive chargebacks. These thresholds are in place to monitor and manage the level of chargebacks a merchant experiences, as high chargeback rates can have negative consequences for both the merchant and the payment processor.

Create effective password policies to protect accounts

Encourage or enforce strong, unique passwords through regular prompts and by blocking common or previously breached passwords. Implement stringent verification processes for any account change requests, especially those made via customer service channels.

Perform frequent security audits

Conduct periodic reviews of account security measures, and update them in response to new or evolving threats.

How Promo & Policy Abuse Happens

Multiple redemptions

Shoppers use technical loopholes or create multiple accounts to redeem single-use coupons multiple times.

Promo code sharing

Exclusive or personalized promo codes are shared on deal sites, leading to widespread unauthorized use.

Exploiting return policies

Buyers purchase items with the intention of using them temporarily, then return them for a full refund, a practice known as “wardrobing” or “free renting.”

Friendly fraud for refunds

Customers claim an item was never received or falsely report it as damaged or not as described to secure a refund while retaining the product.

How to Prevent Promo & Policy Abuse

Keep coupon codes secure

Implement secure, single-use coupon codes and monitor for unusual redemption patterns.

Offer personalized promotions

Tailor discounts and coupons to individual customers and require account login for redemption to prevent sharing.

Purchase limitations

Set purchase limits for high-demand or discounted items to deter bulk buying and resale.

Refund verification

Require proof of purchase and inspect returned items carefully before processing refunds. Consider offering store credit instead of cash refunds for certain cases.

Make return policies clear

Define and communicate clear return policies, including conditions for refunds, restocking fees, and time limits. Clearly communicate the terms and conditions of promotions and the consequences of abuse to foster a culture of honesty and integrity among customers.

Keep up to date with the latest trends in refund and return fraud

New forms of refund abuse are constantly popping up as fraudsters navigate loopholes to exploit. Stay ahead of their tactics and ensure your fraud prevention solution is leveraging machine learning to block bad actors from completing transactions.

How Loyalty Fraud Happens

Account takeover

Fraudsters will launch an account takeover attack to gain unauthorized access to customers’ loyalty accounts to redeem points for products, gift cards, or other rewards.

Point generation schemes

Exploiting loopholes in the loyalty program to generate points illegitimately, such as through fake purchases or referral fraud.

Synthetic account creation

Using false identities to create multiple accounts and accumulate rewards, often automating activities to meet point-earning criteria.

Reward trafficking

Selling or trading loyalty points or rewards on unauthorized third-party platforms.

How to Prevent Loyalty Fraud

Always use secure authentication methods

Implement multi-factor authentication (MFA) for accessing loyalty accounts, adding a layer of security against unauthorized access. Enforce strict verification processes for high-value redemptions or changes to account details to prevent unauthorized transactions.

Monitor transaction patterns

Use a fraud prevention solution that offers advanced analytics to identify unusual redemption patterns or point accruals that may indicate fraudulent activity.

Limit reward transferability

Restrict the ability to transfer points or rewards between accounts or limit the sale/trade of rewards on external platforms.

Regularly update program terms

Review and update loyalty program rules to close loopholes that could be exploited for fraud.

How Affiliate Fraud Happens

Fake leads or transactions

Fraudsters generate bogus leads or sales using automated scripts or stolen user information to claim undeserved commissions.

Click fraud

Click fraud artificially inflates click counts through automated bots or hired individuals to increase commission earnings without genuine customer engagement.

Cookie stuffing

Cookie stuffing secretly drops affiliate cookies on users’ computers without their knowledge, falsely claiming credit for user purchases.

Typosquatting

Typosquatting registers misspelled versions of popular domain names to redirect users through affiliate links without their explicit intent to visit the merchant’s site.

How to Prevent Affiliate Fraud

Be vigilant in vetting affiliates

Thoroughly screen and monitor affiliates before and after approval to ensure they adhere to ethical practices. Continue to monitor them during your partnership, auditing affiliate activities and verifying the legitimacy of transactions and the methods used to generate traffic.

Use advanced fraud detection tools that can protect against affiliate fraud

Employ sophisticated detection technologies that analyze patterns in real-time that are indicative of affiliate fraud, such as abnormal conversion rates or suspicious IP addresses. 

Provide clear program guidelines to affiliates

Establish and communicate clear rules and guidelines for affiliate conduct, explicitly prohibiting fraudulent practices and outlining the consequences. Define what acceptable marketing practices look like and the importance of maintaining the program’s integrity for mutual benefit.

How Reshipping Scams Happen

Recruitment

Fraudsters recruit individuals through job postings, social media, or email campaigns, offering work-at-home opportunities that involve receiving and reshipping packages.

Stolen credit information

Cybercriminals use stolen credit card details to purchase high-value items online, which are then shipped to the addresses of recruited reshippers.

Reshipping

The recruited individuals forward the packages, often to addresses abroad, effectively obscuring the trail of stolen goods.

How to Prevent a Reshipping Scam

Only sell to verified customers

Implement stringent verification processes for new accounts or high-value transactions to detect potential fraudulent activity.

Monitor shipping and transactions

Utilize advanced monitoring systems to identify suspicious patterns, such as multiple shipments to addresses linked to known fraud or unusual transaction volumes.

Launch awareness campaigns

Educate the public about the risks and indicators of being recruited as a reshipper, highlighting the legal consequences.

Collaborate with law enforcement

Work closely with postal services and law enforcement agencies to report and investigate suspicious activities.

Create secure payment processes

Strengthen payment processing systems to detect and prevent the use of stolen credit card information.

How Botnets Operate

DDoS attacks

Botnets overwhelm eCommerce websites with traffic from multiple sources, rendering the site inaccessible to legitimate users (customers and shop employees) and can cause significant downtime and revenue loss.

Credential stuffing and card testing

Botnets are used to automate login attempts using stolen username and password combinations across multiple websites to gain unauthorized access to user accounts. Similarly, bots are used to test stolen credit card information on eCommerce platforms, identifying valid card details for larger fraudulent purchases.

Phishing

Bots are also used to conduct large-scale phishing attempts or spam to steal personal information or spread malware.

Scraping

Botnets can scrape pricing, product descriptions, or other proprietary data from eCommerce sites to gain a competitive advantage or create counterfeit listings for a fake storefront.

How to Prevent Botnet Schemes

Use advanced traffic filtering tools

Deploy solutions that can distinguish between legitimate users and bot traffic, blocking malicious bots while allowing genuine customers access.

Implement CAPTCHA verification

CAPTCHAs are designed to challenge suspicious login attempts or checkout activities, making it harder for bots to proceed. 

Implement access limits

Set limits on the number of requests an IP address can make in a certain timeframe to prevent automated attacks.

Perform frequent system audits

Conduct security audits and vulnerability assessments to identify and patch potential entry points for malware.

Collaboration with ISPs and authorities

Work with internet service providers and law enforcement to report and take down botnet command and control servers.

How Triangulation Fraud Happens

The Setup

A fraudster creates a fake online store or listing, offering popular items at attractive prices to lure in consumers.

The Purchase

Unsuspecting customers buy items from the fraudulent store, paying the scammer directly.

The Fulfillment

The scammer then uses stolen credit card information to purchase the item from a legitimate retailer and ships it to the customer, completing the triangle.

The Discovery

Eventually, the true cardholder notices the unauthorized transaction and initiates a chargeback, leading to financial losses for the involved retailer and potentially the consumer.

How to Prevent Triangulation Fraud

Enhance seller verification methods

Marketplaces should implement strict seller verification processes to prevent fraudsters from setting up shop.

Let shoppers know about fake stores

Educate consumers on the risks of triangulation fraud and encourage them to report suspiciously low prices or sellers.

Monitor the web for copycat websites

Use Google Alerts or a similar tool that can flag duplicate websites or product listings so you can vet whether or not they’re authorized sellers. Take action to get fraudulent sites shut down by reporting them to authorities.

Secure and monitor transactions

Use secure, encrypted payment gateways that verify the authenticity of transactions and protect consumer data to ensure stolen credit cards aren’t being used. Implement advanced fraud detection systems that flag unusual purchasing patterns indicative of stolen card use. Employ additional verification steps for transactions that present a high risk of fraud, such as cross-referencing shipping and billing addresses.