Kevin Lee, trust and safety architect at Sift
Fancy Bear hacked the Democratic National Committee. Cozy Bear spear-phished the Pentagon. But Bargain Bear, a Russian cybergang discovered in 2020, represents a new level of ecommerce fraud and a dark omen as online shopping skyrockets.
Bargain Bear’s scam used fake ecommerce listings to test stolen credit cards. Such bogus listings falsely pose as legitimate storefronts but are often the opening salvo in a lengthy chain of fraudulent activity.
Combined with card testing—a process fraudsters use to determine the validity of stolen credit card information—the scheme demonstrates how organized, interconnected and collaborative the economy of fraud has become. As the impact of COVID-19 pushes ecommerce to record heights, gangs like Bargain Bear have a chance to scale like never before.
The fraud supply chain
Interlinking attacks make up the “fraud supply chain.” Merchants caught in this tangled web of crime suffer more than financial loss. They may see their trademarks hijacked to gain the trust of unsuspecting customers at the expense of consumer confidence. Their ecommerce sites may become a testing ground for stolen credentials—and their customers could find themselves on the receiving end of password reset notifications, hampering their experience and slowing legitimate sales. Financial woes are one thing, but other impacts of the fraud supply chain can affect brand loyalty, leaving reputations in ruins and limiting long-term growth.
Content abuse—like phishing, misinformation and fake listings—is particularly nefarious. Often, the mere perception of fraudulent content is enough to send customers to a rival merchant. In fact, 74% of Experian customers agree security is still an essential factor when engaging with an online business. Simply put, consumers do not want their personal information stolen.
Modern cybercriminals are organized, collaborative and have created a fraudulent economy that poses a constant threat to ecommerce.
The criminal boost of COVID-19
As the global pandemic forced merchants to reorient themselves, many criminals saw a drastic increase in online sales as an opening window for them. Hackers are rushing to impersonate, steal customers and kickstart a whole new level of cybercrime.
This fraud supply chain is booming. Fraudsters are creating innovative ways to weave their attacks together and take advantage of digital interactions.
Take the subscription trap. In this scheme, online criminals dangle seemingly free trials of a product or service. Victims believe the offers are risk-free yet end up with an expensive monthly subscription. Even if consumers stop the recurring charges, the fraudster has a credit card number and personal details. The damage is done.
Protecting business
Understanding the fraud supply chain is key to defending against it. Online criminals collaborate across time zones, borders and currencies. Likewise, ecommerce merchants must tune their defenses to guard against global attacks.
Breaking down silos between your security data and third-party intelligence gives you an edge. If an attack hits elsewhere, you should have systems in place to learn from it and adapt before your systems are under assault.
Retailers should not leave that protection to manual monitoring. Fraud moves too fast and too frequently for humans to keep pace. Real-time alerts and automated responses, driven by machine learning, are the answer to responding to threats in seconds to keep customers safe.
With ecommerce sales continuing to rise, highly organized cybercriminals will take advantage of every weakness to kick the fraud supply chain into overdrive. In response, smart retailers have just months to avoid their own grim tale, deploy modern defenses and keep the bears at bay.
Sift is a fraud-prevention technology supplier.