Fraudsters revive old tactics mixed with modern technology

Threat actors continue to probe the payments ecosystem for vulnerabilities and were successful in conducting fraud schemes affecting multiple financial institutions, technologies, and processes, according to Visa.

The resurgence of physical theft

Scammers are going back to basics with an increase of physical theft over the past six months, capitalizing on the window between the theft and the victim’s awareness. After a theft, the most common ways the criminals are capitalizing on their theft by purchasing gift cards or physical goods to resell, or even using the card number online for money transfers.

Similarly, in March of 2023, Visa identified an emerging threat dubbed “digital pickpocketing,” where cybercriminals use a mobile point-of-sale device to tap against unsuspecting consumers’ wallets and initiate a payment, often in crowded areas.

Consumers are falling victim to scams where fraudsters pose as representatives from the government, including agencies like the USPS, the FBI and the IRS. In the first three months of 2024, the average government impersonation scam victim in the US lost $14,000 in cash, totaling more than $20 million.

Additionally, between 2022 and 2023, there was 90% increase in losses from cash payments due to government impersonation scams. As government impersonation scams move towards cash, Visa predicts that banks will see an increase in large cash withdrawals by customers at ATMs.

Looking for a way to get around two-factor authentication, fraudsters are doubling down on one-time-password phishing scams, which allow criminals access to full account funds and information via increasingly convincing texts, emails or phone calls. These scams have grown more convincing in part due to the prevalence of GenAI.

Threat actors utilize widely available tools and technology

Threat actors continue to innovate in their use of technology to perpetrate fraud. With the expansion, evolution, and availability of GenAI tools, and the associated increase in underground forum discussions of how to use AI tools to facilitate crime, threat actors have an ever-increasing array of tools and technologies at their disposal.

The threat actor toolbox has evolved to include an expanding collection of cybercrime-as-a-service offerings, such as proxy networks, ransomware-as-a-service variants, and fraud tutorials, enabling them to scale their campaigns more effectively.

It takes only three seconds of audio to clone a voice using AI voice cloning technology, which can be obtained by threat actors from victim’s videos on social media or voicemailbox message. The use of cloned voices enhances imposter scams by creating a façade of legitimacy as victims believe they are speaking to the actual person, rather than an AI-generated voice or video.

While many of the scams highlighted in the report target consumers, the research contains key takeaways for financial institutions and merchants as well.

Gas station fraud: After a successful small authorization, fraudsters are making large fuel purchases at gas stations using accounts that do not have enough money to cover the total. In the past six months, activity has significantly shifted from targeting issuers in the US, Latin America and Caribbean to issuers in Central Europe, Middle East and Africa, showing how these scams spread globally.

Enumeration: Merchants continue to be targeted by cybercriminals who test payment data with scale and speed, leading them to access consumer account information. Enumeration, or automatic testing of common payment data to guess account numbers, remains a top threat to the payment ecosystem, with significant fraud occurring in the year after a successful enumeration attack. Industries most impacted over the past year include restaurants, government services, and charitable and social service organizations.

Token provisioning fraud: Tokenization remains one of the safest ways to pay, but as the technology gains momentum, scammers have taken to obtaining tokens illegitimately—and cashing out under the radar of financial institutions. Recently, Visa has noted a marked delay in when cybercriminals choose to cashout compromised accounts, hoping to evade detection after initial provisioning fraud.

Ransomware: More sophisticated ransomware attacks are affecting more companies and individuals. Although there was an overall decrease of 12.3% in attempted ransomware attacks seen during the period of this report, there was a 24% increase in targeting of third-party providers like cloud or web hosting services, creating the opportunity for more fraud per attack. Just one attack to a third-party provider affected an estimated 2,620 organizations along with 77.2 million individuals, making these third-party providers a prime target for criminals.

With this increase in sophistication, threat groups are aiming at cardholders directly, using advanced social engineering techniques and AI technology to make scams even more believable for victims and to circumvent financial network security and fraud prevention protocols.

“As payments become safer, fraudsters are reverting to tried-and-true tactics that target the weakest link in the ecosystem: consumers,” said Paul Fabara, Chief Risk and Client Services Officer at Visa.