Is the FCC Investigating Your Platform?

By: Tim Prugar

If your business model is similar to Dialing Services, LLC...they very well might be. 

Late last week, the FCC adopted a "Forfeiture Order" against Dialing Services, imposing fines totaling $2.9 million, citing their practice of placing pre-recorded calls to mobile phones without prior opt-in consent. The FCC asserts that Dialing Services placed more than 4.7 million calls over a 3 month period, ignoring multiple FCC warnings and a citation in the process. The FCC found that not only did Dialing Services offer a spoofing functionality for their clients, but they also participated in the creation of the content. 

So why is this decision significant?

1. Dialing Services is a Platform

This decision has enormous significance because it's not simply going after Dialing Service's clients - it's going after the platform itself. This may signify a sea change in legal thinking, identifying platforms that offer robodialing services as equality culpable for TCPA violations as firms that execute the calls. This is a big, big deal. 

2. Potential Crackdown on "Neighbor Spoofing"

The use of spoofing isn't limited to account takeover or prank calls. The practice of "Neighbor Spoofing" - spoofing the area code of the person you're calling in order to increase the likelihood they answer - has been picking up steam in the sales world over the last 5-7 years. The FCC citing this practice explicitly in their Order may indicate a dedication to cracking down on this type of spoofing. It would certainly be in keeping with the current FCC's clear vow to reduce Robocalls. 

 

Tim Prugar is the Director of Customer Success at Next Caller. He can be reached at tim@nextcaller.com

What You Can Expect After the Verizon Breach

By: Tim Prugar

Yesterday, ZDNet broke the story that a data breach at Verizon resulted in the exposure of the names, phone numbers, and PINs for over 14 million Verizon customers. The data was accessed in June after it was discovered to be improperly stored on a server maintained by Nice Systems, an Israel-based company. 

The scope of the damage has yet to be established, but here are some safe bets on what you will see in the wake of this breach:

Explosion of Call Center Fraud at Verizon

Obtaining customer names, phone numbers, and PINs is pretty much the Holy Grail for fraudsters. Having this information allows fraudsters to order new handsets, obtain additional personal information for a secondary attack, set up call forwarding, or engage in number porting. Attacks using this information will almost always center around spoofing, and will most likely look something like this:

1) Fraudster researches the individual who owns the account they wish to breach online or through social media to figure out the answers to Knowledge-Based Authentication Questions.

2) Fraudster spoofs the number of the account they're attacking in order to present a matching ANI to the IVR system or the live agent.

3) Fraudster gives the name they've obtained from the breach to the agent when they reach a live person.

4) Fraudster gives the PIN they obtained through the breach. If there are any Knowledge-Based Authentication questions, Fraudster answers them easily based on their prior research. They're in. The Account Takeover is complete. 

 

Exploitation of Two-Factor Authentication (2FA)

Fraudsters will attack the Verizon Call Center directly - but for most fraudsters this will be the first step in a two-step plan. 

Many banks leverage 2FA to ensure the security of the accounts. 2FA largely relies on mobile devices, leveraging callbacks or SMS messaging to ensure the security of the customer. 

As Fraudsters set up call forwarding or port numbers during their primary attack on the Verizon Call Center, they will have the ability to intercept this 2FA from financial institutions. By successfully navigating this authentication process, fraudsters can attempt to execute wire transfers, open lines of credit, order replacement credit cards, or any amount of nefarious behavior. Expect fraudsters to leverage spoofing once again to present as the compromised customer to the financial institution to execute this plan. 

 

Increased Attacks on ISPs

We predicted in this post that ISPs would encounter "Hacktivism" and retaliatory breaches in the wake of the Net Neutrality debate. There isn't evidence yet that this breach is a direct result of internet unrest, but ISPs would be wise to batten down the hatches on their cyber and telephony channels. 

 

Tim Prugar is the Director of Customer Success at Next Caller. He can be reached at tim@nextcaller.com.

 

 

Merchants Stand To Lose HOW MUCH to CNP Fraud?

 

By: Tim Prugar

           Regular readers of this blog should be no stranger to Next Caller’s stance that the EMV migration has had a significant impact on Card-not-Present (CNP) Fraud in the retail and financial services spaces. The call center channel and eCommerce are the most vulnerable due to the volume of transactions and vulnerability to social engineering. We always knew that the threat was a potentially catastrophic one, but the amount of money at stake may be even greater than anyone realized.

            A recent report by Javelin estimates that $71 billion will be lost to CNP Fraud over the course of the next five years. With those staggering numbers in play, it’s even more alarming that so many merchants still insist that the costs of combatting fraud are too high to justify. This is false: the majority of real-time fraud solutions are less expensive and less labor intensive than salaried Analysts who perform manual reviews of instances after the fact. Javelin also indicates that in the eCommerce space, address fraud in the form of freight forwarding and Synthetic ID fraud are of particular threat to the industry.

            So, in the face of this oncoming tsunami of fraud, what is a merchant or financial institution to do?

 

Prioritize Real-Time

The reason for the growth in CNP Fraud is twofold: one, the difficulty of traditional Card-Present Fraud post EMV migration, and two, the enormous volume of transactions fraudsters can pump through CNP channels. Merchants and Financial Institutions simply do not have the time and resources to hand-review the massive amount of fraud that is coming and will continue to come their way. Visionary organizations will prioritize real-time, first-stage fraud detection systems over second-stage review solutions.

 

Leverage Geographic Intelligence

Businesses know where their fraud is taking place. Why not view those regions with a greater degree of skepticism? Setting up business rules to trigger automated, real-time reviews of orders going to suspicious locations is a must for dynamic fraud teams. According to Javelin, Fraud chargeback rates in Brazil jumped from .5% of all transactions to 3.5% - with a jump from 1.25% to 2.75% reported during the same period in Mexico. Wouldn’t it make sense to pay a touch more attention to orders going to those locales?

 

Verify Everything

With Synthetic ID fraud on the rise, it serves as the perfect compliment to CNP Fraud. It’s not enough anymore to verify that a phone number and/or a postal address are valid. Fraudsters are providing valid information in invalid combinations to circumvent detection systems. Fraud teams, particularly in eCommerce, should not only be validating each order line, but should be verifying that the information has been seen together before – an offering that Next Caller provides.  

 

Tim Prugar is the Director of Customer Success at Next Caller. He can be reached at tim@nextcaller.com.