With some unwanted recent findings regarding fraud, as well as major breaches in cybersecurity, a stronger strategy towards security is needed now more than ever. John Marsden, head of ID and fraud at Equifax, gives an overview of the problem and offers critical advice for individuals and businesses

Recent ONS crime figures show bank­ing and credit fraud is up 13% in the year ending June 2016.

Companies have stepped up their fraud protection with multiple layered fraud defences, but this often moves criminal activ­ity to channels that are less well protected.

Fraud is a surprisingly professional indus­try. The number of cases continues to rise as criminals find new ways to access informa­tion, often fuelled by a deep understanding of their target’s identity. Underlying this is the sharing of knowledge and consumers’ personal information across dark web mar­ketplaces.

Consumers must take steps to protect themselves from falling prey to fraudulent behaviour. People are without doubt con­fused about where to store and share confi­dential information like their bank account number, sort code and even date of birth.

As consumers seek the convenience and speed offered by digital correspondence, they expose themselves to fraudsters who will steal this information to gain access to accounts and financially exploit individuals.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

View profiles in store

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData

Submit

UK USA Afghanistan Åland Islands Albania Algeria American Samoa Andorra Angola Anguilla Antarctica Antigua and Barbuda Argentina Armenia Aruba Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia Bonaire, Sint Eustatius and Saba Bosnia and Herzegovina Botswana Bouvet Island Brazil British Indian Ocean Territory Brunei Darussalam Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cape Verde Cayman Islands Central African Republic Chad Chile China Christmas Island Cocos Islands Colombia Comoros Congo Democratic Republic of the Congo Cook Islands Costa Rica Côte d"Ivoire Croatia Cuba Curaçao Cyprus Czech Republic Denmark Djibouti Dominica Dominican Republic Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Ethiopia Falkland Islands Faroe Islands Fiji Finland France French Guiana French Polynesia French Southern Territories Gabon Gambia Georgia Germany Ghana Gibraltar Greece Greenland Grenada Guadeloupe Guam Guatemala Guernsey Guinea Guinea-Bissau Guyana Haiti Heard Island and McDonald Islands Holy See Honduras Hong Kong Hungary Iceland India Indonesia Iran Iraq Ireland Isle of Man Israel Italy Jamaica Japan Jersey Jordan Kazakhstan Kenya Kiribati North Korea South Korea Kuwait Kyrgyzstan Lao Latvia Lebanon Lesotho Liberia Libyan Arab Jamahiriya Liechtenstein Lithuania Luxembourg Macao Macedonia, The Former Yugoslav Republic of Madagascar Malawi Malaysia Maldives Mali Malta Marshall Islands Martinique Mauritania Mauritius Mayotte Mexico Micronesia Moldova Monaco Mongolia Montenegro Montserrat Morocco Mozambique Myanmar Namibia Nauru Nepal Netherlands New Caledonia New Zealand Nicaragua Niger Nigeria Niue Norfolk Island Northern Mariana Islands Norway Oman Pakistan Palau Palestinian Territory Panama Papua New Guinea Paraguay Peru Philippines Pitcairn Poland Portugal Puerto Rico Qatar Réunion Romania Russian Federation Rwanda Saint Helena, Ascension and Tristan da Cunha Saint Kitts and Nevis Saint Lucia Saint Pierre and Miquelon Saint Vincent and The Grenadines Samoa San Marino Sao Tome and Principe Saudi Arabia Senegal Serbia Seychelles Sierra Leone Singapore Slovakia Slovenia Solomon Islands Somalia South Africa South Georgia and The South Sandwich Islands Spain Sri Lanka Sudan Suriname Svalbard and Jan Mayen Swaziland Sweden Switzerland Syrian Arab Republic Taiwan Tajikistan Tanzania Thailand Timor-Leste Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Caicos Islands Tuvalu Uganda Ukraine United Arab Emirates US Minor Outlying Islands Uruguay Uzbekistan Vanuatu Venezuela Vietnam British Virgin Islands US Virgin Islands Wallis and Futuna Western Sahara Yemen Zambia Zimbabwe Kosovo

Industry * Academia & Education Aerospace, Defense & Security Agriculture Asset Management Automotive Banking & Payments Chemicals Construction Consumer Foodservice Government, trade bodies and NGOs Health & Fitness Hospitals & Healthcare HR, Staffing & Recruitment Insurance Investment Banking Legal Services Management Consulting Marketing & Advertising Media & Publishing Medical Devices Mining Oil & Gas Packaging Pharmaceuticals Power & Utilities Private Equity Real Estate Retail Sport Technology Telecom Transportation & Logistics Travel, Tourism & Hospitality Venture Capital

Tick here to opt out of curated industry news, reports, and event updates from Electronic Payments International.

Submit and download

Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

Data shared on the dark web cannot be treated as a one-time event; the data never truly vanishes and can spread glob­ally in a short amount of time, enabling criminals to fraudulently takeover accounts and identities.

To reduce the risks and damage associated with fraudulent activity, more needs to be done to educate the public and give them a stronger chance of protecting themselves.

The advice is very clear: remain vigilant, only share your details when you are sure the channel is secure, and keep the follow­ing guidelines in mind when handling your personal information:

1. Do not do your online banking in public places, and definitely do not use public Wi-Fi – criminals can set up bogus pub­lic Wi-Fi hotspots to access devices and information.
2. Never respond to unprompted banking messages unless you are absolutely certain the request is genuine, for example you have spoken with your bank to confirm.
3. Be very aware of domain names online and the security signs visible in a brows­er. Make sure you log on to a banking website at a web address you know, not via a link.
4. Never provide any banking details to a third party you do not know or are unsure about – in part or as a whole.
5. Avoid unnecessarily sharing details such as your name, address and date of birth.

Fraud losses rise

The latest FFA UK report reveals a 25% year-on-year increase in financial fraud losses for the first half of 2016 to £399.5m.

Cyber and ID fraud dominate the fraud landscape, and online scams and attacks con­tinue to rise. E-commerce is growing, and is a tempting prospect for fraudsters looking to use identity and payment data such as credit and debit card information they have gained via the vast ‘carders’ markets’.

Fraudsters are sophisticated, and can easily gather information which can then be used to open accounts and make purchases online fraudulently. This situation is exacerbated by an increasing frequency of data breaches by hackers who can then sell this data on to other criminals.

In addition, a frightening number of con­sumers are also still being tricked into hand­ing over personal data. This usually occurs when a criminal is able to convince an indi­vidual that they are emailing or calling from a legitimate organisation and they need to verify their personal details. Using this infor­mation, criminal fraud networks can create high-quality ID data to sell via the dark web.

The financial services industry has to work together, educating consumers and sharing information to help collectively tackle this criminal activity.

The focus must be twofold. It is vital that any organisation holding personal data con­tinuously evolves the systems and processes in place to keep that information safe.

Equally, any business handling financial transactions has to take every possible step to ensure the customer they are dealing with is genuine.

It is clear that passwords alone are no longer enough, fraudsters are wise to our thinking when we create a password, mak­ing them all too easy to crack. This is why businesses need to invest in new technology like biometrics and device recognition creat­ing multiple layers of defence.

The criminals do not stand still, and busi­nesses of all sizes need to work hard to stay ahead.

Stolen passwords and usernames

Around 500m Yahoo passwords and user­names have been stolen since 2014.

Passwords are continuing to topple like dominos, and the rate of major breaches is increasing at an alarming rate. The Yahoo breach is a super-sized domino that is going to have huge effects on people for years to come.

This is a game changer in the online fraud world; aside from Gmail being cracked, there is no other single event that could happen that will cause more fraud and damage over the next five years.

The breach has been a major blow to Yahoo, with personal details of around 0.5bn users now up for sale on the dark web. This information will spread quickly and globally, with no chance of recovery. There will be a long-lasting impact for consumers and busi­nesses as hackers attempt to use the breached data to access other online accounts.

We urge businesses to be on high alert for any customer contacting them from a Yahoo email address, as there is a high chance that their details have been comprised. One par­ticular area to watch are requests to reset passwords; sending a ‘click here to reset pass­word’ link to a Yahoo address is not advis­able given the size of the breach.

Passwords are no longer effective as a standalone measure, and companies must act sooner rather than later to improve their online security.

The normal advice of complex password, numbers and numerals no longer works in a world where there are now billions of cracked passwords; companies should instead introduce a second layer of authenti­cation processing, such as device recognition, to help build the necessary barriers to keep data safe.