Fraud, Internet

views updated

FRAUD, INTERNET

According to the U.S. National Consumers League, Internet-related fraud cost individuals and businesses $3.2 billion at the turn of the 21st century. The U.S. Federal Trade Commission (FTC) identified 18,660 instances of potential Internet fraud in 1999, with fully 25 percent of all consumer fraud complaints concerning the Internet, up from three percent in 1997. The Securities and Exchange Commission (SEC) received about 2,000 e-mails each day concerning possible online scams.

In many ways, the Internet seems tailor-made for engaging in fraudulent activity. A single individual can perpetrate elaborate, low-cost schemes while enjoying anonymity and a platform from which to reach potential victims all over the world. Among the crimes the Internet facilitates are identity theft and the generation of false, but valid, credit card numbers. Cyberspace also provides a new home for more traditional forms of fraud that can be more easily, and often more damagingly, committed online than in the physical world.

The true impact of Internet fraud is difficult to measure. Gartner Group reported that a survey of 166 retailers revealed an online credit card fraud rate that was 18 times higher than overall credit card fraud, while the U.S. Secret Service states that online and offline fraud rates are roughly the same. Part of this variation is caused by reluctance on the part of consumers and merchants to report fraud. Since there are no national reporting standards for credit card fraud, and claimed losses due to alleged fraud often are tal-lied in with all disputed claims, accurate measures are difficult to come by.

VARIETIES OF ONLINE FRAUD

Internet scams come in a wide range of guises. The most common online fraud concerns the compromise of shoppers' personal financial information when it is released to complete a sale on the Internet. Even well known retailers seem prone to security breaches and hacking. A variety of sensitive personal information is revealed in such transactions, including a person's name, address, e-mail account, phone and social security numbers, passwords, and credit card data.

Online auction sites present prime breeding grounds for online fraud. The FTC reported that Internet fraud complaints rose from a mere 100 in 1997 to about 11,000 in 2000. The most common auction-related problem was that buyers failed to receive the items that they had paid for. The courts generally have refused to hold auction sites liable for any fraudulent activities perpetrated by sellers who use their sites. Potential customers are left to investigate the reliability of vendors through independent avenues. Some sites will post the names of fraudulent buyers who have been caught in scams designed to artificially inflate the highest price bid or in other ways fix the outcome of a sale. Auction site eBay draws roughly 16 million users each month. Nearly 87 percent of all online fraud cases in 2000 were believed to involve online auctions, with an average victim losing $600 per order. In addition to auctions, stock scams also are popular, especially the so-called "pump and dump" schemes in which con artists posing as investment experts fraudulently promote stocks via the Internet and then quickly sell their shares of those stocks in order to realize large profits.

Fraud perpetrators frequently utilize computer viruses, such as Trojan horse programs that arrive as e-mail attachments or JPEG images that, once opened, can steal passwords or grant hackers access to a user's PC. Dialer programs—applications that can terminate an ISP and dial another telephone number—also are involved. They often are presented as porn site downloads. Another online scam involves dot-coms whose sites closely mimic those of respected online companies. Web con artists use such sites to collect credit card information from inattentive online shoppers.

Identity theft constitutes a particular subset of online fraud. Hackers break into poorly protected servers, set up clone sites that resemble legitimate sites, and then use them to gather personal information. With merely a name, thieves can access Web directories or dossier services to acquire addresses and phone numbers.

Though most notorious online scams were perpetrated by teenagers in highly publicized cases of stock fraud, authorities actually are far more concerned about the international online fraud rings that have cropped up. The Gartner Group predicted that the most vigorous growth in online fraud in the early 2000s would involve petty larcenies committed by individuals operating from economically depressed countries, particularly Russia. The FBI indicates that stolen credit card data frequently is sold to Eastern European organized crime operations.

Among recent innovations in cyber fraud is domain name extortion, in which individuals receive faxes from phony domain name monitoring firms indicating that a third party is trying to register a dot-net version of a dot-com domain name that the individual owns. Then the firm offers to register the dot-net name for that individual, upon payment of a fee for the service. The U.S. Securities & Exchange Commission also launched an investigation of online frauds that attempt to sell investments in nonexistent nations, including New Utopia, the Kingdom of EnenKio, and the Dominion of Melchizedek.

Wireless subscription fraud also is emerging, since Internet security systems can't easily be transferred to a wireless environment. Merchants involved in fraudulent transactions conducted over the wireless Net that are completed with stolen credit card numbers are liable for the cost of the item, while wireless carriers are exempt from responsibility. In a wired environment, security is maintained by SSL protocol, digital certificates, and user name/password verification; in wireless environments, SSL is translated to wireless transparent LAIN service. This translation permits information transferred from a wireless device to become decrypted, at which point credit card numbers and passwords can be stolen.

At the end of 2000, consumer protection agencies identified a "top 10" list of "dot-cons" as part of a multi-national effort to combat Internet fraud. The list was compiled from complaints lodged at Consumer Sentinel, a consumer fraud database. The list included, in decreasing order of prevalence: Internet auction fraud; Internet access services that lure consumers into unknowingly entering long-term access contracts; credit card fraud; offers of free access to porn sites when a viewer or dialer is downloaded; "Web cramming," or offers of a free 30-day trial use of a custom-designed Web site, which is later invoiced even if the recipient does not agree to continue use of the site; and finally, traditional "real world" scams transported to the Internet, such as pyramid schemes, vacation frauds, get-rich-quick offers, and miracle healthcare products.

PROTECTION AGAINST E-FRAUD

Most industry-standard encryption technologies only protect customer data during its actual transmission. An equally vulnerable point—the Web site's storage of personal data after the transaction occurs—often remains unprotected. Many hackers break into the servers that store customer data collected from past e-commerce transactions. Third-party sites that process credit card information also may furnish weak links. Thus, most online merchants rely on secure sockets layer (SSL) encryption technology to protect e-commerce data while in transit. However, it does nothing to safeguard information before or after it arrives on the server. Ideally, sites should possess a complex combination of firewalls, digital certificates, intrusion detection, access control, passwords, anti-virus software, and even biometrics systems to verify customers' identities. Retailers also can require the three-digit card verification value (CVV or CVV2), which is printed above the signature on the back of credit cards, to prevent unauthorized use of credit card numbers that have been obtained over the Web. Finally, transaction-risk scoring software exists that can spot deviations from customers' usual shopping patterns. One of the latest developments was a smart card payment option, which became popular in Europe.

Federal legislation concerning online fraud includes the Computer Fraud and Abuse Act of 1986, which authorizes both criminal remedies and civil remedies for such offenses. The Electronic Signatures in Global and National Commerce Act ("E-Signature Act") of October 1, 2000 guaranteed that electronic signatures on legal agreements or commercial transactions enjoy the same legal status and protection as written signatures.

The Federal Trade Commission and the Internet Fraud Complaint Center (a joint initiative of the FBI and the National White Collar Crime Center) host Web sites where victims of online schemes can post complaints. In May 2000, the FBI teamed up with the National White Collar Crime Center to create the Internet Fraud Center, whose 161 full-time employees will conduct preliminary investigative work into complaints and then forward their findings to field agents. The FTC manages the world's biggest database on Internet fraud, though it cannot lodge criminal charges in cases.

Some electronic payment processors were developing special digital certificate codes that identify consumers as rightful credit-card holders. Also in the works were virtual, single-use credit cards. Ultimately, many firms hope that biometric identification systems, which read unique voice or retinal patterns, will provide higher e-commerce security.

The federal Fair Credit Billing Act limits consumer liability for all incidents of credit card fraud to only $50 of any unauthorized charges. Thus, online merchants often stand to lose the most from online fraud. Beyond the expenses of charge-backs and bank fees (which are higher than those paid by their traditional retail counterparts), companies that gain reputations as vulnerable to online fraud often lose customer confidence and business. The CSI/FBI Computer Crime and Security Survey for 2000 indicated that 44 percent of all companies interviewed revealed that they failed to report incidents, while 20 percent notified their legal counsel, and only 25 percent went to law enforcement agencies. More than half stated that they wanted to avoid negative publicity or would prefer to handle the situation themselves.

THE EXTENT OF E-FRAUD

A survey of 140 members of the Worldwide eCommerce Fraud Prevention Network indicated that many international firms consider online fraud is a serious but manageable problem. However, despite their assertion, only 10 percent of those firms surveyed spent more than three percent of their total revenue on fraud protection, while 60 percent spent less than one percent. Of the varieties of online fraud, one-third found the difficulty in prosecuting Web-based fraud to pose the greatest threat to their online businesses.

The Internet Fraud Complaint Center received more than 20,000 complaints during its first six months of operation, according to the FBI and the National White Collar Crime Center. Computer users made more than 37.5 million visits to the Web site. Auction fraud was the most reported Internet fraud, comprising 64.1 percent of all referred complaints. Several of the complaints involved monetary losses of $100,000 or more, including one involving more than $366,000. Internet-related fraud complaints to the Federal Trade Commission were up from 8,000 in 1998 to 23,000 in 2000 (not including identity theft).