Card fraud is a rare kind of threat in that it doesn't solely occur online but offline as well. Unfortunately, many small businesses are not sufficiently protected from the dire consequences of payment card fraud.
\r\nIn 2018, losses due to payment card fraud reached $24.26 billion worldwide. Experts project that losses will balloon to $36.44 billion by 2022.
\r\nAs much as small business owners would like to think their size does not make them a target for thieves, that simply isn't the case. Small businesses reported losing an average of $37,258 to card fraud last year.
\r\nWhether you run an online business or a brick-and-mortar operation, there are certain types of card fraud you need to be aware of. In this article, I discuss the threats small business owners face and offer recommendations so you (and your customers) do not fall victim to card fraud.
\r\nObtaining payment card credentials requires physical access to the victim's point-of-sale (POS) equipment – the terminals that store personnel use to read data off cards and process transactions. There are two possible scenarios where in-store payment card fraud occurs:
\r\nRegardless of the manner used, a consumer's payment card data end up in criminals' hands.
\r\nA particularly insidious type of fraud doesn't involve physically altering a store's POS system; instead, cyberthieves work hard to create different variations of malware that steal user data stored on payment cards from retail checkout systems.
\r\nPOS malware hunts for credit card data that includes the owner's full name, billing address, expiration date, and card verification value (CVV) numbers. This information very briefly becomes available in unencrypted format in a device's memory, and POS malware gathers it instantly once the unencrypted data is detected. The stolen data is then sent to the attacker's computer or server.
\r\nMore advanced payment card fraudsters, however, infiltrate databases where the information is stored. These cases fall under the broad category of data breaches that involve the theft of personally identifiable information, or PII, in bulk.
\r\nThere's a reason why most payment card fraudsters resort to online forms of fraud. Online fraud presents fewer risks than engaging in physical theft. Online criminals can easily cover their tracks as opposed to being caught red-handed with a skimming device in an actual store.
\r\nMost fraudsters collect credit card data to collate so-called \"fullz\" dumps, cybercriminal slang for \"full credit card data\" repositories, that they then peddle in underground markets or the deep web. Some create and sell actual cards or credit card clones coded with stolen data. Still, other cyberthieves use the stolen data to make card-not-present purchases for personal gain.
\r\nOver the years, various high-profile retail, hotel and restaurant chains have suffered significant losses due to POS malware infections. Here are some that you may know about, or that may have personally affected you.
\r\nAfter a spate of POS malware attacks, banks and financial service providers migrated to Europay, Mastercard and Visa (EMV) chip and pin technology. They hoped the stricter requirements for using EMV chip and PIN cards would alleviate the problem. Years after their introduction, however, there are still attacks against establishment chains and small businesses alike.
\r\nThe newest malicious form of POS malware on the block is DMSniff. Though believed to have been active since 2016, it made waves this year, thanks to its use of domain generation algorithms. Because the malware can change domains upon detection, it stays under the radar while spreading mayhem.
\r\nTo date, 11 variations of DMSniff have been found. These are believed to gain access to POS systems using a combination of brute-force and exploit attacks. In a brute-force attack, threat actors subject systems to innumerable username and password combinations until the right ones are found and compromise is achieved. In exploit-enabled attacks, the threat actors scan victims' networks for vulnerabilities. Once holes are found, the right exploit is dropped, and the network is breached.
\r\nDMSniff is just one form of POS malware that is still actively wreaking havoc against many establishments today. Businesses, especially small businesses, need to monitor their systems for fraud.
\r\nWhether fraud occurs digitally or in-store, the damage caused to small businesses and their customers can be irreparable.
\r\nCompanies, therefore, need to prevent payment card fraud. Here are six steps small business owners can take to reduce their risk of credit card fraud:
\r\n