MULTINATIONAL RETAIL CORPORATION - EMC

MULTINATIONAL RETAIL CORPORATION
Underground carding market fraudsters are
foiled with RSA FraudAction Intelligence
AT-A-GLANCE
Challenge
––
Retailers face attacks from
fraudsters operating in online
forums and chat rooms
––
Infiltrating these communities to
identify threats requires expertise
and dedication
––
Effective intelligence gathering
requires knowledge of the
underground ecosystem
and an established persona
Solution
––
RSA ® FraudAction Intelligence
(FAI) service provides detailed
insight into specific threats and
into long-term trends in
cybercriminal activities
––
The retailer was able to conduct
a sting operation to intercept and
prevent a fraudulent transaction
staged in an underground forum
Results
––
The retailer has the option to use
the intelligence to immediately
respond to individual threats where
appropriate, or identify patterns in
fraud and prosecute repeat
offenders
––
The RSA FAI team has international
law enforcement connections and
can support the retailer in its work
with law enforcement to prevent
fraud
––
The retailer is in a strong position
to execute its strategy to eliminate
carder fraud from its branches and
online
“ We want to send a clear message to the cybercrime underground
that it’s not worth attempting carder fraud against our company.
We can put our confidence in the RSA FAI service to provide us
intelligence we need to mitigate fraud effectively, and to
perpetuate this message back to the fraudster community.”
OPERATIONAL LEAD, RETAILER’S ANTI-FRAUD TEAM
This multinational retail corporation has branches across the United
States as well as running a significant online shopping platform.
CHALLENGE
Retailers have long been engaged in a battle against fraudsters. It’s an ongoing challenge
as criminals take increasingly creative approaches to avoid the security measures that
retailers put in place to combat fraudulent practices. Many fraud attacks are now devised
and carried out from the murky world of online underground fraud chat rooms, which are
hard for retailers to penetrate, enabling the fraudsters to remain faceless.
An example of such activity is known as carder fraud, where someone uses compromised
card details to make an online purchase for pickup at a particular store. This individual
then uses an online forum to recruit a ‘mule’: a person to make the pickup and ship the
fraudulently purchased item to the purchaser.
In order to deal with these threats, businesses must not only infiltrate communities of
wary fraudsters, but also then identify specific threats and take appropriate action. One
retailer recognized the need for an expert team, and chose to work with the RSA FAI
service to help it track suspicious activities in the cybercrime underground, which may
impact the organization. “We wanted to use the insight from the FAI service to identify
patterns in fraudsters’ activities so that we can best prepare for and respond to them
before they resulted in losses for us,” explains the operational lead of the retailer’s
anti-fraud team.
SOLUTION
While the retailer was eager to use the information from the FAI service to deepen its
understanding of fraud patterns over time, the RSA team was also able to help it respond
to individual threats.
The FAI fraud intelligence agents each use a variety of methods to monitor and engage with
cybercriminal communities on a regular basis. As part of his daily monitoring of these sites,
an FAI agent uncovered that one of the forum members was claiming to have identified an
employee of the retailer at a particular store who would be able to act as a mule.
CUSTOMER PROFILE

“ We wanted to use the insight
from the FAI service to identify
patterns in fraudsters’
activities so that we could
proactively prepare for and
respond to threats before they
resulted in losses for us.”
OPERATIONAL LEAD, RETAILER’S
ANTI-FRAUD TEAM
CONTACT US
To learn more about how RSA
products, services, and solutions help
solve your business and IT challenges
contact your local representative or
authorized reseller – or visit us at
www.emc.com/rsa.
The agent contacted the community member, posing as someone requesting to make a
fraudulent purchase and use the pickup service. Using small talk to build an element of trust
with the cybercriminal, the RSA agent got the name and store details of the fraudster’s
employee contact. “We use many techniques to get information from our contacts in the
forums. In this case I was able to get a few personal details about the fraudster as well,”
explains the RSA agent. “For example, the way he used the English language made me think
he wasn’t American, so one day when he commented that he’d been unable to reach me for a
few hours, I told him it was because I’d had to spend the day at the DMV (Department of
Motor Vehicles). Any American would have known what that meant, but he asked what it was.
I explained and asked what he called it in his country and he said the DVLA. I quickly Googled
the acronym and learned that he was in the UK, which he then unsuspectingly confirmed.”
The agent provided the employee details to the retailer to confirm accuracy. The retailer
confirmed the employee did indeed work at the store indicated by the fraudster, and
decided to set up a sting operation to intercept the employee and prevent the fraud from
taking place. The retailer started the sting operation by providing the RSA agent with a
screen shot of a fake purchase confirmation, which the fraudster needed to pass on
(through another middle-man) to the employee so that the pickup could take place.
When the employee tried to pick up the items, the store’s security team was waiting for
her and confronted her about the fraudulent purchase. “She had no idea she was
participating in a fraudulent activity, and had believed that she was picking up a
legitimate purchase for a friend that she had met on the Internet – the cybercriminal’s
additional middle-man,” explains the retailer’s anti-fraud team operational lead. “We were
able to check her history to see if she regularly made such pickups. When it became clear
that she was being honest and had been deceived into making the pickup, we felt
comfortable that she would not do it again, and so were happy to enable her to keep her
job. Of course, if further investigation showed that an employee was regularly supporting
fraud, or if they did so again after receiving a warning like this, we would terminate their
employment and carry out any necessary steps to prosecute or involve law enforcement.”
“This fraud attempt was typical in that it involved a complex chain of connections that
enabled the real criminals to hide online,” says the RSA FAI agent. “However, in this case
we were able to collaborate with the retailer to proactively stop the fraud and protect an
innocent employee who was unknowingly recruited as a mule.”
RESULTS
The retailer appreciates the fact that it was able to make use of the insight provided by
RSA’s FAI agents in two ways. First, “In cases like the sting operation, where we have
verified details of the pickup ‘mule’ and we have in-store security to deal with it, we can
take action to prevent individual fraud attacks,” says the anti-fraud team operational lead.
Second, “However, it would be inefficient to follow up every individual threat, so we also
use the data to track historic patterns and predict future trends. We have been working
with the RSA FAI team for about a year now, and have a comprehensive database of
intelligence to refer to, not only for our own anti-fraud operations but to respond to
requests for support from law enforcement as well.”
The intelligence that the retailer now has about carder fraud practices against it will play
an important role in its mission to attack this type of fraud across its thousands of stores.
“We want to displace this sort of fraud from our stores,” concludes the anti-fraud team
operational lead. “We want to send a clear message to the cybercriminal underground
that it’s not worth attempting this sort of fraud against our company. We can put our
confidence in the RSA FAI service to give us the intelligence we need to fight the fraud
effectively, and to perpetuate this message back to the fraudster community.”
www.emc.com/rsa
©2013 EMC Corporation. All rights reserved. EMC, RSA, RSA Security, the RSA logo and FraudAction are the property
of EMC Corporation in the United States and/or other countries. All other trademarks referenced are the property of
their respective owners. H12440 RETFAI CP 1013