Latin America. Akamai Technologies Latin America reports that identity theft has experienced a significant increase in Latin America, becoming an alarming situation that is affecting individuals and companies throughout the region.
By impersonating the rightful account owners, cybercriminals can gain unauthorized access to users' accounts and use those privileges to perform a host of fraudulent activities. Reports such as IBM's X-Force Threat Intelligence Index 2024 highlight an emerging global identity crisis as cybercriminals are exploiting user identities to compromise businesses around the world. In fact, there was a 71% increase in cyberattacks caused by identity exploitation globally. On the other hand, in 2023 cybercriminals saw more opportunities to 'log in' through valid accounts instead of 'hacking' corporate networks, making this tactic a weapon of choice for cybercriminals in Latin America.
Likewise, LexisNexis Risk Solutions' The True Cost of Fraud highlights that, in LATAM, digital channels account for 51% of overall fraud losses. In addition, 38% of fraud can be attributed to new and emerging payment methods such as digital/mobile payments, crypto, etc.
"Criminals are using increasingly sophisticated methods, from falsifying documents to manipulating fingerprints. Some of the red flags of identity theft are: unrecognized credit card charges, invoices from unknown companies, confirmation emails of unsolicited purchases, notifications of approval or rejection of unsolicited credit cards, rejection of a credit or loan despite having a clean credit history, among others," reported Helder Ferrão, director of industry strategy for Akamai Technologies Latin America.
The executive highlighted five methods that cybercriminals are employing to steal an account:
- Stolen credentials. Data breaches often result in the leakage or theft of thousands or millions of usernames and passwords, which hackers can use to gain access to accounts through credential stuffing attacks or trade this data on the dark web to organized groups of cybercriminals.
- Brute force attacks. Attackers try to access accounts with random combinations of usernames and passwords, and they use a botnet to make thousands of login attempts every hour.
- Phishing attacks. Phishing campaigns trick users into sharing their login credentials through fake websites, chats, emails, SMS, and other channels.
- Middle-of-the-middle machine attacks. In this common attack vector, cybercriminals place themselves between the user and unencrypted traffic so they can intercept and alter sensitive data traveling between them.
- Malware attacks. Attackers can use malware such as keyloggers to expose personal data, including user credentials.
"The damages from account takeover scams can go far beyond the theft of money or data. In individuals, the effect it causes in them is stress, anxiety, emotional problems, etc. However, companies and organizations also suffer from this type of attack as they can lose customers and possible future revenue, and the company's brand and reputation can suffer the loss of trust of those customers who have experienced account theft," said Helder Ferrão.
All of these problems, if perceived by the market, can result in a loss of value for a publicly traded organization.
Advanced protection against sophisticated account abuse
Fortunately, criminals also make mistakes, and there are ways to stop them before they try to harm customers and businesses. Helder Ferrão mentioned that, in the current threat context, it is no longer enough to run a single security check when logging in or making a transaction. To stop
To effectively protect malicious activity and abuse, you need to analyze risk in real-time and constantly monitor accounts, every time. Only in this way can the signs of suspicious behavior be detected on the fly.
He recommended that companies implement techniques to understand the behavior of legitimate account owners, and then assess the risk of each authentication request by looking for deviations from the behavioral profile and common devices, as well as other forms of advanced detection. He also highlighted that there are security solutions with capabilities that offer advanced protection against sophisticated account abuse by monitoring user behavior in real-time and adapting to changing risk profiles. The best way forward for organizations is to apply the Zero Trust framework, developing a structured project to raise the level of cybersecurity maturity of the organization.
Finally, Helder Ferrão mentioned that the ability to detect fraudulent account creation prevents the use of a major attack vector, improves trust, and provides additional security and better experiences to legitimate users who want to create and manage accounts with them. And by reducing account abuse, you'll not only protect customers' assets and personal information, but you'll reduce the cost and frustration that these attacks bring.
