Account takeover (ATO) is the downstream effect of a worrying rise in massive data breaches and phishing attacks. Criminals have easy access to billions of credentials, which they systematically test on sites and apps until they find a match.
With 48 percent of online businesses experiencing a rise in ATO attempts in 2016, are you doing enough to prevent your users’ accounts from being hacked?
ATO is on a steep rise. In 2016, 554 million records were compromised in the first half of the year. ATO losses reached $2.3 billion in 2016, a 61 percent increase from the year before.
ATO naturally spikes following data breaches, as fraudsters can reuse stolen login information to takeover other accounts of hacked users. 59 percent of online users reuse login information which makes them easy ATO targets after a data breach.
Unfortunately, ATO attacks are inevitable. Data breaches happen and credentials get exposed. Hopefully with the right tools and defences, you can protect your users and secure their confidence by keeping their accounts safe from hackers.
With the rapid rise and potential business implications of ATO, companies are actively trying to find ways to discover and prevent ATO before it costs them money and customer trust.
Sift Science has added a tool to its suite of machine learning tools to detect account takeover (ATO) and fight fraud. The tool uses machine learning and behavioural analysis to detect fraudulent logins.
This enables Sift Science to analyse users’ behaviour, and then compare that behaviour, as well as patterns of good and bad users across its network.
The tool automatically detects and blocks illegitimate login attempts from bad actors – without getting in the way of ‘good users’.
Billions of users interact with online businesses every day browsing websites, making purchases, and posting content.
All digital signals from these interactions including information entered in sign-up forms can be analysed to indicate how risky users are for online businesses.
Sift Science captures these signals, and detects patterns that indicate whether users are good, trustworthy customers, or fraudsters out to commit acts like identity theft, spam posts or credit card fraud.
The tool then assigns scores for people interacting with a customer’s site, which indicate how likely the user is to be good or bad.
Each time someone logs in, the tool returns an ATO risk score. You can identify risky users and alter the login experience in real time.
Customers have the option to automate reaction to “risky” behaviours. The tool can automatically reject their activity or send them to a review queue.
The technology looks at a range of potential ATO signals, such as user browsing patterns, network and IP data, location history, and device information. Problems can be resolved before they affect the good users.
It flags risky or abusive user behaviour (fraudulent transactions, spammy content posting, promotional abuse etc.) for companies.
The console enables users to review the signals that makes a particular user risky – like location, IP address, device, etc. and resolve the issues.
You can also build in an extra authentication step, such as a code sent via SMS for certain users.
Two factor authentication is a great step to increasing security, but there is no replacement for educating your users so that they can minimise any ATO attacks.
The unbreakable solution is still a very long way off.
