Best practices for fighting fraud – brief Q&A merchant session

Which fraud trends did you see on the rise in the past 12 months?

Elena Emelyanova, Senior Payments and Fraud Manager at Wargaming.net

Wargaming is definitely one of those gaming companies that is lucky enough to have a stable variety of fraudulent activities appearing on a yearly basis. The year of 2022 was not an exception, bringing us lots of interesting and mind-blowing cases to fight with.

Wargaming’s main fraud influencer of this year was account takeover (ATO). It may sound quite ordinary, especially since this type of fraud was never a ‘headache’ for us. However, we saw a peak of activity from the mid of the year, specifically in the European region. The other trend we see is related to Gifting – the area we were almost sure is under our full control. I must admit that our fraudsters are definitely creative. They need to be extremely inventive to do their job properly.

Augie Kennady, Director of Trust & Safety at Chegg

The reality is that fraud adapts to however you combat it. All over the world, you’ll see similar card testing schemes, stolen-card purchases, and Account Takeover — anything that gives users an ‘in’ to your product. The behavioural patterns present analogously to dipping a toe into a cold pool — the fraudster tests a new tactic or pattern and then gradually expands it, as the level of comfort and confidence grows. Catching the signals early is paramount.

Will the current global economic context and the latest regulations, including for crypto assets, affect the level of fraud?

I do believe that every new technology or regulation, regardless of whether it was designed specifically to prevent fraud or not, is, in the end, serving yet another impulse for fraud to appear or to be pushed to somebody else. Global fraud levels will doubtfully be impacted. However, there will be industries which will catch the fraud ball due to the impact of global economic changes and the latest regulations.

Gaming is an industry married to fraud, thus, no matter what, there will be always a struggle with bad guys at some level, which means we are not even close to bringing the fraud level to its minimum.

The impact of both factors depends on the offerings of a particular company. A company that permits only domestic sales is unlikely to experience the impact of abuse that a more global company may encounter. 

There is an important point to keep in mind here — while macroeconomic conditions are generally favourable to fraud, fraud isn’t a game fought on the macro-stage. It is a game fought on a firm-level. It’s the age-old adage: ’You don’t need to outrun the bear; you just need to outrun the other campers.’  

At the end of the day, threat actors want to make money. If they have three comparable financial opportunities, but one of those opportunities is more sophisticated in their abuse prevention, the threat actor is likely to focus on the two less-sophisticated platforms. That’s why every company – no matter the platform, product, or approach – should understand what they can do to mitigate abuse.

Which tools do you consider the most effective into keeping fraudsters away, without adding extra pressure on legit consumers?

The most effective tool would be the combination of multiple technologies and practices existing in a market. However, even in such case, the used tools will not be efficient forever. Ecommerce is a rapidly developing environment, including its fraud component. Thus, the efficient tool would need to be flexible and adaptable.

A combination of Machine Learning, Adjustable Fraud rules, and Manual monitoring could prove effective, although quite expensive. That’s why, in most of the cases, you will see companies opting for only one component of the solution above.

Understand your platform. Where are the moments of greatest risk? Is it at login? Is it at order placement? Content or product access? Account access? Wherever the greatest risk may reside, you should find a partner who will be able to implement their technology at that level. Moreover, ensure that the partner allows for custom business rules. No two businesses are identical. 

What worked marvellously for some companies may prove unsuccessful for your company Strong threat-defence partners understand that their clients – the firms themselves – are collaborators in their model. Firms seeking guidance should immediately assess potential collaborators’ ability of implementing custom logic.