ClickCease

3 Key Takeaways from Prove's Q1 Fraud & Identity Roundtable

April 3, 2023

Every quarter, Prove gathers industry executives in identity, fraud, and risk to discuss hot topics, key trends in the industry. This is a summary of what we discussed in Q1:

1. Prove Identityā„¢ Prevents Tax Fraud Attack

By establishing a connection between the user attempting to onboard and their phone, Prove protected its clients and consumers from tax and identity fraud.

Bad actors used social engineering and online SMS services to perform an OTP authentication and attempt to file taxes using stolen PII before legitimate taxpayers could file.

  • We stopped the bad actors šŸ›‘ by determining that the phone number used for the fraudsterā€™s OTP did not belong to the PII submitted in the application.Ā 

Prove also identified fraudulent transactions where bad actors recently claimed ownership of the phone number (e.g., less than 90 days before the attack).

For further protection, and to avoid the potential fraudulent transactions altogether, clients can replace traditional SMS OTP workflows with next generation authentication services that protect against social engineering, such as Proveā€™s Mobile Auth possession check that is performed as part of Prove Identityā„¢ solution.

What is Proveā€™s next security enhancement? We are developing a signal to tag phone numbers associated with online SMS services as being higher risk.

2. SIM Cloning and SS7 Vulnerability Chatter

Fraud experts were alive with chatter about a potential SS7 vulnerability that could lead to SIM Cloning attacks. Our telephony experts dug in to clear up any confusion.

SIM cloning happens when someone creates a duplicate SIM card from an existing one. When deployed correctly, the SS7 protocol (international standard architecture for telephony signals) protects against SIM Cloning.Ā 

  • We did our own research šŸ’” by contacting US mobile operators and confirmed that there are no known SS7 vulnerabilities that would allow SIM cloning to occur.

During our investigation, Prove identified that ā€œusage forkingā€ is commonly confused with SIM Cloning. Usage forking occurs when a bad actor accesses a phone number via an online portal or paid ā€˜fraud-as-a-serviceā€™ and uses the phone number without the actual owner knowing.Ā 

3. OTPs Are Not EnoughĀ 

Prove continues to observe that high-risk transactions secured only by an OTP (SMS or Voice) are vulnerable to attacks. In some cases, bad actors used the same phone number combined with many different sets of stolen PII to try and create accounts. Without using a separate reputation check and phone ownership check as part of the authentication process, itā€™s tough to identify and prevent fraud.Ā 

We wanted to remind attendees about Proveā€™s PRO methodology šŸ” and explain why itā€™s a next generation approach for lowering fraud rates and mitigating risk:

ā€

  • Possession: Confirm the phone number being used during a transactionĀ 
  • Reputation: Evaluate real-time signals such as SIM history, porting history, and line type to determine riskiness of a phone number
  • Ownership: Confirm that the owner of a phone number is the person completing the transaction

ā€

PRO is a powerful methodology designed to prevent fraud through a layered, secure approach.

Conclusion

The discussion among Prove's industry executives in identity, fraud, and risk highlighted the importance of developing and implementing next-generation authentication services to combat social engineering and fraud attacks. A warm thank you to all of the executives who participated in this critical discussion.

ā€

No items found.

Keep reading

See all blogs
Blog
Prove CEO Rodger Desai Explains How Digital Identities Can Secure the Gig Economy Against Fraud

Rodger Desai, CEO of Prove, a leading identity verification solution provider, offers a unique perspective on the rising fraud in the gig economy, advocating for robust digital identity verification as a key defense mechanism.

Brad Rosenfeld
November 6, 2024
Blog
Approaches to the Complex Issue of Age Verification

Ascertaining a userā€™s age used to involve simple self-declaration or rudimentary checks, but technologies like facial recognition and rigorous identity verification offer a more accurate form of determination.

Mary Ann Miller
October 25, 2024
Beyond Passkeys: Why We Need More Than Just a Password Replacement

Even though weā€™re all acclimated to using them, passwords simply do not provide an adequate level of security.

Bill Fish
October 23, 2024