Account Takeover: Protecting Retail Customer Accounts During Peak

Retailers encourage customers to create accounts to gather customer data that can be used to personalize marketing, and to help create a smooth, streamlined checkout experience for future purchases. However, fraudsters that gain access to these customer accounts can wreck financial havoc on customers and merchants.

Account takeover fraud (ATO) is a form of identity theft where bad actors gain access to consumer accounts, make legitimate-appearing changes to them in order to use the accounts to make fraudulent actions or purchases. Because ATO fraud can be very tricky to detect, as retailers gear up for peak, monitoring for account takeover fraud becomes more complex.

Here’s what to keep in mind as you prepare for a surge in transactions.

In an ATO, a fraudster uses stolen credentials obtained on the Dark Web to gain access to a consumer account. Since customers often use the same password for all or many of their customer accounts, the fraudster is able to use automated methods like credential stuffing to attempt to access thousands of accounts simultaneously.

Fraudsters do their best to not raise red flags during ATO fraud. The first thing they often do is make legitimate-appearing changes such as changing the account password, address, email, shipping address, adding an authorized user, or adding a fraudulent (aka stolen) credit card to the account. Once these changes are made, the fraudster can make purchases using the account — often having orders shipped to the address of the stolen credit card, and then initiate chargebacks for financial gain.

In ecommerce retail, more ATO fraudsters are taking advantage of BOPIS and BOPAC for the pickup part of their fraud, then they either keep the merchandise or return it. They do this by setting up designated proxy pickups and count on retailers (or even target them) that are not stringent about asking for identification and verifying credentials for store pickup orders.

Customers typically do not realize they are the victim of an account takeover until they see fraudulent charges on their credit card statement or are blocked from accessing their account because the password has been changed. Credit card companies with solid fraud detection will often alert customers to any unusual or deviant activity on their card. But if fraudsters stay within bounds of that customer’s normal behavior, it is very difficult to detect an ATO until evidence of fraudulent purchases happens across multiple accounts.

Customers expect retailers to provide a high level of security over their account information. But because account takeover is often predicated on customers using the same password for multiple accounts, there is a level of co-prevention that needs to happen.

Here are 5 ways that retailers can help prevent account takeovers:

Radial offers fully managed fraud prevention services designed specifically for ecommerce retailers. With deep expertise in retail (including 10 years in BOPIS) and a vast network of customer data across the retail industry, we are able to detect account takeover attempts to help keep your customer accounts secure.

We assess for risk factors, such as:

As retailers prepare for peak and high volumes of transactions, taking the time now to add additional measures to mitigate account takeover is essential. Radial is here to help advise on fraud protection and provide complete fraud solutions.

Follow Radial on LinkedIn, Facebook and Twitter.