You may be familiar with web card skimming, where a fraudster replaces the payment iframe on an ecommerce site with a fake version designed to intercept payment details or divert a transaction.
However, there’s another variation that, while not new, is something we encounter far less often. It was highlighted this week during a call from an ecommerce vendor: redirection fraud.
In this scenario, the attack starts much earlier in the customer journey. Rather than targeting the payment stage alone, the fraudster interferes with the product-selection and shopping-cart process, redirecting the customer into a fraudulent checkout journey.
What made this case particularly surprising was that it occurred on a major ecommerce platform.
The redirection urls are similar, maybe with a single character change in the name or with a hyphen introduced. The customer therefore doesn’t notice anything unusual and assumes they have made a legitimate purchase.
Without effective user-journey monitoring in place, the merchant may have no idea anything is wrong. The first indication can be when a customer gets in touch to ask:
Where are my goods?
That’s when the nightmare scenario begins to unravel — transactions have taken place, customers believe they have purchased from you, but the money and order information has gone elsewhere.
Because a customer is not likely to contact you until at least 24 hours after placing their order, by the time you know anything is wrong, tens or hundreds of orders, depending on how busy your store is, could have been processed this way.
The customers have no goods and you haven’t received the money for them!
Monitoring the complete customer journey, not just the payment page, is becoming increasingly important. If the customer journey is monitored and there are changes to the journey or script then the RapidSpike Synthetic monitoring tool can detect the change, alert the merchant of the change and then the merchant can act quickly, removing the fraudulent script and code.
If you’d like to discuss user-journey monitoring, get in touch.
We recommend acting before anything fraudulent happens, not after.
