2017 Call Center Fraud Report

REPORT

EXECUTIVE SUMMARYFor financial institutions, retailers, and other high-value targets, the call center is now the nexus of fraud activity. Data collected at Pindrop® Labs has shown a significant increase in the call center fraud rate, a jump of 113% from 2015 to 2016.1 As fraud calls increase, the sophistication of the criminals behind these efforts is continuing to grow. One of the main drivers behind the relentless rise in fraud is that attackers are getting better at their craft, honing their skills, and becoming more adept at social engineering techniques to help them bypass call center defenses. The continued adoption of EMV (chip and PIN) cards in the United States has also contributed significantly to the increase in call center fraud, as fraudsters have had to abandon in-person techniques and move to the phone channel where defenses are less mature.

Key data points for 2016 include:

• A year-over-year increase in the call center fraud rate, up 113% from 2015 to 2016.

• An increase in fraudulent calls from 1 in every 2000 calls into a call center in 2015 to 1 in 937 in 2016.

• A flattening of call center losses per call, staying at $0.58 per call from 2015 to 2016.

INTRODUCTIONThe call center is the softest target for fraud in virtually every organization. Call center defenses usually come down to knowledge-based authentication questions (KBAs) and the skills of customer service representatives. Training for call center employees is designed around providing excellent customer service and not fraud detection.

Fraudsters understand this and target their operations at the call center—what they see as the weakest link in these organizations’ security. In fact, 61% of fraud losses from account takeovers involve the call center.2 By the time a fraudster gets to the call center, they have often already worked to gather intelligence about the target account and are ready to strike.

This report will provide insights about the depth and breadth of fraud activity across a variety of industries from a data set of more than half a billion calls.

FRAUDULENT CALLS INTO CALL CENTER

2000 9371 1

2015 2016

FRAUD RATE INCREASE

113%from2015

to 2016

CALL CENTERLOSS PER CALL 2015–16

58¢ CALL

1. Unless otherwise noted, all data and findings come from Pindrop® Labs annual Call Center Fraud Reports, 2013-2016. 2. Contact Centers: The Fraud Enablement Channel, Aite Group, April 2016

REPORT

1pindrop.com | 866.245.4045

REPORT

1pindrop.com | 866.245.4045 1pindrop.com | 866.245.4045

DEFINING THE PROBLEMFor the purposes of this report, call center fraud represents any interaction between a criminal and a call center agent. Though many of these calls involve criminals attempting to complete a fraudulent transaction, the majority of fraudulent calls do not involve such a transaction. Pindrop® Labs suggests that a criminal makes an average of five calls before completing a fraudulent transaction. They may reset passwords, change mailing addresses, and make other modifications that enable them to conduct later attacks. In some cases, fraudsters know that their previous activities have caused the company to flag their target for fraud, restricting what can be done on the account. Therefore, fraudsters will call in an effort to influence customer service agents to remove that flag.

THE SCOPE OF CALL CENTER FRAUDIn recent years, the scope of call center fraud has become truly staggering. In 2015, one in every 2,000 calls was fraudulent. In 2016, that number jumped to 1 in 937, an increase of 113%. This is clear evidence that more fraudsters are turning to the phone channel and are getting better at what they do, while call center defenses have not kept up. When the bad guys run up against a wall, they find

a way around it through the call center. It’s wide-open territory leaves minimum barriers to prevent fraudsters from taking what they want.

To make this problem more tangible, consider that targeted organizations lost $0.58 per call to fraud— a significant amount of money given huge call volumes. While the number of fraud calls has increased dramatically over the years, the loss per call has remained fairly static at $0.58 per call. Though the upper echelon of fraudsters are becoming increasingly sophisticated and targeted with attacks, at the same time, there is a continuing influx of new, less sophisticated attackers, which contributes to keeping this number flat.

5CALLS

Criminals make an average of

before completing a transaction

1 in 2900

1 in 2200 1 in 2000

1 in 937

2013 2014 2015 2016

2013-2016 GROWTH IN GLOBAL FRAUD RATES

Fraud rate is calculated as fraudulent calls per legitimate calls

REPORT

2pindrop.com | 866.245.4045

TECHNICALFraudsters have the ability to spoof caller ID and use applications such as Skype or Google Voice to hide their identity and location. Caller ID and location data are now no better or reliable than an IP address for authentication. Fraudsters also abuse IVR (Interactive Voice Recognition) systems to reset victims’ PINs or find more information about a target.

HUMAN

The real target of call center fraud attacks is the employee on the other end of the line. Taking hundreds or thousands of legitimate calls for every “bad” call, customer service representatives focus on resolving customer issues efficiently and not on filtering out fraudulent calls. The risk of falling prey to a fraudster is high, and so is the potential downside if an agent mistakes a legitimate customer for a fraudster.

ORGANIZATIONAL

Call centers are designed to efficiently handle huge volumes of activity very quickly, and agents are measured on how quickly they resolve each call. Fraudsters use data they’ve gathered about a target account to pass knowledge-based authentication and socially engineer the agent into giving them account access. They will often pretend to be in a rush, angry, or traveling in a foreign country in order to gain sympathy and move the call along quickly.

OUTSIDE FACTORS THAT PUSH FRAUDSTERS TO THE CALL CENTERThe push into the call center by fraudsters has coincided with several larger trends. Financial institutions, insurance companies, and other frequent fraud targets have invested heavily in securing their online channels in recent years, making online fraud much more difficult and risky for criminals. At the same time, card issuers in the United States have rolled out EMV cards with chip-based authentication, which has produced a huge drop in card-present fraud. Previously, fraudsters were able to print credit cards

with stolen numbers, but the EMV rollout has taken that option away. As such attackers have had to look for other options and, are focusing their energy on the highly lucrative phone channel. With fewer defenses and a lower barrier to entry for phone fraud, compared to online or in-person attacks, call centers are vulnerable and attackers are succeeding.

Also, fraudsters who are in the game for the long–term spend a considerable amount of time researching their

KEY WEAKNESSES IN THE CALL CENTER

Tell me one thing, Madam. You are here to provide a service, not to be moody.

Sir, I am not angry.

My name is .......

When answering, instead of asking me how are you, how was your day, why don’t you just do your job! Just answer my questions. Sorry what’s your name?

Just tell me the balances please.

Ok, your balance is.....and I’ll get that statement to you right away.

Fraudster (in an angry tone)

Customer Service Representative (apprehensively complies)

REPORT

3pindrop.com | 866.245.4045

targets. They gather intelligence from online and offline sources (such as social media profiles), and purchase information stolen during data breaches. They will compile a dossier on a specific victim comprising high-quality data from many sources and then use that information in multiple interactions with a call center in an account takeover operation. At that point, the criminal knows more about the victim than the organization does and has a significant advantage over the call center agent trying to protect the victim’s account.

0%

10%

20%

30%

40%

50%

53%

42% 45%

43%

35%

21%

26%23%

12%

60%

VOIP

MOBILE

LANDLINE

2014 20162015

GLOBAL GROWTH OF MOBILE FRAUD

FRAUDSTERS EMBRACE MOBILE, CONTINUE USING VOIP

32%

12%

56%

FRAUD CALLS FROM VOIP

FRAUD CALLS FROM MOBILE

FRAUD CALLS FROM LANDLINES

U.K. FRAUDSTER WEAPONS OF CHOICE

While the lack of defenses in the call center help enable phone fraud, the phone network itself also plays a part. Simple, freely available tools such as caller ID spoofing apps and voice distortion software allow criminals to circumvent the limited protections that exist on the public phone network. Combined with access to free VoIP software or cheap mobile phones, these tools give even unsophisticated attackers a considerable arsenal with which to work. For the third year in a row, VoIP software has remained the most common tool for fraudsters, comprising 45% of fraud calls.

It’s also notable that, globally, fraudsters have increased their use of mobile phones in recent years. In 2014, only 21% of fraud calls were made over mobile. Today, it’s 43%. This rise is likely due to the emergence of cheap burner phones, which many fraudsters believe are untraceable. Data from the Pindrop® Labs U.K. Call Centre Fraud Report suggests that mobile phones are the number one method of attack for fraudsters, with VoIP a distant second. 56% of fraudulent calls in the U.K. are made from mobile phones and 32% are from VoIP lines. Almost none of the phone fraud hitting U.K. call centers is from landlines.

Fraud calls from landlines have been decreasing steadily, accounting for just 12% of all fraudulent calls in 2016. The steady increase in the use of both mobile and VoIP lines will remain a key ingredient in the fraud ecosystem. These technologies simplify attacks for criminals and make it more difficult for defenders and law enforcement agencies to identify fraudulent calls and find the attackers. The convergence of these factors is a major contributor to the annual increase in fraud.

REPORT

4pindrop.com | 866.245.4045

REPORT

4pindrop.com | 866.245.4045

Along with facilitating international communication and commerce, the advent of the global internet has also led to the emergence of global cybercrime operations. The same is true in the phone fraud arena. Worldwide telecom infrastructure allows fraudsters to call anyone, anywhere. VoIP software and mobile phones make it cheap or even free.

Although some scammers tend to stay within their country’s borders, others are increasingly branching out and attacking organizations across international lines. In 2016, fifty-two percent of fraudulent calls to U.K. financial institutions came from other countries. This is a clear departure from past years when the vast majority of such calls were domestic, and it follows the trend of what’s been happening in the U.S. where 83% of fraudulent calls were from outside the country.

Some of this can be attributed to the growing problem of phone fraud as an international crime. But, it’s also an indication of scammers becoming more confident as they improve their skills and feel competent enough to target organizations in other countries.

This migration across international lines also presents more opportunities for profit. The average loss per fraud call in the U.K. jumped up to $1.08 in 2016, a sharp increase from $0.74 per call in 2015. As scammer confidence builds, so will the trend to target higher-value accounts, leading to significant average losses for victimized organizations.

INTERNATIONAL PHONE FRAUD RINGS ATTACK U.S. & U.K.0%10%20%30%

40%50%60%70%80%90%

100%

2015

INTERNATIONAL DOMESTIC

2016

UNITED KINGDOM

0%10%20%30%

40%50%60%70%80%90%

100%

INTERNATIONAL DOMESTIC

2015 2016

UNITED STATES

0%10%20%30%

40%50%60%70%80%90%

100%

2015

INTERNATIONAL DOMESTIC

2016

UNITED KINGDOM

0%10%20%30%

40%50%60%70%80%90%

100%

INTERNATIONAL DOMESTIC

2015 2016

UNITED STATES

OUTSIDE ATTACKS OUTWEIGH DOMESTIC

REPORT

5pindrop.com | 866.245.4045

Device InsuranceBy far, the highest fraud rate of any single industry is seen in the device insurance sector. For companies that provide payments to consumers whose mobile phones are lost or stolen, 1 in every 194 calls is fraudulent. That rate increased 55% over 2015, when device insurance already had the highest phone fraud rate of any vertical.

Banks and BrokeragesIn 2016, the fraud rate for banks was 1 in 867 calls, a 61% increase over 2015’s one in 1,400 calls and higher than the fraud rate across all industries. The trend toward higher fraud rates in financial institutions isn’t unique to banks, either. For brokerages, 2016 saw a 53% increase in the call center fraud rate, with 1 in 1761 calls being fraudulent.

Card IssuersFraudsters continue to target card issuers, which remain one of the financial institutions hardest hit by fraud. Nearly 1 in 800 calls to a card issuer’s call center is fraudulent - a high fraud rate that has stayed consistent over several years. Criminals of all kinds value stolen credit card numbers because they’re the easiest and fastest way to steal large amounts of money with the lowest chance of detection. Fraud exposure for card issuers is also very high, pointing to the fact that fraudsters increasingly target high-value accounts.

InsuranceThe insurance industry is also taking severe hits from phone fraud. In 2016, one in every 4,700 calls was fraudulent compared to 1 in 12,000 in 2015. Phone fraud rings run a variety of scams against insurance companies, and victims may not notice for a long time, if ever. Most customers rarely call their insurance companies, so fraudsters can have access to a compromised account for months or years. Life insurance policies typically have high cash values. Fraudsters are known to take out loans against a victim’s policy, or even cash out the policy altogether.

BREAKDOWN BY INDUSTRYFraud rates can vary widely across industries and are dependent upon many factors, including the sophistication of defenses and the size of an organization. One thing that remains the same is that criminals go where they can find the money.

1 in

12000

1 in

4700

INSURANCE RETAIL

1 in

1000

1 in

491

2015 2014 20162016

BANK

BROKERAGE

CREDIT CARD ISSUER

2014 20162015

1 in 900

1 in 2650

1 in 3000

1 in 2700

1 in 17611 in 1400

1 in 8671 in 800

1 in 832

GLOBAL FINANCIAL INSTITUTION FRAUD RATES

GLOBAL INDUSTRY FRAUD RATES

Fraud rate is calculated as fraudulent calls per legitimate calls

REPORT

6pindrop.com | 866.245.4045

REPORT

6pindrop.com | 866.245.4045

RetailFraud rings have also taken aim at retail call centers in 2016 as the confluence of EMV card rollouts and better online security has pushed fraudsters to exploit the phone channel. In 2014, one in 1000 calls to a retail call center was fraudulent. In 2016, that number jumped to 1 in 491. For retailers, this trend will be difficult to reverse without a major change in the way they handle call center security.

Fraudsters continue to perfect their tactics. The huge volume of stolen information available from data breaches means they have access to more accurate data about potential victims. With the shift in tactics comes an attendant shift in liability, from the card issuers and banks to the retailers. Many of the same retail chains previously victimized by data breaches are being hit a second time as fraudsters monetize the stolen information through call center schemes.

Some of the scams hitting retail chains are fiendishly clever and quite difficult to stop. For example, rather than stealing a victim’s payment card data, some scammers specifically target a consumer’s loyalty account. In much the same way that they perform account takeovers at banks, scammers will make multiple calls to retail loyalty account call centers to try and reset account passwords or change other account details. The loyalty points generated by shopping at some retail chains are as good as cash, so fraudsters will gain access to those accounts and use them to purchase goods. In some cases, they will even buy new items and send them to the victim just to get the loyalty points a new purchase accrues. Similar scams have been seen in hotel and airline loyalty programs.

METHODOLOGYFor this report, Pindrop® Labs analyzed more than half a billion calls globally using Phoneprinting™ technology to dissect the details of attacker techniques and behavior. Pindrop’s patented Phoneprinting™ technology was combined with metadata and voice biometrics analysis of the phone call audio content. Phoneprinting™ technology measures 147 characteristics of the audio signal in order to form a unique fingerprint for the call. This information provides an unprecedented level of insight into the phone channel. Phoneprinting™

technology determines a caller’s true location and device type. In addition, it helps to identify multiple callers associated with the same phoneprint, allowing enterprises to track fraud rings.

ABOUT PINDROPPindrop is the leader in

voice fraud prevention and

authentication. Pindrop

provides enterprise solutions

to reduce fraud losses and

authentication expense for some

of the largest call centers in

the world. Pindrop’s patented

Phoneprinting™ technology can

quickly and accurately identify,

locate, and authenticate phone

devices uniquely just from the

call audio, on the first call and

every call. Pindrop® solutions

allow customers to reduce

call time and improve their

customers’ experience even

while reducing fraud losses.

Pindrop was founded in 2011 and

is venture backed by Andreessen

Horowitz, Citi Ventures, Felicis

Ventures, CapitalG, GV, and IVP.

REPORT

7pindrop.com | 866.245.4045