API Security & the Commoditization of Credit Card Fraud-as-a-Service

Credit card fraud is easier than ever. But why?

The tools and services designed to facilitate fraudulent activities like carding and card cracking are becoming more accessible to the masses. Stolen card details, carding techniques, and sophisticated fraud-as-a-service tools are all growing more available, more advanced, easier to use, and cheaper to buy or rent by the day.

With easy access to countless services and tools, even the most inexperienced of fraudsters can perpetuate attacks fast using sophisticated techniques, increasing the potential damage to your business.

While business websites and mobile apps are highly visible and often protected by bot and/or fraud protection, APIs are sometimes left out. That’s because APIs can seem more like “soft” targets, and are therefore left with softer protection—legacy tools, such as web application firewalls (WAFs).

Largely because of their lack of sophisticated protection, APIs are now being increasingly targeted at scale by cybercriminals using highly commoditized (and thus more accessible) tools.

What are fraud-as-a-service tools?

Fraud-as-a-service tools help attackers automate the background work of online fraud, such as credit card fraud, making malicious activity as simple as possible for fraudsters. Online credit card fraud involves several steps, including (but not limited to):

1. Getting card numbers: Fraudsters obtain or steal valid credit card numbers (via carding, card cracking, or purchasing on the deep web) to use in their fraudulent transactions. Bots are often employed en masse to infer (aka “test” or “crack”) card numbers and associated cardholder information. Payment details can be easier to find behind less protected endpoints, such as an API used by the payment processor or the merchant.
2. Gathering cardholder information: Fraudsters match credit card numbers to the cardholder’s data, like name, billing address, zip code, etc. in order to use the card online. Bots can be used to infer cardholder information. Sometimes, attackers purchase fullz, which include payment information and personal information about the cardholder.
3. Completing fraudulent transactions: Armed with stolen credit card information, fraudsters focus on getting through the entire checkout process on the target website—without raising red flags. Bots are often used to automate the process and increase the volume of transactions that can be made.

Any of the steps above can be intensive if not automated, which is where fraud-as-a-service tools come in. Similar to bots-as-a-service, fraud-as-a-service can send bots to gather card details and personal information, or to complete a transaction, or both. Add-ons like residential or ISP proxies help the fraudster avoid detection.

Using a fraud-as-a-service tool helps outsource the risk and difficulties of performing credit card fraud, allowing anyone—even those without any programming knowledge—to perpetrate fraud.

Fraud-as-a-Service Commoditization Increases APIs’ Risk of Card Fraud

The commoditization of card fraud tools and services makes credit card fraud easier for anyone to perform, particularly against front-end APIs left unprotected against advanced bad bots. Online fraud will persist, and get worse, and any e-commerce platform left unprotected offers many opportunities for bad actors to steal money, personal data, and products using stolen cards.

Both businesses and financial institutions are facing significant challenges as online fraud continues to grow in popularity, and as the payoffs for fraudsters continue growing too.

As cybercriminals find new ways to exploit vulnerabilities in existing fraud prevention systems, businesses and financial institutions rush to develop new systems to detect and stop fraud. But the resource-draining cat-and-mouse game will only escalate as card fraud becomes easier to perform. Trends show fraudsters shifting to target APIs instead of websites, which tend to be more well-protected.

APIs are gateways to organized data in predefined formats, making them a useful target for fraudsters looking for specific information. Additionally, API security is more difficult to implement than protection for websites and mobile apps, making APIs “softer” marks. For example, a headless browser connecting to a website is suspicious—but a headless browser connecting to an API is considered to be normal.

Fraud-as-a-service tools provide bad actors with access to the resources they need to create and utilize sophisticated bots—like proxies with good reputations—to easily circumvent basic security tools like WAFs.

Protect User-Facing APIs From Automated Credit Card Fraud

The increasing automation and commoditization of online card fraud can only be countered by a sophisticated, smart bot and online fraud protection solution. And the best solution will protect all of your business’ endpoints. One of the most common security measures used in front of user-facing APIs are web application firewalls (WAFs) that are designed to protect from known attacks based on a set of rules. But WAFs can only block familiar threats, making them ineffective against today’s advanced bots.

DataDome’s bot and online fraud protection fortifies API data access points, defending businesses and customers against scraping, credential stuffing, brute force attacks, and more.

DataDome’s machine learning-powered solution analyzes each request in real time, every time, to safeguard websites, mobile apps, and APIs from malicious bot activity with speed and accuracy. Our protection reduces security risks, strengthens trust between merchants and partners, and helps businesses avoid excessive chargeback fees from fraudulent transactions.

Want to see how DataDome can protect your business against credit card fraud? Try it free for 30 days to see which threats are targeting your platform, or schedule a demo today.