The E-commerce market has seen tremendous revenue growth during the pandemic. Along with that good news for E-business, there has been an increase in fraudulent activities online that may cost retailers over $20 billion in losses by the end of 2021. According to eMarketer, worldwide retail E-commerce sales posted a 27.6% year-over-year growth rate in 2020, with sales reaching well over $4 trillion. Experts predict E-commerce revenue will approach $5 trillion this year and reach $6.388 trillion by 2024. In the US economists believe, E-commerce will account for a record 18.9% of total holiday season retail sales. Holiday shopping season starts earlier every year and will be here before you know it. What are some of the main concerns that E-tailers should prepare now to address?
Online credit card skimming increases in popularity
Account takeover fraud is a growing concern
Account Takeover (ATO) is a form of identity theft where a bad actor gains unauthorized access to an account belonging to someone else. Alarmingly, despite their name making an impression of a complex break into an account, this isn’t quite the case. A lot of these attacks do not require much technical expertise. Instead, they rely on capturing leaked credentials online and using automated web browsers to test these against login pages at scale. This is usually achieved through credential stuffing attacks. In these, bots are being used to perform mass login attempts in order to verify the validity of stolen username & password pairs. According to Imperva’s Threat Research Labs, online retailers experienced more than twice as many ATO attempts as all other sectors in 2020. Saved credit card information, gift card balance, loyalty points and other customer benefits make E-commerce a ripe target. Brand damage, revenue loss, chargebacks and increased customer support costs are just a few of the implications of a successful account takeover attack on an online retailer.
Credit card fraud and chargeback fees
Carding is a good example of a bot attack that is optimized by Magecart attacks. It is an automated threat carried out by bots, in which attackers use multiple, parallel attempts to authorize stolen credit card numbers on websites that have checkout forms. The goal of carding attacks is to identify which card numbers or details can be used to perform purchases. Recently, one million stolen credit card numbers were leaked on hacking forums in an attempt to promote a new criminal carding marketplace. The ramifications for online businesses, especially online retailers, is significant. In addition to the damage done to owners of stolen credit cards, carding attacks negatively affect businesses whose websites are used to authorize stolen credit cards. This is a result of chargebacks – disputed transactions that result in a merchant reversing them and refunding the purchaser’s money. While chargebacks can happen for legitimate reasons, they are very often the result of fraudulent techniques like carding. They hurt the business’ reputation with the credit card processors and may lead to poor merchant history and chargeback penalties.
Bad bots shop, too
In October 2020, we recorded a 788 percent increase in bad bot traffic to retail websites, coinciding with the launch of the new gaming consoles and GPUs, as well as holiday shopping and lasting through Black Friday. Throughout the year, 22.7 percent of traffic to retail websites consisted of bad bots, of which a staggering 62.8 percent were classified as Advanced Persistent Bots. The 2021 holiday shopping season is shaping up to be similar. The global chip shortage is only worsening, and may last well into 2022. This matters because highly coveted electronics like gaming consoles, GPUs, smartphones, laptops and other consumer electronics are in short supply. And where there’s short supply for a high demand product, scalpers armed with bots are on high alert. Scalping is the act of purchasing limited stock items to then resell them for a higher price. From simple bots that scrape product pages for available inventory to full-fledged bot operations that make use of highly sophisticated bots, scalpers gain a competitive edge over the average consumer. The inability to purchase the items results in legitimate customers being frustrated with brands and retailers. It damages reputation and customer lifetime value as well as conversion rates.
The side-effects of bot traffic mismanagement
Retailers that are caught unprepared and without a bot management solution in place can expect degraded performance leading to slowdowns and potential downtime, which according to Gartner costs $5,600 per minute on average. Additionally, for online retailers that experience downtime there’s more at stake than just lost sales. Damaged brand reputation, diminished search engine optimization (SEO), and unsatisfactory conversion rates are just a few of the repercussions. Today, consumers are highly sensitive to page load times. The average bounce rate for pages loading within 2 seconds is 9%, and it skyrockets to 38% by the time it hits 5 seconds. Implementing a bot management solution that eliminates bad bot traffic, not only reduces the risk of downtime, but also improves average page load times, thus reducing the bounce rate.
Customer experience is key
One particular challenge of bot management is maintaining top-class customer experience (CX), all while not compromising security. According to Google commissioned research conducted by Forrester, improving security and detecting threats are naturally the top two capabilities that decision-makers look for in a bot management solution. However, improving CX was the third most highly rated priority for business leaders. According to Forrester, there is a direct line between improving CX and growing your bottom line. This means that besides cutting-edge detection and mitigation techniques, retailers must look for a solution that doesn’t compromise on the user experience.
Better fraud prevention with Imperva
Imperva’s WAAP (Web Application and API Protection) stack combines best of breed solutions that protect your business from edge to database. Two key components of it are Advanced Bot Protection and Client-Side Protection. Combined, they improve security posture by enhancing fraud prevention:
- Advanced Bot Protection reduces business risk by safeguarding your online store from bad bots that perform business logic attacks. Importantly, it doesn’t get in the way of legitimate customers, preserving customer experience and ensuring business continuity. It mitigates all OWASP automated threats including account takeover, web scraping and online fraud. With protection for websites, mobile applications and APIs, Advanced Bot Protection has got all of your access points covered.
- Client-Side Protection mitigates the risk of your customers’ most sensitive data landing in the hands of bad actors. It prevents supply-chain fraud from Client-Side attacks like formjacking, Magecart and other online skimming attacks. Client-Side Protection automatically scans for existing and newly added services on your site, eliminating the risk of them being a blind-spot for the security team. The solution empowers your security team to easily determine the nature of each service, and block any unapproved ones.
Try Imperva’s Application Security Suite today. Start your Application Security free trial now.
Get the latest from imperva
The latest news from our experts in the fast-changing world of application, data, and edge security.