Social media – the new playground for fraudsters

Earlier this year Javelin Strategy & Research issued new figures on identity fraud, and unsurprisingly the focus of the research was social media. Social, dating and business networking websites such as Facebook, MySpace, Bebo, and LinkedIn, have rewritten the digital landscape as users create their own profile and share conversations, photos, videos, links and personal information with friends and other online users. Unfortunately this opens the door to fraudsters who use these trusted services to target victims with their scams. Many will be familiar to computer owners: malware; spam; and page hacks; but less so in their new social media guises...

Malware remains by far the most common social networking fraud because members will install user-created applications on their profile pages. These might be used for animation, calendars, photo-feeds or simple games, unfortunately they can often hide spyware, trojans and viruses that members then unknowingly either download to their own computers or post on their profile page. Social networking sites are particularly vulnerable because, by their very essence, they are communities built on trust. Users don't expect to be scammed by other users and that makes them easy targets for fraudsters.

Spamming is another familiar issue, such as the Nigerian 419 advance fee scam, only these are now often able to bypass spam filters by coming through the social network. A great deal of social media spam will originate from the victim, usually because they have installed a malware widget program. Often purported to advance the design of a user's page, such malware will actually be designed to spam all the user’s contacts.

But fraudsters do not only want to use your profile to spam others. They want to spam you. This is achieved with carefully targeted emails using the social media search tools to identify a members' area of interest. In the worst case these details can be collated into master spam lists of people with specific interests that are sold on to other spammers.

In part 2 we will look at the growing threat from social media identity theft...

The value of your phone

Do you know what your phone is worth?  According to recent research, the average value of a recycled phone has topped £100 for the first time.  Good news for people recycling phones and to find out the value of your current handset, you might wish to click here.

However, we suspect that headline figure significantly undervalues the handset in your pocket for a number of reasons:

• Think of all of the data on your phone.  Pictures, messages, emails.  All of this information could potentially be of value to a fraudster, far beyond the actual cash that can be generated from the hardware itself.
• Now think about cross referencing this information with easily accessible public profiles on social networks.  Take a simple example.  Your phone is stolen, it is then used to cross reference you with information held on social networking sites.  This can help locate you and even give a fraudster an idea of what you are doing at any time.  Imagine how useful even a simple phrase like “working away until the weekend” or posting a location status could be?
• So the fraudster could now know your location, your mobile number, the numbers of your contacts, have access to your emails and potentially know your address.  All of this information is invaluable to a fraudster.

In this environment, it is astonishing that up to half of phone users do not use the lock on their phone to secure it, effectively leaving an open channel for fraudsters to access confidential information.

Accentuating the positives, people check that their phones are to hand far more often than they check their wallets, which does at least mean that, should you have a handset stolen, you will discover this quickly.  But by then the damage could be done.

The digital footprint available to fraudsters from an unsecured mobile phone and publically available social networking information is a goldmine to fraudsters and this emphasises the importance of having a joined up approach to personal anti-fraud measures in the 21^st Century.  In the late 20^th Century we were advised to shred important documents.  A far more proactive and resilient approach to private data security is needed in the digital age to secure private information.

Bypass Fraud hits Manila

We were struck by this article in the Manila Standard Today newspaper from the Philippines.  It demonstrates what a huge international issue GSM Gateway or SIM Box fraud really is.

The interesting thing about this story is threefold:

1. It demonstrates a clear connection between international telecommunications fraud and terrorist activity.  Hopefully this will help to put lie to the myth that telecoms fraud is a victimless crime: whilst some people might have little sympathy for mobile operators losing revenues, it’s impossible to sympathise with the illicit gains of this activity funding the Bali bombings and other similar activities.
2. It shows the scale of the problem.  The article quotes a figure for operator losses of $3 billion per annum.  It’s hard to put that into context so the more pertinent figure comes later in the article.  In one scam alone, 22 million fraudulent minutes were sold for $55 million.  That’s one scam, in one country.  With SIM box fraud happening in almost every operator in every country globally, you begin to understand how that $3 billion figure is, if anything, an understatement.
3. It also gives us a view as to why SIM box fraud continues, even after more than 10 years.  To catch and convict the fraudsters requires international co-operation: across governments; law enforcement agencies and the judicial system.  That is not a simple thing to achieve, particularly to convince busy police forces that they can help to reduce international criminal activity through their own actions on the ground.

As the fraudsters get smarter, so the need for anti-fraud detection and elimination become more important.  The mobile operators have to do all they can to eliminate SIM box fraud and continue to raise the issue at the highest levels of government – not only to protect their own revenues but, more importantly, to protect the public from the illicit gains made by telecoms fraud.

New moves to combat handset theft

Our attention was drawn to a story in the media regarding mobile fraud.

First, thirteen operators in Latin America have joined forces to combat mobile handset theft.  This is a positive move that will enable operators in Latin America to share information on stolen handsets with their counterparts to ensure these devices are not reused.  This helps reduce the sell on value of mobile phone and hopefully ensuring that mobiles are therefore a less enticing target for criminals.

A similar system has existed in Europe for some time, so one obvious question is why has it taken the operator community so long to instigate their own scheme. Nevertheless the initiative is welcome.

Talk to anyone that has a phone stolen (and plenty of people do) and one of the major frustrations is not only the loss of hardware but also the data kept on the device.  In the last few years this has become even more of an issue with mobile banking apps, email, private photos and other data all accessible from the handset.  It is pretty astonishing that more than half those with a smartphone do not apply any kind of security to the device.

The different frauds: Interconnect Bypass

Traditionally, mobile fraud was seen as something that took place against the consumer – this is often what generates the headlines.  But there are also a number of mobile frauds that are hidden from the end user. 

They may be inadvertently involved but often users are completely unaware they are participating in a fraud.

Over the next few weeks we will be highlighting some of these frauds and the implications they can have for the mobile industry.

Interconnect Bypass:

Interconnect bypass is also known as GSM Gateway or SIM Box fraud.

When you make a call abroad, a number of different telecoms operators will handle the transfer of this call from home to the other side of the world.  This all happens automatically and within hundredths of seconds, but each company will be paid a small proportion of the call revenue for passing the call over their network.  When the call arrives in the destination country, the local operator will be paid what is called a ‘termination fee’ for passing the call on to the recipient.

The opportunity for fraud comes when the value of the termination fee exceeds the cost of a local mobile to mobile call in a country.  For example, if the termination fee is 10p, but the local operator offers local mobile to mobile calls for 5p a minute, there is a potential money making scheme of 5p per call available if someone can divert calls from the mobile operators traditional routes.

The next question is how to achieve this? This is where the ‘SIM Box’ element of the fraud comes about.  SIM boxes are machines that can house thousands of SIM cards.  If you fill a SIM box with active cards, you can connect and terminate as many calls as you have SIM cards.  And if the 5p per call opportunity exists, you can generate this from every call.

So how do these ‘call terminations’ end up in the telecoms system?  Mobile operators tend to have relationships with other operators through which they ‘buy’ a number of minutes on their network each month.  But there is also an “open market” for the buying and selling of call termination.  This enables operators to sell on excess capacity they have or buy more terminations if they need them in a country.  SIM box fraudsters will bundle together millions of terminations on thousands of routes between countries and sell these on the open market.  These can end up as part of the routes that operators buy to terminate calls meaning that the calls are diverted from the mobile operator in country through a SIM box fraudster.

Why does any of this matter?  For the operators the answer is obvious – they lose money from not terminating as many calls as they would if SIM box fraud did not exist. 

But there are also implications for consumers and even governments.  A consumer would not know that their call is being routed via a SIM box but they might well be aware of a poor connection, interference on the line or calls that cut out.  They will also not receive normal telephony services such as caller line identity. 

For governments the issues are more complex.  SIM Box fraud often funds other frauds, organised crime and exploitation.  Furthermore, governments lose a proportion of the revenues that the operators should be paying them.

SIM Box fraud is one of the most serious frauds for operators.  It is estimated to cost operators billions of dollars a year.  Whilst the public might not recognise it as a consumer facing fraud, its implications are considerable.