Fraud Reduction Intelligence Platforms - Group-IB

Fraud imposes major costs on businesses and individuals globally, with banking, finance, payments, and retail most frequently targeted, and rising exposure across online sectors such as insurance, gaming, telecom, healthcare, crypto exchanges, government assistance, travel, and real estate. Key fraud categories include Account Takeover (ATO), where attackers use breached credentials, credential stuffing, social coercion, malware (info-stealers/Trojans), Adversary-in-the-Middle (AiTM) and session hijacking/token theft, or abuse of legitimate remote-access tools. New Account Fraud (NAF) uses stolen or synthetic identities (including deepfake documents and media) to create convincing accounts for promotions abuse, loans, mule activity, and broader crime, while controls such as AML, KYC, sanctions, and PEP screening help reduce risk. Credit card fraud spans Card-Not-Present (CNP) abuse and physical theft/counterfeiting/skimming. Phishing, vishing, and smishing target victims to surrender credentials or approve transactions, increasingly using LLMs to craft more persuasive messages. Authorized Push Payment (APP) fraud manipulates victims into authorizing step-up authenticated payments.

Fraud Reduction Intelligence Platforms (FRIPs) address these threats by ingesting user behavior, device and transaction telemetry, and threat intelligence to generate real-time risk scores and decisions. FRIPs collect context via JavaScript and SDKs and analyze core signals: identity verification (with liveness detection to counter deepfakes), device intelligence, user behavioral analysis, compromised credential intelligence, behavioral biometrics, and bot detection. The risk engine combines rules and ML to detect anomalies, while analyst dashboards, case management, and reporting support investigations. Use cases include ATO, NAF, credit card fraud, financial crime, and scam prevention, with advanced scam defenses detecting coercion indicators (including concurrent calls/apps), user hesitation signals, and proactive in-flow questioning to disrupt high-loss scams such as “pig butchering.”

• Account takeover tactics include breached passwords, credential stuffing, social media coercion, malware, AiTM, session hijacking/token theft, and abuse of legitimate remote access tools.
• New account fraud is also referred to as account opening fraud.
• Synthetic identity fraud can use deepfake documents, photos, voices, and video, sometimes combined with real identity elements.
• Credit card fraud includes CNP abuse and physical theft, counterfeiting, and skimming.
• Phishing, vishing, and smishing target users through email, calls/voicemails, and SMS to obtain credentials or induce fraudulent transactions.
• APP fraud involves manipulating victims into authorizing transactions, including those requiring OTPs, authenticator codes, or push approvals.
• “Pig butchering” scams can progress over months and may include fronting small gains to induce victims to commit more funds.
• FRIPs ingest behavior, device data, transaction telemetry, and threat intelligence to produce real-time risk scores and decisions.
• Core FRIP signal categories include device intelligence, user behavioral analysis, compromised credential intelligence, behavioral biometrics, and bot detection.
• Some countries mandate banks and financial institutions to help prevent customers from being scammed.

• “Fraud is a major cost to businesses and individuals worldwide.”
• “Fraudsters are constantly varying their techniques and targets.”
• “Many are leveraging Artificial Intelligence (AI), specifically forms of AI based on Large Language Models (LLMs), to write more convincing messages to increase their chances of success.”
• “Scams are increasing in frequency and severity.”
• “Detecting scams can be complex and difficult, and is not foolproof, since fraudsters are constantly changing their tactics.”
• “The crux of a FRIP is the risk engine.”
• “Some FRIP solutions allow for granular bot management, as not all bots are bad.”
• “Unsupervised ML algorithms are often used for outlier detection, and supervised ML can speed up classification.”
• “There are few vendors who have top-notch functionality across all six FRIP component areas.”
• “Banks, fintechs, payment processors, and card issuers need to be mindful of architectural and deployment considerations throughout the procurement process.”