The payment companies that serve micro merchant communities face many inventive fraud schemes, and the fraudsters behind them are getting wiser about how to appear legitimate.
Merchant acquirers have faced "scam storefront" threats for years, but the growth of e-commerce makes it easier for crooks to build a fake virtual storefront. In the absence of a physical storefront or a long transaction history, payment companies and merchant acquirers can look at social network profiles as a way to vet the validity of the business. But increasingly, these too are being faked.
"In Square's early days, they tried to revolutionize micro merchant underwriting by relying heavily on whether the micro merchant had an established social media presence on sites like Yelp. Criminals quickly latched on to this and gamed the system by establishing a false set of social media credentials and history," said Julie Conroy, a research director at Aite Group.
Social networks directly combat these fake accounts by scanning for duplicated data that is copied-and-pasted into every new identity by lazy fraudsters, Conroy said. "However, like so many things in fraud, these sites can't rely exclusively on these tactics," she said.
WePay, a Palo Alto, Calif.-based company that provides the technology tools that enable payments for small merchants, uses its own system to weed out the social profiles that the social networks themselves fail to flag as fraudulent.
"A Facebook profile that's well established would be hard to fake for years," said John Canfield, vice president of risk for WePay.
Any identity method can be falsified, but because social networks are so data intensive, it can be hard for a fraudster to construct one that looks realistic, he said. WePay also looks at other factors when judging the fraud risk of an account.
Etsy, the online arts-and-crafts marketplace that uses social networks to connect buyers and sellers, has had to combat frausters who try to build "fake" merchant profiles, said Nikki Summer, a spokesperson for Etsy, in an email.
Etsy uses rules-based technology to monitor buyer accounts, seller accounts, types of listings and transactions, Summer said, adding the company also has a team review accounts and transactions. "As with other types of fraud, we have a complex network of systems to prevent it," Summer said.
A diverse mix of social network data and information from other sources is key to combating emerging fraud in the electronic micro merchant sector, said Rick Oglesby, a senior analyst at Double Diamond Payments Research.
"The over reliance on any one type of data represents a big risk because most data sources can be spoofed in some way," Oglesby said. "However it's quite difficult to spoof many different types of data at the same time, so the best strategy is to use a variety of data sources, including social media data."
Social media can be useful as an input data source, as long as it's not the only data source being used, Oglesby said.
"Social media networking is not the most effective identity assurance tool as [Facebook, Twitter, and other sites] are constantly battling fake accounts and account takeovers, which would render profiles suboptimal for positive identification during registration," said Al Pascual, director of fraud and security at Javelin Strategy & Research.