jamie-hughes

At Fingerprint, Jamie solves EMEA customers' device intelligence challenges at each stage of the digital lifecycle (from ATO to credential stuffing to MFA friction and more) by quickly discerning their technical needs and demonstrating how Fingerprint can help them stop fraud and grow revenue. Jamie was previously a lead sales engineer at Auth0 and Beyond Identity. His years of experience in both the CIAM and device intelligence space enable him to help customers seamlessly reduce fraud and improve the user experience by combining best of breed identity and security solutions.

Solutions Engineer at Fingerprint

Jamie Hughes

Changing the conversation from “detected” to “prevented”… stop identity fraud at the source.

**TL:DR:** Digital identities have emerged as a crucial aspect of an online existence. From buying a product online, logging into a streaming service, or communicating with friends via social media, digital identity is a fundamental component in each of these activities. At the same time, companies must ensure digital identities are safe from malicious actors without adding friction for trusted users. This blog outlines how device intelligence can play a crucial role in protecting digital identities from fraud and optimizing the user experience.

## The Role of Digital Identity

A digital identity encompasses the data and information that represents an individual, organization, or device online. It plays a pivotal role in how a person interacts, transacts, and takes advantage of the digital world.

Successful validation of a digital identity enables one to perform associated actions and transactions for the service being used, such as updating account information or authorizing a banking transaction. However, malicious actors target these digital identities to commit fraudulent transactions or steal valuable data, which has left many users lacking trust and confidence in the security of their online accounts.

## Types of Digital Identity Fraud

* New Account Fraud New account fraud (or fake accounts) occurs when users sign-up more than once to receive one-time bonuses or promotional offers as a reward for becoming an account holder but with an ulterior motive. 
* Account Takeover (ATO) Account takeover occurs when malicious actors steal login credentials to access someone else's account. Once fraudsters have access, these accounts can be used to conduct various activities, such as transferring funds or accessing personal data.
* Social Engineering Social engineering is a deceptive and manipulative technique used by cybercriminals to gain unauthorized access to sensitive information; instead of relying on technical vulnerabilities, social engineering preys on people's trust, curiosity, and willingness to help. It often takes the form of phishing emails, pretexting phone calls, or impersonation tactics, tricking individuals into divulging confidential data or performing actions that compromise security. In September 2022, Uber's private network was [breached by a teenage hacker](https://fingerprint.com/blog/why-social-engineering-attacks-are-successful-with-technical-staff/) who used social engineering methods to gain secure information from an engineer.

## What about Multi-Factor Authentication (MFA)?

Product teams are conscientious about adding additional layers of friction to secure user accounts, fearful that they will abandon the transaction or sign-up process, resulting in a loss of revenue. This typically means that MFA is not mandated and is optional for the user. Even when users opt-in or MFA is enforced, companies are still relying on weak or outdated MFA methods, such as SMS/email one-time password (OTP) or cookie-based MFA, which can easily be phished or spoofed.

Strong MFA is an effective defense layer to help secure user accounts, given how easy it is to steal a user's password. However, many companies are challenged with how to make accurate and context-based MFA decisions that reduce friction for genuine users. Most forms of context-based authentication rely on IP addresses or cookies, which on their own are not stable or reliable enough to ensure the trust required to skip the MFA stage.

As a result of the above challenges, most companies fall back to challenging all authentication transactions with MFA, resulting in unnecessary user friction and rising SMS OTP costs.

## How Device Intelligence Protects Accounts

Accurate device intelligence recognizes trusted users from bad actors. Generating an accurate and stable device identifier during account creation or the next trusted login results in the user having a list of “trusted devices”. If an authentication attempt is initiated from a “new” device not within that list, the attempt can be blocked or challenged with a strong MFA factor. When the actual user returns and authenticates from a “trusted device,” you have a high degree of confidence it is actually the owner of the account and can, therefore, skip any additional friction, which leads to an enhanced, seamless user experience.

Capturing device intelligence data for each account creation request allows you to make smart decisions on whether or not to allow account creation. During the creation process, if the device identifier captured already exists for a registered user, depending on your allowed account-to-device ratio, you can block or allow the sign-up request. 

Companies who are using device intelligence are able to block malicious actors from using their services by adding them to a block list, as they can easily identify when they have attempted to create multiple fake accounts (for the purpose of promo abuse or [SMS pumping](https://fingerprint.com/blog/sms-pumping-fraud/)) or attempted account takeover attacks using their device/browser or browser automation tools (bots).

## Why Fingerprint with Auth0

Fingerprint was built to help companies solve complex identity & fraud-based challenges. Fingerprint is an API-based solution, which makes it very easy to plug into Auth0’s well-known [Extensibility](https://www.okta.com/customer-identity/extensibility/). 

Using Fingerprint in addition to [Auth0 Security](https://www.okta.com/customer-identity/login-security/) modules layers in an extra level of defense to help keep your Auth0 tenant safe from synthetic account creation and account takeovers. This is achieved by adding Fingerprint’s unique device fingerprint to the Auth0 user profile for each user at signup or a trusted login. Fingerprint’s visitor identifier is 99.5% accurate at identifying returning visitors; it can then be used to evaluate the identity of the device that is attempting to authenticate. 

See the example flow below for preventing account takeovers: 

![Auth0 Security](https://images.ctfassets.net/23aumh6u8s0i/4P8cG3n0TfGZAAiQIn9yZn/150b48b1b176d0bd24b7e19ad06663a4/use-case.png)

In addition to device identification, Fingerprint also provides [Smart Signals](https://fingerprint.com/products/smart-signals/), such as bot detection, VPN detection, and browser tampering detection, that pinpoint indicators of fraud from anonymous traffic. All of these Smart Signals can be evaluated in Auth0’s extensible [Actions](https://www.okta.com/customer-identity/actions/) within the sign-up or login flows. 

You can find additional details and technical integration documentation in the Auth0 Marketplace [Fingerprint listing](https://marketplace.auth0.com/integrations/fingerprint-pro). 

## Conclusion

One of the key use cases for implementing a device intelligence platform is to prevent fraud, and as discussed above, digital identities are prime targets for types of fraud, such as signup abuse, account takeover, and social engineering. 

Unique, stable, and accurate device identifiers from Fingerprint recognize good users from bad users and block the activity associated with bad actors as a result. Accurately identifying the devices of your good users and incorporating them with Auth0 Actions allows you to make smart decisions to keep accounts secure with no additional friction. 

To get started, sign up for your free Fingerprint trial [here](https://dashboard.fingerprint.com/signup) and check out the Auth0 Marketplace [Fingerprint listing](https://marketplace.auth0.com/integrations/fingerprint-pro) for more details on how these solutions work together to help you stop fraud without friction.

Leveraging Device Intelligence to Protect Digital Identities

auziros:jeana-tahnk

Jeana has been in the tech industry for 15+ years, both as a communications professional and writer. As Director of Global Communications at Auth0, she works with her internal team and external agencies to amplify the company's visibility worldwide and establish its leadership in the identity industry. When she is not working, she can most likely be found on a field watching one of her three kids playing sports, or cleaning up after her one-year-old retriever who chews everything.

Senior Director, Global Communications

Jeana Tahnk

New feature adds a dedicated security team and support for multiple languages to prevent fraudulent access with stolen credentials

**BELLEVUE, Wash. – February 9, 2022 – [Auth0](https://auth0.com/)**, a product unit within [Okta](https://www.okta.com/) (NASDAQ: OKTA), today announced the general availability of [Credential Guard](https://www.auth0.com/breached-passwords#credential-guard), a new security feature that helps enterprises prevent account takeover attacks by detecting and resetting stolen passwords faster. Credential Guard upgrades Auth0’s existing breached password detection with a dedicated security team, and support for more than 35 languages and 200+ countries and territories to reduce breach detection time.

Credential Guard gives application builders the tools to help secure their apps and to help protect their users from bad actors logging in with stolen credentials. Auth0’s breached password detection enables organizations to automatically screen for stolen passwords, and alert the user, prompt for additional verification, or block access by forcing a password reset. Credential Guard adds even more visibility and speed with a dedicated security team that infiltrates criminal communities to gain access to otherwise unavailable breach data.

Auth0’s security team conducted an internal test on 100,000 random usernames, and found that the ability to detect breached passwords (breach detection efficacy) increased by a minimum of 250% when using Credential Guard compared to an automated detection solution alone.

“The goal with Credential Guard is to help organizations detect breaches as soon as they happen, to reduce the risk to the business and its users,” said Shiv Ramji, Chief Product Officer at Auth0. “Traditional web scanners and scrapers rely on breach data being made public, which can be months or even years after the initial breach. Credential Guard enables security teams to shrink that gap, and better protect their customers’ digital identities on a global scale.”

Account takeover attacks with stolen credentials, targeting everything from sensitive healthcare data to loyalty points, are one of the most common and costly cyber threats. Verizon’s 2021 [Data Breach Investigations Report](https://www.verizon.com/business/resources/reports/dbir/) (DBIR) found that 89% of web application breaches involve some sort of credential abuse (use of stolen credentials or brute force). Reusing passwords across sites increases the risk of an attack and makes it more difficult for organizations to prevent fraudulent access to user accounts. With Credential Guard, organizations can secure their apps and protect their users during the login process by detecting and resetting exposed passwords before they fall into the wrong hands.

Credential Guard is available as an Enterprise Add-on for existing Auth0 customers. For more information, please visit the [Auth0 blog](https://auth0.com/blog/detect-breached-passwords-faster-with-auth0-credential-guard/).

<include src="asides/AboutAuth0" />

## About Okta

Okta is the leading independent identity provider. The Okta Identity Cloud enables organizations to securely connect the right people to the right technologies at the right time. With more than 7,000 pre-built integrations to applications and infrastructure providers, Okta provides simple and secure access to people and organizations everywhere, giving them the confidence to reach their full potential. More than 14,000 organizations, including JetBlue, Nordstrom, Siemens, Slack, Takeda, Teach for America, and Twilio, trust Okta to help protect the identities of their workforces and customers.

### Media Contacts

Global Communications 
Auth0 
[press@auth0.com](mailto:press@auth0.com) 

### Investor Contact

Investor Relations 
[investor@okta.com](mailto:investor@okta.com) 

 
<div class="alert alert-info alert-icon">
 These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at <a href="https://www.okta.com/agreements/">okta.com/agreements</a>. 
</div>

Auth0 Credential Guard Detects Breached Passwords Faster to Prevent Account Takeover

df6c864847fba9687d962cb80b482764?size=200 avatar

df6c864847fba9687d962cb80b482764?size=200

Martin Gontovnikas, a.k.a Gonto, is a software engineer at heart who moved to the ‘dark side’ and became VP of Marketing at Auth0. He considers himself lucky to have found a way to combine his two passions and apply his engineering thinking model to marketing. Gonto’s analytical thinking is a huge driver of his data-driven approach to marketing strategy and experimental design. He is based in the Bay area, and in his spare time, can be found eating gourmet food at the best new restaurants, visiting every local brewery he can find, or traveling the globe in search of new experiences.

Former SVP of Marketing and Growth at Auth0

Martin Gontovnikas

Retailers are embracing eCommerce but are vulnerable to fraudsters impersonating real users.

Holiday shopping looks a lot different this year. As a result of the pandemic, shoppers are avoiding brick-and-mortar stores and ordering online, with [eCommerce sales up 37%](https://www.digitalcommerce360.com/article/quarterly-online-sales/) over 2019. Unfortunately, the eCommerce boom has created a similar spike in eCommerce fraud. [One study found](https://www.digitalcommerce360.com/2020/07/27/the-cost-of-fraud-is-up-7-for-us-merchants/) that in 2020, mid-sized to large merchants experienced 14% more fraudulent transactions per month than the year before.

These dueling forces put retailers in a difficult position: they need to provide eCommerce options to customers without exposing themselves to attack. Retailers can balance these needs by putting strong fraud-prevention tools in place to maximize their eCommerce trade while locking out fraudsters.

## Bot-Based Fraud Is Rampant in Ecommerce 

Retailers trying to guard against cybersecurity threats must first understand what those threats are. This list is constantly evolving, and in 2020, while there are several types of attacks, most of them use armies of automated bots.

In a [2020 survey](https://kount.com/wp-content/uploads/2020/10/Bot-Landscape-and-Impact-Report-2020-Kount.pdf) from cybersecurity company Kount, 81% of businesses reported that they dealt with malicious bots often or very often, and 25% reported that a malicious bot attack cost their organization over $500,000.

Bot attacks on retailers can take multiple forms. In one variation, armies of bots buy up all the inventory for in-demand items for later resale at a markup. For years, that’s been a popular trick for coveted concert tickets and sneakers, but it’s equally effective for hot-ticket gift items. The risk for retailers is that customers will come to your site looking for a product, and when you don’t have it, they’ll switch to your competitors.

Many bot attacks use identity as their vector, meaning they break in through the login box by impersonating legitimate users. [In credential stuffing](https://auth0.com/blog/what-is-credential-stuffing/) attacks, hackers take user login credentials that were stolen in one data breach and use them to break into other sites. Credential stuffing attacks have become much more widespread in recent years because people tend to reuse passwords, and [billions](https://www.wired.com/story/collection-leak-usernames-passwords-billions/) of these stolen credentials are currently circulating on the dark web.

Ecommerce retailers are at particular risk of these attacks, especially with the booming popularity of “buy online, pick up in store” (BOPIS). In the past, fraudsters had to get stolen merchandise mailed to them, increasing the likelihood that the transaction would be stopped or they would be caught. But with curbside delivery, they can order goods and pick them up before anyone catches on.

Even if bot attacks aren’t successful in conducting fraudulent transactions, they can still crash your website by flooding it with requests. [Auth0’s research](https://auth0.com/blog/auth0-reveals-50000-credential-stuffing-attempts/) has found that in a credential stuffing attack, a site’s traffic can spike by as much as 180-fold.

![Critical Tools in the Fight Against Ecommerce Fraud](https://images.ctfassets.net/23aumh6u8s0i/5CBZ47YCilUVHG1F0gf9om/a5893de32934cc5d60a561a9282d2217/prevent-ecommerce-fraud-separator)

## Critical Tools in the Fight Against Ecommerce Fraud

Fortunately for retailers, there are effective methods to deter bots without creating unnecessary obstacles for legitimate users. Since most eCommerce fraud takes the form of [broken authentication attacks](https://auth0.com/blog/what-is-broken-authentication/) &mdash; meaning that fraudsters impersonate legitimate users&mdash;the fixes all relate to being able to more accurately verify user identities.

### MFA

[Multi-factor authentication (MFA)](https://auth0.com/docs/mfa) demands that users prove they are who they claim to be by providing an additional form of verification beyond the classic username-password combination. Common MFA methods include one-time codes sent to a user’s email address and [biometric scans](https://auth0.com/blog/3-critical-trends-in-biometric-authentication-in-2019/), such as fingerprints. While MFA is the single most reliable defense against identity-/authentication-based attacks, it is not a silver bullet. If retailers want to defend against automated attacks, they have to think about security in layers. 

In 2019, [NIST started recommending](https://auth0.com/blog/why-nist-recommends-mfa-to-fight-ecommerce-fraud/) that retailers implement MFA to fight eCommerce fraud, but adoption has still been slow. That’s partly because retailers worry that MFA will introduce too much friction and will make customers abandon their carts. [But MFA standards are constantly evolving to be more seamless and secure](https://auth0.com/blog/auth0-introduces-adaptive-mfa). For instance, [Microsoft recently told](https://www.zdnet.com/article/microsoft-urges-users-to-stop-using-phone-based-multi-factor-authentication/) its customers not to use SMS as an MFA delivery mechanism because cell phone lines are vulnerable to multiple forms of attack. (They recommend [hardware keys as the least susceptible to attack](https://auth0.com/blog/fido-security-key-support-comes-to-auth0/).)

### Attack Protection

You want to find out about eCommerce fraud before you get a call from a customer’s bank asking you to reverse fraudulent charges. To stop these transactions from ever taking place, you need tools that automatically flag suspicious behavior.

**Brute force protection** is one such tool, which prevents bot armies from overwhelming your site or app with login attempts. Enabling brute force protection locks out IP addresses after a certain number of failed login attempts.

[CAPTCHA](https://auth0.com/blog/captcha-can-ruin-your-ux-here-s-how-to-use-it-right/) (and its assortment of bot-catching descendants) helps to lock out bots at the account creation stage by having human users prove “I’m not a robot” and, occasionally, tricking bots into proving that they are.

**Breached password protection** protects against credential stuffing attacks by monitoring databases of compromised credentials and alerting users if they need to change their passwords.

It’s important to note that none of these technologies are foolproof, and none are designed to work in isolation. Some hackers have learned how to spoof fake IP addresses to mask brute force attacks. CAPTCHA always struggles to stay ahead of sophisticated bots that can mimic human behavior. And while retailers can force users to change their passwords in the event of a breach, they can’t change the underlying problem of password reuse. Even MFA, the bedrock of a sensible security strategy, works only if you convince or compel your customers to sign up for it.

But even though there’s no single silver bullet to prevent eCommerce fraud, implementing these features together offers superior protection. Scammers generally seek out the path of least resistance, and when you have all these tools, you don’t present your business as a soft target. 

![Prevent Fraud by Updating Customer Access Controls](https://images.ctfassets.net/23aumh6u8s0i/1MzswDFUmttHgwNE85rxY2/cc3066d34b3cc682703051845d44b7fc/prevent-ecommerce-fraud-separator-2)

## Prevent Fraud by Updating Customer Access Controls

We’ve talked about the threats to eCommerce retailers and the tools to protect against them, so the question now is, how do you go about putting those tools in place? For many retailers, the solution is to partner with a third-party [customer identity and access management (CIAM)](https://auth0.com/blog/what-is-ciam/) provider. That’s because building fraud-preventing tools in-house is time-consuming for any business, and it’s out of reach for most small to medium-sized retailers. But sticking with the simple login solution you’ve had in place for years is clearly no longer an option.

But as we’ve discussed, all fraud-prevention tools are not created equally. Here’s what retailers should look for when analyzing potential CIAM partners.

### Customizable MFA

There’s no reason to challenge every loyal customer to prove their identity every time they make a purchase, so retailers need [step-up or adaptive MFA](https://auth0.com/blog/what-is-step-up-authentication-when-to-use-it/), which requests additional credentials only in the event of suspicious or high-risk behavior. For example, you may want to verify a customer’s identity if they log in with a new device or place an order above a certain dollar amount.

![Adaptive MFA](https://images.ctfassets.net/23aumh6u8s0i/1NOHOVPjLZsNsuklb3Cw2e/c5ac893b034e2bf9df235deacb04966f/adaptive-mfa-graphic-1)

Auth0’s Adaptive MFA analyzes every login attempt and assesses its risk level. This assessment included a user’s IP reputation, whether the login is coming from a known device, or whether its geographic location indicates so-called “impossible travel.”, Based on these factors, it then determines whether the login can proceed uninterrupted, triggers MFA, or blocks the account altogether.

![Customizable MFA](https://images.ctfassets.net/23aumh6u8s0i/7CKjaRixRDYnypIFL2cTiA/85fd1e38bda162575c1fdd7016738526/use-adaptive-mfa)

### Comprehensive Attack Protection

Likewise, retailers need anomaly detection that lets them combine the strongest tools available to deter scammers. [Auth0’s Attack](https://auth0.com/docs/anomaly-detection) Protection offers an arsenal with which businesses can protect themselves. That includes Bot Detection, which forces suspicious logins to take a CAPTCHA test. Suspicious IP Throttling and Brute Force Protection block IP addresses from trying to break into user accounts. And Breached Password Protection notifies customers if a user’s credentials have been compromised in a known data breach.
Lets customers implement CAPTCHA and enable brute force protection, and notifies them about breached passwords.

![CAPTCHA](https://images.ctfassets.net/23aumh6u8s0i/7KwQQhPVnPr15lr3S73mdz/dc8846b93ba9384500c0bc155928ad84/attack-protection-04)
Here’s a look at Auth0’s Attack Protection tools.

### Developer-friendly documentation and support

Finally, in order to put safeguards in place as quickly and easily as possible, retailers should look for a CIAM solution that provides a high level of documentation and support. While many identity providers have similar suites of tools and services, the time it takes to implement them can vary widely depending on what kind of instructions they give to developers. Having clear documentation and customer support is particularly important to smaller businesses, who don’t have dedicated authentication professionals on their teams.

## An IAM Partner Can Get You Holiday-Ready

It’s been an indisputably challenging year, but retailers have risen to the occasion by embracing eCommerce solutions. And as 2020 comes to a close, it’s increasingly clear that eCommerce isn’t just a stopgap solution for the pandemic &mdash; it’s the new status quo. That means that updating security is a worthwhile investment for the entire coming year, not just the holiday rush. To learn more about how state-of-the-art identity can protect your customers and your business, [reach out to the team at Auth0](https://auth0.com/en/contact-us).

<include src="asides/AboutAuth0" />

How Retailers Can Prevent Ecommerce Fraud This Holiday Season

MFA adoption urged to fight e-commerce fraud

Fraudulent purchases and data breaches are an incredibly costly problem for online retailers, and they are on the rise. A [ThreatMetrix report](https://www.signifyd.com/blog/2018/06/26/ecommerce-fraud-grow-threatmetrix/) found that in the first quarter of 2018, the growth of e-commerce fraud attempts outpaced the growth of overall e-commerce transactions by 83%.

According to the latest data from [IBM](https://digitalguardian.com/blog/whats-cost-data-breach-2019), the average cost of a data breach is currently $150 per compromised record, and the costs of data breaches will only increase with the passage of new privacy legislation.

For business leaders concerned about protecting profits and customer data from attacks the National Institute of Standards and Technology’s (NIST) [recent guidance for e-commerce businesses](https://www.nccoe.nist.gov/projects/use-cases/multifactor-authentication-ecommerce) to implement multi-factor authentication (MFA) can offer some relief.

<include src="TweetQuote" quoteText="According to the latest data from IBM, the average cost of a data breach is currently $150 per compromised record"/>

When deployed properly, MFA is one of the strongest defenses against fraudulent purchases and administrative data breaches, yet e-commerce has been [slow to adopt it](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf). [Experian’s research](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf) found that only 44% of businesses currently employ MFA, which they attribute to concerns about it negatively impacting customer experience.

Yet modern MFA solutions allow businesses to balance [security and convenience](https://auth0.com/blog/security-vs-convenience/). The NIST’s guidelines offer actionable advice for e-commerce to catch up to current security standards and what to look for when embracing MFA.

In this piece, we’ll go over what MFA is, how the NIST defines sound MFA solutions, and how e-commerce businesses can effectively implement MFA while balancing their other business needs.

## MFA in a Nutshell

In the simplest terms, [MFA](https://auth0.com/learn/get-started-with-mfa/) is a protocol for determining if individuals using your system are who they claim to be. MFA demands more than one (usually two) types of credentials:

* Something someone knows (like a password or their mother’s maiden name)
* Something they have (such as a phone on which they can receive a one-time SMS code)
* Something they are (biometric ID such as a fingerprint or facial scan)

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

A business using MFA can request additional verification at any point in a user’s session: login, purchase, or when navigating within a site or app.

Developers generally consider MFA to be the safest form of authentication, but there are a wide variety of MFA solutions available, and [they are not all created equally](https://auth0.com/blog/is-multifactor-authentication-the-best-way-to-secure-your-accounts-myths-and-reality/).

Finally, while most of us are familiar with MFA from our own online shopping experiences, it isn’t just for end users. The NIST emphasizes that requiring MFA for e-commerce admins is crucial for preventing data breaches rising from admin phishing attacks.

## Why E-Commerce Needs MFA

The continually-evolving digital threat landscape makes e-commerce businesses particularly vulnerable. As the NIST’s guide explains, 2015 saw the introduction of security improvements to credit cards and in-store terminals. These improvements reduced traditional credit card fraud but had the unintended effect of pushing more theft online.

E-commerce businesses are vulnerable to several types of attack, including [brute force attacks](https://www.scmagazineuk.com/brute-force-dictionary-attacks-400-percent-2017/article/1473168), [phishing](https://www.vadesecure.com/en/ecommerce-security-issues/), and [credential stuffing](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), which the NIST gives particular focus to in its guidelines.

In credential stuffing, user IDs and passwords stolen from one site are used to log in to another, preying on the tendency of users to recycle the same few passwords. Credential stuffing is arguably the [most dangerous and prevalent](https://blog.barracuda.com/2019/04/02/is-2019-the-year-credential-stuffing-dominates-the-threat-landscape/) security threat of 2019. An [Akamai report](https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf) found that retail was the single most vulnerable vertical for this attack, with over 10 billion credential abuse attempts in 2018.

<include src="TweetQuote" quoteText="Developers generally consider MFA to be the safest form of authentication"/>

Credential stuffing is difficult to combat, and will likely worsen as hackers develop more sophisticated bots that can combine data from multiple breaches in their attacks. Successful credential stuffing can lead to account takeover. For customers, account takeovers can result in fraudulent purchases being shipped to strangers.

For admins, they can lead to even [more serious data breaches](https://www.zdnet.com/article/anatomy-of-the-target-data-breach-missed-opportunities-and-lessons-learned/).

So how do you know if your current authentication system is at risk for these types of breaches? NIST lists the following common traits of vulnerable systems:

* Allow multiple incorrect logins without account lockouts
* Purchasers have reused the same password on multiple systems
* Accept weak passwords

If any of those describe your company’s authentication system, implementing MFA can quickly patch those leaks to project you and your customers while you strengthen your identity solution.

## What Makes a Good E-Commerce MFA Solution

MFA is open-source technology, but there’s a great deal of variance between implementation methods. NIST specifies a few “must-haves” for MFA solutions to protect your business effectively.

* **Customization**: Not every transaction should require additional authentication, so a good MFA solution allows you to tailor your system to your needs. NIST lists the most common parameters to trigger verification as cost threshold (a purchase above a certain dollar amount) and risk threshold. You can customize your definition of risk any number of ways, such as a customer using a new shipping address, paying with a new card, buying an item commonly associated with fraud, or making a purchase at an unusual time of day.
* **Require MFA for admin tasks**: A criminal with fraudulent admin credentials can do incalculable damage to your business, so NIST recommends that any administration activity requires verification.
* **Dashboards for suspicious activity**: The NIST report specifically mentions that e-commerce businesses should “enable system-activity situational awareness by providing dashboards that display account lockout and authentication activity.” Auth0’s dashboard does just this: giving you a high-level look at your users, allowing your admins to spot patterns and being aware of new threats as they evolve.

![Auth0 Dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

Auth0 also offers [breached password protection](https://auth0.com/docs/anomaly-detection), which tracks security breaches at third-party sites and flags potentially stolen credentials. Taken together, these features are a proactive way for e-commerce teams to detect and prevent fraudulent transactions.

## How an IDaaS Partner Manages Your MFA Needs

Many e-commerce executives have been slow to push for MFA because they feared alienating customers with irritating demands for credentials. However, online shoppers are increasingly reassured rather than irritated by such measures.

In [Experian’s 2018 Global Fraud and Identity Report](https://www.experian.com/assets/decision-analytics/reports/global-fraud-report-2018.pdf), 66% of surveyed customers reported that they “like all the security protocols when I interact online because it makes me feel protected." Yet customer tolerance isn’t infinite, and in the same survey, a third of customers reported that security demands caused them to make fewer online purchases.

E-commerce businesses have to find an MFA solution that provides both effective fraud prevention and positive user experiences. By partnering with an identity management platform like Auth0, you can reap the benefits of increased security without taxing your developers or frustrating your customers.

* **Balance of ease and customizability**: Auth0’s MFA solutions can be turned on by flipping a single toggle, so you don’t have to wait weeks or months for your developers to secure your system. However, Auth0 also gives your team the freedom to write customized rules for MFA around any of the parameters discussed above.
* **Reduced friction for users**: Auth0’s MFA lets developers choose which factors for authentication suit their needs, whether that’s SMS, a token generator app, or Guardian, which lets users authenticate via a push notification.This allows users to utilize the MFA method they want while maintaining proper security practices.

![Multi-Factor Authentication Auth0](https://images.ctfassets.net/23aumh6u8s0i/4VTHSpJTsDhLuAyznJK2BE/27185cb5d398e5f1dc609141c781d57b/mfa-auth0)

Guardian doesn’t require your customers to install an app or even have a smartphone, so it’s a truly universal solution that meets both security and UX needs.

* **Evolves with and for you**: Keeping on top of current security standards can be a full-time job. But it’s not your full-time job, so outsourcing MFA to a highly respected and [accredited IDaaS partner](https://auth0.com/blog/the-real-roi-of-auth0-part-3-security/) like Auth0 can provide peace of mind to your customers and yourself.

## NIST Guidance Can Offer Immediate Protection

Though NIST’s guidelines are voluntary suggestions, their very existence points to the urgent need for MFA adoption to protect online shopping as a whole. As the guide says: “fraud impacts the e-commerce ecosystem by decreasing purchaser confidence...and by increasing costs to offset the e-commerce fraud.”

Business leaders are under pressure to protect their customers from identity-based attacks without sacrificing revenue through excessive security measures. Finding this balance requires expert help, so reach out to an [Auth0 resource](mailto: sales@auth0.com) to talk about how you can put NIST advice into practice.

<include src="asides/AboutAuth0" />

---

Why NIST Recommends MFA to Fight E-Commerce Fraud

Identity management solutions will help protect your platform and end users.

Cross-industry fraud is on the rise. According to the fourth annual [LexisNexis Fraud Mitigation Study](https://risk.lexisnexis.com/insights-resources/research/2018-fraud-study), an increasing number of organizations are encountering fraud that has moved beyond its initial source and is causing damage in multiple arenas.

In 2018 89% of fraud professionals reported cases of cross-industry fraud — a five-point jump over the 84% who reported the same in 2017.

Hackers target particular industries — including insurance, financial services, health care, and even travel — that deal with a high volume of sensitive customer information. In many cases, companies in these spaces don't yet have adequate security protocols in place. As one example, [less than half of insurance CEOs](https://home.kpmg/content/dam/kpmg/ae/pdf/closing-the-gap.pdf)_ believe their teams are fully prepared for a cybersecurity event.

Once hackers obtain information from these targets, they’re able to use it to gain access to other higher-value accounts or platforms and conduct malicious activity across organizations.

This piece highlights the many, complex risks of cross-industry fraud — and offers solutions to help business leaders secure their organizations and end users.

<include src="TweetQuote" quoteText="In 2018 89% of fraud professionals reported cases of cross-industry fraud — a five-point jump over the 84% who reported the same in 2017."/>

### Cross-industry fraud can have extraordinary effects on end users

The uptick in cross-industry fraud presents a cascade of problems for company management. It's not always something they can isolate and solve for independently.

To start, these types of breaches often have extraordinary, negative effects on end users — relationships business leaders are trying hard to nurture. The ripple effect that occurs when identifying information stolen and used in cross-industry fraud makes it very difficult to detect where the breach originated and where it could move next.

This situation is further complicated by the fact that [83%](https://www.cyclonis.com/report-83-percent-users-surveyed-use-same-password-multiple-sites/) of people use the same password for multiple sites. In many cases, hackers who obtain a username and password are able to move quickly by recycling them.

[Credential stuffing](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/) and [credit card skimming and shimming](https://www.experian.com/blogs/ask-experian/shimming-is-the-latest-credit-card-scam/) are two primary means by which hackers take sensitive data from its initial source and use it across numerous platforms.

In our [prior post](https://auth0.com/blog/credential-stuffing-is-a-persistent-threat-to-your-users/), we described how cyber thieves use credential stuffing for a mass of login attempts at once. While these attacks are only successful about [3%](https://qz.com/1329961/hackers-account-for-90-of-login-attempts-at-online-retailers/) of the time, they quickly add up. According to Quartz, [91%](https://qz.com/1329961/hackers-account-for-90-of-login-attempts-at-online-retailers/) of login attempts on e-commerce sites are credential-stuffing attacks, followed by 60% on airline sites.

->![Share of login attempts that are credential stuffing attacks](https://images.ctfassets.net/23aumh6u8s0i/3ajfvBhlRdq2fXi0KRDXxD/c239e52657b2f8e9a556b5cfd0d2272c/login-attempts)<-

[_Image via Quartz_](https://qz.com/1329961/hackers-account-for-90-of-login-attempts-at-online-retailers/)

[Credit card skimming and shimming](https://www.experian.com/blogs/ask-experian/shimming-is-the-latest-credit-card-scam/) (a newer technique designed to lift information from chip cards) is another method. When consumers make a purchase or visit an ATM, hackers are able to obtain credit card information and then sell that information on the dark web or make fraudulent purchases in numerous other industries.

In all sectors, cross-industry fraud brings with it a hefty price tag. In the same [LexisNexis study](https://risk.lexisnexis.com/insights-resources/research/2018-fraud-study), 80% of organizations reported that cross-industry fraud cases took a moderate to high financial toll on their businesses; more than half said they experienced extreme or high financial impact.

In turn, these unexpected costs can translate into an increase in the price of services for customers — a vicious cycle that punishes them rather than the hackers who are causing the problems in the first place. When you're trying to build trust, fraud in any form — even if it originated elsewhere — can do you harm.

### Improving identity management to reduce cross-industry fraud

As cross-industry fraud continues to increase, it’s up to organizations to put security measures in place to protect their data and their consumers from these sorts of attacks.

**1. CLOSELY MONITOR ALL USERS WITHIN YOUR SYSTEMS**

A recent survey unveiled that [62% of employees](https://www.esecurityplanet.com/network-security/62-percent-of-employees-have-access-to-data-they-shouldnt-be-able-to-see.html) recognize that they have access to company data they believe they shouldn’t see.

One of the best ways to protect business-critical information from unwanted eyes begins with implementing better [user management](https://auth0.com/user-management). Cutting-edge user management tools and processes will help you exercise greater control over who’s able to access business-critical information.

->![Auth0 Dashboad view](https://images.ctfassets.net/23aumh6u8s0i/3iyjcUTaJiDXqwSgFTDkMn/e621d2e4bb54280c4f9377850815ab53/auth0-dashboard)<-

A solution like [Auth0](https://auth0.com/), for example, allows your admins to closely track all of the users working with the company's systems and flag erratic behaviors, such as multiple failed login attempts. These admins can also grant permissions for specific users to access more sensitive data — while restricting the permissions of others.

**2. INVEST IN ANOMALY DETECTION TO IDENTIFY SYSTEM-WIDE THREATS**

It can take a long time to detect security breaches or threats. [According to the Ponemon Institute](https://securityboulevard.com/2018/07/survey-finds-breach-discovery-takes-an-average-197-days/), discovery takes an average of 197 days, which exposes your organization and your users to many vulnerabilities.

Having a solution like [anomaly detection](https://auth0.com/docs/anomaly-detection) in place can alert you to unusual activity immediately.

->![Anomaly Detection view on Auth0](https://images.ctfassets.net/23aumh6u8s0i/1E5ZE61rzHUyv4Bj4ZbcRE/c370d6c571de65fb55944b2dcfaf0602/anomaly-detection-view)<-

Auth0’s anomaly detection feature allows for brute-force protection and breached password detection, both of which you can easily turn on and customize from the main Dashboard view.

Brute force protection mitigates the risk that a hacker will push their way into your system by repeatedly iterating on a password until s/he finds the correct match, and breached password detection notifies your users when their credentials have been leaked by a third party data breach. In both scenarios, admins can block access and investigate the situation further.

<include src="TweetQuote" quoteText="Auth0’s anomaly detection feature allows for brute-force protection and breached password detection."/>

**3. DO AWAY WITH PASSWORDS**

While the burden of identity protection falls largely on a company’s IT team, some of the effort rests with your users and customers. In an ideal world, they’d [update their passwords when prompted](https://www.pcmag.com/news/362566/35-percent-of-people-never-change-their-passwords) (according to a new study by The National Institute of Standards and Technology) to ones that are longer and harder-to-guess.

Yet when users do make password changes, they’re often just slightly altered versions of their previous passwords (think something like “Password1” instead of just “Password”) — which leaves them just as vulnerable to attacks. [A new report from SplashData](https://www.securitymagazine.com/articles/89694-the-top-100-worst-passwords) shows that the two most popular passwords in 2018 were simply “123456” and “password” — essentially an open door for cyber theft.

Rather than counting on your users to keep themselves secure, institute streamlined login processes that also offer added security.

[Auth0’s Passwordless](https://auth0.com/passwordless) allows users to log in using codes that are sent to their mobile phones — meaning they don’t need to remember or frequently update a password. What if people still insist on passwords? [Auth0’s Breached Password Detection](https://auth0.com/breached-passwords) will alert you and your users immediately if their credentials are leaked.

### Update your legacy systems to mitigate the risk of cross-industry fraud.

Fraud isn’t going anywhere. Even as security measures improve and technology advances, hackers will be motivated to rise to the challenge of stealing information and conducting malicious activity.

It’s up to you to make it as tough as possible for them to do so and protect your organization, your users, and your peers across industries who could be impacted by a breach.

Implementing a solution like Auth0 (https://auth0.com/) bolsters your security while it frees up your company’s time and resources so that you can focus on the tasks and projects that directly contribute to your revenue growth.

<include src="asides/AboutAuth0" />

---

Cross-Industry Fraud is on the Rise — Here’s What You Can Do

diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Rapid gaming industry growth across mobile, console, and PC platforms can lead to disaster without proper security and anti-fraud protections.

In April 2018, Epic Games’ [Fortnite generated $296 million](https://techcrunch.com/2018/05/25/fortnite-had-a-296-million-april/)—more than double what it generated in February. Growth was rapid across mobile, console, and PC platforms.

At the same time as users peaked in February 2018 with 3,400,000 simultaneous logins, [mysterious charges began to appear in users' accounts](https://kotaku.com/whats-really-going-on-with-all-those-hacked-fortnite-ac-1823965781), ranging from $99.99 to $149.99. Hackers made off with one-off charges and often racked up multiple thefts from single users. [One player even struggled to pay his rent](https://www.reddit.com/r/FORTnITE/comments/841zdn/account_hacked_epic_please_help_thats_my_rent/) as a result of the total financial damage. Thieves exposed critical data via multiple log-in attempts, posted sign-in codes, and offered upgrades at steep discounts.

The example isn't isolated. Annually, [cyber thieves make off with over 40 percent](https://www.panopticonlabs.com/our-technology/) of video-game publishers' in-game revenue. As the global [gaming industry's sales top $100 billion](https://seekingalpha.com/article/4184342-video-games-taking-will-esports-become-larger-sports), more criminals are taking notice, and more companies are at risk.

In 2018, it will be critical for gaming companies to know exactly who is logging into their system, when, how, and from where — in order to create a safe and productive environment that users trust and continue to visit.

## What Are Auth0 Rules? How Can They Help?

[Auth0 Rules](https://auth0.com/docs/rules/current) are short JavaScript functions that are executed each time a user authenticates to an application. For example, if you want to know what country a user is logging in from, you can pull this data with the [Add Country Rule](https://auth0.com/rules/add-country) in the Auth0 user dashboard. This can be helpful in locating individual hackers or clusters of them working closely together. In the case of Fortnite, several thefts corresponded to Russia.

While Auth0 has several Rules, all of which developers can use to customize and [extend Auth0's current suite of capabilities](https://auth0.com/b2c-customer-identity-management) to understand and protect end users, we've highlighted two particular ones below that growing video game companies can implement for better security as they scale.

These can be used separately or chained together for modular coding.

### User Fraud Score

The User Fraud score is particularly helpful in confirming that users are who they say they are and in quickly blocking those who are behaving inappropriately.

Auth0 has partnered with [Socure](https://www.socure.com/) to develop a user fraud score for each account that authenticates, based on their email address and IP address.

```javascript
function (user, context, callback) {
 // score fraudscore once (if it's already set, skip this)
 user.app_metadata = user.app_metadata || {};
 if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

 if(!user.email) {
 // the profile doesn't have email so we can't query their api.
 return callback(null, user, context);
 }

 const request = require('request');

 // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
 request({
 url: 'https://service.socure.com/api/1/EmailAuthScore',
 qs: {
 email: user.email,
 socurekey: configuration.SOCURE_KEY,
 ipaddress: context.request.ip
 }
 }, function (err, resp, body) {
 if (err) return callback(null, user, context);
 if (resp.statusCode !== 200) return callback(null, user, context);
 const socure_response = JSON.parse(body);
 if (socure_response.status !== 'Ok') return callback(null, user, context);

 user.app_metadata = user.app_metadata || {};
 user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
 user.app_metadata.socure_confidence = socure_response.data.confidence;
 // "details":[
 // "blacklisted":{
 // "industry":"Banking and Finance",
 // "reporteddate":"2014-07-02",
 // "reason":"ChargeBack Fraud"
 // }
 // ]
 user.app_metadata.socure_details = socure_response.data.details;

 auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
 .then(function(){
 context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
 context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
 context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
 callback(null, user, context);
 })
 .catch(function(err){
 callback(null, user, context);
 });
 });
}
```

Socure incorporates information about individuals from social media, offline identity verification services, and publicly available data, to determine if an account is real or fake. While other vendors generally aggregate static points, such as a user's name, date of birth, and/or social security number, Socure + Auth0 focus on behavioral cues (e.g., how a user has transacted on other platforms, when, and from where; if they have a stable history; or if there are gaps and inconsistencies).

If a user has a high fraud score, you can put them on a watch list or require them to [provide additional information before they can transact](https://www.teampay.co/blog/finance-stack-startups/).

### minFraud (For Games with Payments)

In addition to rooting out suspect account logins and signups, minFraud helps secure your online marketplace by identifying possible fraud in online transactions.

The minFraud Rule will send the user’s IP address, email address, and username to MaxMind’s [minFraud API](https://dev.maxmind.com/minfraud/). Similar to the user fraud score, the API will return the risk score — but this time the focus is on the specific transaction (instead of the user as a whole).

```javascript
function (user, context, callback) {
 const querystring = require('querystring');
 const request = require('request');
 const crypto = require('crypto');

 const MINFRAUD_API = 'https://minfraud.maxmind.com/app/ccv2r';

 const data = {
 i: context.request.ip,
 user_agent: context.request.userAgent,
 license_key: configuration.MINFRAUD_LICENSE_KEY,
 emailMD5: user.email &&
 crypto.createHash('md5').update(user.email).digest("hex") || null,
 usernameMD5: user.username &&
 crypto.createHash('md5').update(user.username).digest("hex") || null
 };

 request.post(MINFRAUD_API, { form: data, timeout: 3000 }, (err, res, body) => {
 if (!err && res.statusCode === 200) {
 const result = querystring.parse(body, ';');

 console.log(`Fraud response: ${JSON.stringify(result, null, 2)}`);

 if (result.riskScore && (result.riskScore * 100) > 20) {
 return callback(new UnauthorizedError('Fraud prevention!'));
 }
 }

 if (err) {
 console.log(`Error while attempting fraud check: ${err.message}`);
 }
 if (res.statusCode !== 200) {
 const message = err && err.message;
 console.log(`Unexpected error while attempting fraud check: ${message}`);
 }

 // If the service is down, the request failed, or the result is OK just continue.
 return callback(null, user, context);
 });
}
```

MinFraud collects information from over [2 billion transactions](https://www.maxmind.com/en/minfraud-services) in its network. The tool assesses signs of fraud, such as

- suspicious pairings of user location with address and IIN data;
- risk associated with the IP address; and
- reputation checks for street addresses, email addresses, phone numbers, and devices.

In cases like _Fortnite_, minFraud could have helped the team block transactions that didn't meet standards for the above criteria, stopping theft from spreading throughout its network.

## Use Rules As Part of a Larger CIAM Strategy

Adding individual Rules that pertain to certain users on your platform is a step in the right direction. Setting up a comprehensive strategy for more deeply understanding all of your users is the next. Either [building or outsourcing](https://auth0.com/b2c-customer-identity-management) customer identity and access management solutions can bring a new dimension to your insights.

![Auth0 dashboard](https://images.ctfassets.net/23aumh6u8s0i/7sbXQ9SWpmPS7HuKh9pGhE/427d1c43629461957d5c506e8e9e535d/auth0-dashboard)

[Source](https://auth0.com/docs/getting-started/dashboard-overview)

With a well-crafted tool like a centralized dashboard (above), admins are afforded a bird's-eye view of all current and past activity. They can drill down into the granular details of each user, if need be, including when they joined the platform, their latest logins, and heaviest usage times. Admins can easily troubleshoot issues that arise by logging in as any user — or block access if they note multiple failed logins or excessive transactions.

As the threat landscape quickly evolves, particularly in fast-moving and highly technical spaces like gaming, coming up with solutions that are cutting edge and safe against the latest attacks can be enormously challenging — particularly for IT teams working 24/7 just to keep a game running. But taking time to consider and create a broad CIAM strategy, centered on end users, will make your game a safe space for competition for years to come.

<include src="asides/AboutAuth0" />

Secure Your Gaming Company With Auth0's Fraud Protection

Let your defenses down, and you could be giving money away.


In 2016, consumers lost [$16 billion](https://www.cnbc.com/2017/02/01/consumers-lost-more-than-16b-to-fraud-and-identity-theft-last-year.html) due to online fraud, up from $15 billion in 2015. Such crimes affected more than 15.4 million consumers.

None of this takes into account the enormous damages to companies' reputations when their security systems are breached.

Many organizations have taken initial steps to protect themselves against these types of losses (e.g., trying to keep pace with software updates) — but far more can be done.

## What Is Online Fraud Protection?

Online fraud protection encompasses an array of methods for preventing the theft of your organization’s most sensitive data. General forms can include, but are not limited to:

1. **Educating your employees about phishing:** Sophisticated email attacks can be indistinguishable from real emails. This can result in staggering breaches of end-user data. It's important to make sure that each member of your team understands [this](https://auth0.com/blog/the-new-trend-of-artisanal-spam/).
2. **Limiting the disclosure of sensitive information:** The more you distribute your company's EIN, the more surface area you're creating for possible attacks. Limit disclosure to only those cases, when it's absolutely necessary. In addition, try to communicate it over the phone or in-person rather than over a stored medium.
3. **Sign up for alerts with your local Secretary of State:** If anyone attempts to change your business's registration information, you can receive an email quickly from your local Secretary of State, notifying you of the update. If it's not something you authorized, you can have the fraud immediately rolled back.

Despite widespread education on these steps, hackers still manage to worm their way into companies at alarming rates.

## The Worst Cases of Identity Theft in Recent History

[When a data breach occurs](https://auth0.com/blog/data-breaches-by-the-numbers/), cyberthieves have the ability to open bank accounts, lines of credit, new credit cards, and even drivers' licenses in the name(s) of those they've scammed. This can happen within a day — or sooner.

![When a data breach occurs, cyberthieves have the ability to open bank accounts, lines of credit, etc.](https://images.ctfassets.net/23aumh6u8s0i/69tS9PWDrwY2lbWKNXZbwC/d60a82408d3b5b1b33663727dd3a3cfe/equifax-breach-laptop-lg)

([Image Source](https://www.creditcards.com/credit-card-news/images/equifax-breach-laptop-lg.png))

In September 2017, criminals stole sensitive data, including names, birthdates, physical addresses, and Social Security numbers from a yet-to-be-determined number of drivers' licenses from Equifax customers. These hackers also stole 209,000 credit card numbers and 182,000 documents, also containing identifying information.

This is the tip of the iceberg. Other major breaches in the past few years include:

* **Yahoo:** 2013 *and* 2014 (both disclosed 2016); 3.5 billion accounts exposed in total (all Yahoo users); names, birthdates, phone numbers, email addresses, encrypted or unencrypted security questions and answers, and hashed passwords — now available for sale.
* **Myspace:** 2016; 360 million users threatened; more than 427 million passwords made vulnerable.

In the cases of Equifax and Myspace, hackers were able to carry out their breaches, due to outdated systems (e.g., a vulnerability in one of Equifax's web applications allowed access to the credit reporting agency’s most critical data). With Yahoo, an employee opened a spear-phishing email. From here, the hacker was able to explore the company's network, install a backdoor into its server, and obtain a copy of the user database.

## Three Extra Steps You Can Take to Protect Your Company

[Rules](https://auth0.com/blog/5-ways-to-make-your-app-more-secure-in-less-than-20-minutes/) are snippets of JavaScript code, which run as part of a customized login process on Auth0 servers. Rules allow customers to limit logins to a specific region, add information to a user profile (e.g., their security role), and/or check the last time a user reset their password.

![Rules (https://auth0.com/blog/5-ways-to-make-your-app-more-secure-in-less-than-20-minutes/) are snippets of JavaScript code, which run as part of a customized login process on Auth0 servers](https://images.ctfassets.net/23aumh6u8s0i/35QmtnrOwvXpSyD3FdNvoj/25eb462933a2eddb3ef9bd7ad6ec35c1/flow.png)

Rules can be helpful in several ways.

* **They are easy to create & run:** Implementation is simply via a few lines of JavaScript in our Webtask sandbox — with no extra technical debt or product development needed.
* **They can provide real-time updates:** Depending on the service for which you are implementing Rules, you can get real-time updates of user sign-ins, along with any data you sent via the API.
* **They offer sequencing:** Any number of Rules can be run on a single log in. You can run each of the three Rules below (and more) every time a user logs in.
* **They bring improved reporting accuracy:** Server-side events complete with a much higher degree of confidence than client-side ones. (Client-side attempts can be blocked by firewalls, errant browser extensions, or code errors.)

### Rule 1: User Fraud Score

This Auth0 Rule is particularly helpful if you have built an online marketplace, such as Etsy or Airbnb. Protecting your buyers and sellers from fraud in this ecosystem is critical to maintaining its trustworthiness and ensuring more transactions happen there. This Rule will calculate a fraud score for every user, based on their email address and IP address.

```javascript
function (user, context, callback) {
  // score fraudscore once (if it's already set, skip this)
  user.app_metadata = user.app_metadata || {};
  if (user.app_metadata.socure_fraudscore) return callback(null, user, context);

  var SOCURE_KEY = 'YOUR SOCURE API KEY';

  if(!user.email) {
    // the profile doesn't have email so we can't query their api.
    return callback(null, user, context);
  }

  // socurekey=A678hF8E323172B78E9&email=jdoe@acmeinc.com&ipaddress=1.2.3.4&mobilephone=%2B12015550157
  request({
    url: 'https://service.socure.com/api/1/EmailAuthScore',
    qs: {
      email:  user.email,
      socurekey: SOCURE_KEY,
      ipaddress: context.request.ip
    }
  }, function (err, resp, body) {
    if (err) return callback(null, user, context);
    if (resp.statusCode !== 200) return callback(null, user, context);
    var socure_response = JSON.parse(body);
    if (socure_response.status !== 'Ok') return callback(null, user, context);

    user.app_metadata = user.app_metadata || {};
    user.app_metadata.socure_fraudscore = socure_response.data.fraudscore;
    user.app_metadata.socure_confidence = socure_response.data.confidence;
    // "details":[
    //     "blacklisted":{
    //        "industry":"Banking and Finance",
    //        "reporteddate":"2014-07-02",
    //        "reason":"ChargeBack Fraud"
    //     }
    // ]
    user.app_metadata.socure_details = socure_response.data.details;

    auth0.users.updateAppMetadata(user.user_id, user.app_metadata)
      .then(function(){
        context.idToken['https://example.com/socure_fraudscore'] = user.app_metadata.socure_fraudscore;
        context.idToken['https://example.com/socure_confidence'] = user.app_metadata.socure_confidence;
        context.idToken['https://example.com/socure_details'] = user.app_metadata.socure_details;
        callback(null, user, context);
      })
      .catch(function(err){
        callback(null, user, context);
      });
  });
}
```

(Auth0 Rule for [Socure](https://auth0.com/rules/socure_fraudscore))

Fraud Score works with [Socure](http://socure.com/), a cloud service that aggregates data from social media, offline identity verification services, and publicly available data, to determine if a user is real or fake. By putting users with high fraud scores on a watch list, and/or requiring additional verification before they can transact, Fraud Score can help protect your app and users. In addition, Fraud Score will deliver the information by the point of registration, instead of following a series of fraudulent transactions on the site.

### Rule 2: Checking Fraud with minFraud

minFraud identifies possible fraud in online transactions, as well as suspect account logins and signups, using geolocation, IP address, email, device and proxies. The minFraud rule will send the user’s IP address, email address, and username (both in MD5 format) to MaxMind’s minFraud API. In turn, the API will return the risk score for the transaction. This data can be leveraged within the Rule to block any login with a high-risk score.

```javascript
/**
 * @title Fraud Prevention
 * @overview Send the user's IP address, user agent, email address and username in MD5 to MaxMind's MinFraud API.
 *
 * This rule will send the user's IP address, user agent, email address (in MD5) and username (in MD5) to MaxMind's MinFraud API. This API will return information about this current transaction like the location, a risk score, ...
 *
 * > Note: You will need to sign up here to get a license key https://www.maxmind.com/
 *
 */

function (user, context, callback) {
  const querystring = require('querystring');
  const request = require('request');
  const crypto = require('crypto');

  const MINFRAUD_API = 'https://minfraud.maxmind.com/app/ccv2r';

  const data = {
    i: context.request.ip,
    user_agent: context.request.userAgent,
    license_key: configuration.MINFRAUD_LICENSE_KEY,
    emailMD5: user.email &&
        crypto.createHash('md5').update(user.email).digest("hex") || null,
    usernameMD5: user.username &&
        crypto.createHash('md5').update(user.username).digest("hex") || null
  };

  request.post(MINFRAUD_API, { form: data, timeout: 3000 }, (err, res, body) => {
    if (!err && res.statusCode === 200) {
      const result = querystring.parse(body, ';');

      console.log(`Fraud response: ${JSON.stringify(result, null, 2)}`);

      if (result.riskScore && (result.riskScore * 100) > 20) {
        return callback(new UnauthorizedError('Fraud prevention!'));
      }
    }

    if (err) {
      console.log(`Error while attempting fraud check: ${err.message}`);
    }
    if (res.statusCode !== 200) {
      const message = err && err.message;
      console.log(`Unexpected error while attempting fraud check: ${message}`);
    }

    // If the service is down, the request failed, or the result is OK just continue.
    return callback(null, user, context);
  });
}
```

See this rule [here](https://github.com/auth0/rules/blob/master/src/rules/fraud-prevention-with-minfraud.js).

### Rule 3: Force Email Verification

As expected, this Rule denies any user who hasn’t verified their email address from logging in. This Rule is particularly helpful when working with multiple emails, which belong to networks, e.g., `@university.edu` or `@company.edu`. (The tactic of requesting these network emails is one of many critical ones, which help SaaS companies grow rapidly.)

```javascript
function (user, context, callback) {
  if (!user.email_verified) {
    return callback(new UnauthorizedError('Please verify your email before logging in.'));
  } else {
    return callback(null, user, context);
  }
}
```

(Auth0 Rule for [forcing email verification](https://auth0.com/rules/email-verified))

Without this email verification step, chances are high you could show an impostor sensitive company information. To ensure a user actually owns the email address and belongs to the network, signified by their email address, have your app email the user with a unique, obscure, automatically generated link to a page. This will force them to prove that they have access to the email account by logging in and clicking on the link to verify.

While a range of options is available for corporations and institutions to verify the identity of their users, Auth0 offers teams the chance to integrate their advanced options into existing SaaS tools.

## Stay Ahead of Cybercriminals In 2018

In 2018, identity theft will continue to rise as it has for decades. Cybercriminals only become more advanced in their techniques of usurping others’ identities; losses from these crimes have worsened.

Be sure your company isn't part of the headlines — and doesn't suffer significant financial losses. Auth0 Rules can deliver simple fixes — halting staggering problems before they arise.


"fraud"