Tecnología - Blog de JuicyScore

El uso masivo de soluciones basadas en 2FA ha reducido significativamente los riesgos de fraude y ha sido más eficaz para resistir los ataques de fraude en el entorno digital.

2FA_final.png

随着技术世界不断发展，10多年以前出现的双重认证（2FA）或多重要素验证(MFA)得到广泛应用。 使用双重认证（2FA）或多重要素验证(MFA)已经成为常态。 
广泛采用基于双重认证（2FA）的解决方案显著降低了欺诈风险，并更有效地抵御数字环境中的欺诈攻击。如果您还没采用基于双重认证（2FA）的解决方案， 你一定要考虑采用， 因为这种措施肯定会大大有利于您和您的客户。 

线上骗子通常研发新方法盗取个人信息。 因此对于越来越多线上业务来说采用双重认证变成提高系统和客户账号安全水平的不可缺少的一部分。双重认证为访问网站、应用程序或资源提供了额外的安全级别，通过两个不同的因素来确认用户的身份，例如密码和通过短信或应用程序获取的一次性验证码。这有助于防止未经授权的访问帐户，并保护客户的宝贵个人数据免受在线骗子的侵害。

我们写的文章首先针对了解双重认证和多重要素验证并积极采用基于双重认证或多重要素验证的解决方案的读者。 可惜， 线上骗子不断制定新的绕过包括2FA/MFA在内的安全系统的方法。

最近几年我们积极研究与虚假申请欺诈以及个人账户保护问题相关的风险。
我们面对了大量新威胁和攻击形式的增长。随着基于2FA的保护系统推广，新威胁和攻击形式也随之出现。  

**这是什么样的风险? 来举一些例子。 **

技术欺诈包括合成账户（由欺诈者创建的与真实个人无关的虚构账户）、社交工程、远程访问、全面账户接管以及其他形式的欺诈攻击。

社交欺诈包括家庭欺诈 （比如， 孙女冒用她的祖母申请贷款）、多重账户 (multi-accounting)、贷款购物以及其他形式。

有哪些应对这些风险群体的方法？让我们列举一些最常见和最有效的解决方案：
- 登录或账户使用的风险信号分析；
- 建立监测系统并减少用户重复或多余账户的数量（如果对为客户提供服务没有必要）； 
- 检查用户的登录/账户使用详细信息是否与先前的用户会话匹配，包括设备和网络连接细节；
- 引入风险事件和/或信号的评分系统，以识别在涉及财务损失风险的情况下最高风险的会话，例如在线申请信用卡或贷款；
- 引入多重要素验证(MFA) 作为在风险高于平均水平的情况下的额外验证工具。
可能的解决方案包括向用户提出额外问题，这些问题只有账户所有者才能知道，并且最好不涉及账户的个人详细信息，例如账户持有人在银行拥有多少账户。

此外，应特别注意高风险JuicyScore指数和标记，这些标记可与双重认证（2FA）工具一起识别额外的欺诈分段。

- IDX1停止标记 (Stop markers) 表示由50多个高概率的技术操纵设备的欺诈事件的组合。
- IDX2: 用户行为的标记是不同用户行为标记的组合。
- IDX3设备的标记是涉及不同设备参数和设备异常的风险次要标记组合。
- IDX4互联网连接的标记是网络参数和异常的组合。
- 重复设备/Duplicating device
从同一设备在贷款人账户设置的最短贷款期内再次提交申请。
- 相同设备/ Same device
指的是关联设备和用户的先前和当前申请的设备匹配。
- Total num of applications with browser hash in 1 hour (/ 1 / 7/ 30 days)
在过去1小时（1/7/30天）内使用特定浏览器哈希的浏览器标识符提交的所有申请总数（适用于当前的服务订户）。
- 较短的贷款偿还期限天数Less tenor days
意思是此申请的间隔时间小于前一个申请中指定的天数。
- 网页上的停留时间/ Time on page
一个客户需要多长时间填写页面上的表单。 

**引入基于双重认证（2FA）的额外安全层级会产生什么结果？**

通过引入基于JuicyID的解决方案来加强个人帐户的保护，不仅降低了欺诈风险，还通过降低运营成本和信用损失提高了在线业务的经济效益。
JuicyID是JuicyScore的轻量版应用。这个产品旨在保护在线服务中的账户。JuicyID的特点是快速响应速度。回应消息中的设备ID、市场上最稳定和耐用的数字设备指纹和包括100 个属性的向量允许制定各种防止欺诈和不诚实虚拟用户行为的规则并保持成本与回报的平衡。同时考虑到防止在线欺诈风险是今天业务中的最重要的问题之一。

停止标记 (Stop markers) 将有助于在初期筛选阶段识别具有欺诈风险和高风险的申请领域。JuicyID变量向量将有助于降低社交欺诈风险水平。IDX1 - IDX4 指数可以用于构建通过了所有预先筛选阶段的申请的信用评分模型。这些模型有助于识别高风险违约分割和低风险分割，以进行自动筛选，从而提高批准水平。

JuicyID是保护用户个人帐户的最佳解决方案，尤其是在用户没有绑定到一个虚拟个人帐户的情况下。JuicyID又助于发现多账号操作(Multi-accounting)使用情况， 以及检测多个个人数据集用于不诚实用途的情况。如果需要快速响应速度， JuicyID就很合适。 

这是我们的第一篇文章介绍在使用2FA保护帐户和个人资料方面的风险管理研究。明年我们将介绍现有风险的其他多个方面。






随着技术世界不断发展，10多年以前出现的双重认证（2FA）或多重要素验证(MFA)得到广泛应用。 使用双重认证（2FA）或多重要素验证(MFA)已经成为常态。 
广泛采用基于双重认证（2FA）的解决方案显著降低了欺诈风险，并更有效地抵御数字环境中的欺诈攻击。

加强双重认证（2FA）的效力以保护客户

We can’t but agree that technological world is constantly evolving. Relatively recent widespread use of two-factor authentication (2FA) or multi-factor authentication (MFA), which became widely used about 10 years ago, has become commonplace. The widespread use of 2FA-based solutions has resulted in a significant reduction in fraud risks and a more effective response to fraud attacks in the digital environment. If you are reading this article and planning to implement 2FA-based solutions in your online business, we can definitely say that this step will bring significant benefits to you and your customers.

Online scammers are constantly developing new methods to get their hands on customers' personal information. For this very reason it is becoming glaringly obvious for many online businesses that implementing two-factor authentication solutions is becoming an integral part of improving the security of systems and user accounts. Two-factor authentication provides an additional layer of security for gaining access to a website, application or resource by ensuring the user's identity is verified through two different factors, such as a password and a one-time code received via SMS or application. This helps to prevent unauthorized access to accounts and protects customers' valuable personal information from online scammers.

The article will be extremely useful for those who have long mastered 2FA/MFA-based solutions. Unfortunately, online scammers are constantly developing new methods to bypass security systems, and 2FA/MFA systems are no exception. Over the past few years, we have been actively studying emerging risks both related to application fraud and problems of personal accounts protection. We have been facing the rise of a large number of new threats and attacks that have begun to emerge with the proliferation of 2FA-based security systems. What are these risks? We can divide them in a few groups:

- Technical fraud - synthetic accounts, [social engineering](https://juicyscore.ai/en/blog/remote-access-and-social-engineering-risks-prevention-best-practices-en), remote access, total account takeover and a number of other cases of fraud attacks;
- Social fraud - family fraud (for example, when a person applies for a loan on behalf of his or her relative), [multiple accounts](https://juicyscore.ai/en/blog/enhance-the-effectiveness-of-2fa-protect-your-customers-en) (multi-accounting), credit shopping and some other cases.

## What are the most effective approaches to counteract these risk groups? Here are the most common and most effective methods:

- Analysis of risk signals related to login or account use;
- Build a system for monitoring and reducing the number of duplicate or additional user accounts (if this is unnecessary to provide services to the client);
- Additional checks whether login/account usage details match with the previous user session, including device details and Internet connection;
- Apply rare events risk scoring of events and/or signals to identify the most risky sessions. This method is applicable in such cases, where the risk of material losses is involved (for example, credit card application online process or loan applications);
- Apply 3FA+ solutions as an additional verification tool in cases of above-average risk. Possible solutions: additional questions to the user on the information that should only be known to the account owner and preferably should not be associated with personal account details (for example, how many bank accounts this person has).

## JuicyScore high-risk variables and markers

Also it is sufficient to observe that JuicyScore high-risk variables and markers allow you to identify additional fraud segments in conjunction with 2FA tools.

- IDX1 Stop Markers - Combination of 50+ rare events with high risk of tech fraud;
- IDX2 User Behaviour Markers - Combination of behaviour markers, including application frequency, user behaviour parameters, etc.;
- IDX3 Device Markers - A combination of secondary device risk markers, including various device parameters and device anomalies;
- IDX4 Connection Markers - Combination of secondary risk factors, consists of various device markers and anomalies;
- Duplicating device - Repeated application from the same device within the minimum loan term according to the lender's account settings;
- Same device - Device matching with previous and current applications for associated devices and users;
- Total num of applications with browser hash in 1 hour (/ 1 / 7/ 30 days) - The total additional number of applications (for the current service subscriber or user) to a given user with the specified browser hash over the last 1 hour;
- Less tenor days - An indication of whether this application is repeated for a period shorter than the number of days specified in the previous application;
- Time on page - Duration of filling out a page , application form, etc.

##  What results can be achieved after implementing additional protection as part of 2FA?

Implementation of solutions based on JuicyID to enhance the protection of personal accounts not only reduces the risk of fraud, but also increases the economic efficiency of online businesses by reducing operational and credit losses.

JuicyID is a lightweight version of JuicyScore. The product is designed to protect accounts in online services. It's main feature is a high response speed.

The Device ID, which returns in the response, is one of the most stable and sustainable digital fingerprints on the market, it also has a data vector of 100 attributes, which allow you to build various rules for preventing the risk of fraud and spot shady behaviour of a virtual user, maintaining the balance of payback for investments at the same time.

Stop markers allow you to identify segments of high risk applications at early stages of applications filtering: JuicyID vector variables reduce the level of social fraud risk in the flow, while IDX1 - IDX4 indexes can be used to build credit scoring models for applications that have successfully passed all pre-filtration stages. These models help to identify segments with both - high risk of default for automatic filtering as well as low-risk segments in order to increase approval rates.

JuicyID is the optimal solution for protecting user personal accounts, especially if a physical user is not tied to one virtual personal account. JuicyID also can be of great use spotting cases of multi-accounting, as well as any cases of using multiple sets of personal data for shady purposes. 

This is just the first introductory article devoted to our research in the field of 2FA Solutions use for risk management purposes in general and account protection in particular. We will shred some light on other aspects of 2FA Solutions use in the future.

Relatively recent widespread use of two-factor authentication (2FA) or multi-factor authentication (MFA) has become commonplace for many online businesses. If you are reading this article and planning to implement 2FA-based solutions in your online business, we can definitely say that this step will bring significant benefits to you and your customers.

Enhance the effectiveness of 2FA: protect your customers

Mayor eficiencia de 2FA para proteger a los clientes

Snap

AdsTwitter

GTAG

!function(e,t,a,n,g){e[n]=e[n]||[],e[n].push({"gtm.start":(new Date).getTime(),event:"gtm.js"});var m=t.getElementsByTagName(a)[0],r=t.createElement(a);r.async=!0,r.src="https://www.googletagmanager.com/gtm.js?id=GTM-NTGCZRN",m.parentNode.insertBefore(r,m)}(window,document,"script","dataLayer")

GTM.start

function gtag(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],gtag("js",new Date),gtag("config","G-16F2F1RKM2")

gtag func

(function(d,u,ac){var s=d.createElement("script");s.type="text/javascript";s.src="https://a.omappapi.com/app/js/api.min.js";s.async=true;s.dataset.user=u;s.dataset.account=ac;d.getElementsByTagName('head')[0].appendChild(s);})(document,309689,328263);

OptInMonster

// Passing google_client_id into OptInMonster forms
document.addEventListener('om.Optin.init', function() {
  const el = document.getElementById('IDgoogle');
  if (el) {
    function get_clientid() {var cookie = {};document.cookie.split(';').forEach(function(el) {var splitCookie = el.split('=');var key = splitCookie[0].trim();var value = splitCookie[1];cookie[key] = value;});return cookie["_ga"].substring(6);}
    try { el.value = get_clientid() } catch(e) { console.error(e); el.value = '' }
  }
});

Tecnología - Blog de JuicyScore

A collection of 1 posts

Mayor eficiencia de 2FA para proteger a los clientes

Empresa

Productos

Reglas