See how you rank against ecommerce security trends.
This post contains the text from the White Paper: Ecommerce Website Spoofing and Unauthorized Third-Party Resellers. Download the PDF.
Ecommerce sites will always be popular targets for cybercriminals who attempt to steal users' personal and financial information.
One of the emerging ways they do this is by creating fraudulent websites that mimic legitimate ones. This practice, known as website spoofing, has serious consequences for individuals and businesses alike.
Another recently discovered similar threat occurs when an ecommerce website advertises the sale of merchants’ products, as would an authorized third-party reseller, but the site’s intent is solely to steal customer credit card data.
This white paper discusses the dangers of both ecommerce site spoofing and unauthorized third-party resellers, how they work, and what individuals and businesses can do to protect themselves.
Ecommerce site spoofing poses a significant threat to both individuals and businesses. Cybercriminals can use spoofed sites to steal users' personal and financial information, such as credit card numbers, bank account details, and login credentials. They can then use this information to make fraudulent purchases, steal money from bank accounts, or commit identity theft.
For businesses, ecommerce site spoofing can damage their reputation and erode customer trust. Customers who fall victim to these scams may blame the business for not providing adequate security measures and may be less likely to do business with them in the future. Additionally, businesses may suffer financial losses due to chargebacks and lost sales.
The most significant danger is that these attacks can happen to any website–even if that website has no obvious security vulnerabilities. Plus, the attack is often so subtle that it can go undetected for long periods of time.
In one case, we saw that the merchant’s IT staff even knew about the spoofed website, but thought they owned it because their code updates, sales, and other changes were instantly reflected in the fake website. They didn’t worry about it because orders placed on that website appeared in their database. Most importantly, they got paid. Yet, the illicit website was harvesting the customer credit card data of every transaction going through the spoofed website.
Another danger is that these attacks leave almost no detectable footprint on the merchants’ web servers. This can happen because the attack does not exploit any particular security flaw. Web spoofing takes advantage of how websites work in general. So, even if logs are monitored and alerts reviewed, it is possible that even seasoned IT staff will not spot anything unusual happening.
These attacks can even evade professional investigators. In one of our recent cases, the merchant had multiple previous forensic investigations performed. None of those investigations revealed evidence of a data breach or even a major security vulnerability. In fact, our own investigation agreed with the two previous conclusions. We found nothing wrong with the merchant’s website.
This lack of evidence was not due to not looking hard or deep enough. There was simply nothing to be found. It was not until we started looking outside the standard forensic data set that we found a large number of unauthorized resellers advertising the merchant’s products to collect credit cards from deceived customers.
Ecommerce site spoofing typically involves the creation of a fraudulent website that closely resembles a legitimate ecommerce site, including making the domain name and URLs visually resemble the originals, but make minimal alterations (e.g., one character) so that at first glance it would appear to be for the legitimate website. They often also use fake SSL certificates to make their sites appear more legitimate.
Attackers can even write clever scripts that instantly mimic changes made to the legitimate website so that their fake website looks and acts just like the merchant’s website. If a product goes on sale on the real website, it automatically goes on sale on the spoofed website. This has often fooled merchant’s IT staff into thinking they owned and controlled the spoofed website because their changes were instantly visible.
Bad actors may even create domain names that appear to be owned by the merchant by using the same domain registrar and hosting provider. For example, if a merchant owns the domain name retailwidgets.com, an attacker might register retailwidget.com with the same registrar and host it on the same hosting provider.
Cybercriminals may use a variety of tactics to lure users to these sites, such as sending phishing emails, using social engineering techniques, or even getting their forged website ranked on popular search engines so that searches for particular products would put their website or products in with the search results.
Once a user lands on a spoofed site and initiates a purchase, they will be prompted to enter their personal and financial (e.g., credit card) information. The site may also install malware on the user's device, which can steal information or allow the cybercriminal to control the device remotely. However, the fake website will not immediately charge the customer’s credit card. Instead, they simply collect the transaction information.
Once the cybercriminals have all the information, they can manually (or use automated scripts to) place a real order on the merchant’s legitimate website, and then the crime is complete. The merchant gets paid, the customer gets exactly what they ordered, and the bad actor gets stolen credit card data. Everybody is happy until the stolen credit card is eventually used to purchase goods somewhere in the world, and the customer then learns that their credit card is being used fraudulently.
When a credit card transaction is reported as fraudulent, the card brands use algorithms that triangulate that purchase back to the merchant most likely to have lost control of the credit card.
In the case of website spoofing, or unauthorized resellers, the credit card was actually stolen before the legitimate transaction ever occurred on the merchant’s website. However, the merchant still gets flagged for that transaction, even though the credit card was not stolen by any security breach on their website or through any lack of due diligence on their part to protect the transaction data.
Individuals and businesses can take steps to protect themselves against ecommerce site spoofing. Here are some tips:
Websites that sell goods that they did not produce are not uncommon and are typically completely legitimate. This is known as an authorized third-party reseller. Amazon is a perfect example of this, but there are countless smaller sites that legitimately sell products or services that they do not own, but are authorized to sell. However, serious hazards arise when the site selling the goods is not authorized to do so. These posers may be selling counterfeit goods, or they may just take your money and not deliver anything at all.
Recently, another version of unauthorized reselling has come to light. In these instances, a bad actor puts up a convincing website selling your products, with all of the earmarks of being a legitimate reseller. They will take the orders and the customer credit cards; the customer actually receives the bona fide product, but here’s the catch—the bad actor simply goes to a legit seller’s site and places the order using the customer’s information (e.g., credit card, name, shipping address).
The customer receives the goods, so they are no more the wiser. The entire intent of the bad actor is to capture customer credit card data and their personally identifiable information (PII).
Here is where things get really bad: When the bad actor begins to use or sell the stolen credit card data, the legitimate merchant is identified as having potentially been breached and is mandated to pay for an expensive, in-depth investigation looking for the source of the data breach. And no matter the expertise of the investigating body, they are not going to find evidence of a data breach because the credit cards were stolen from the website operated by the bad actor, leaving no indicators of compromise on the legitimate website.
Overall, it is important for consumers to be cautious to avoid purchasing products from unauthorized third-party resellers and for legitimate businesses to take steps to protect their brand and intellectual property from unauthorized use.
By taking these steps, you can protect yourself and your business from the potential negative effects of buying from unauthorized third-party resellers.
Ecommerce website spoofing and unauthorized third-party resellers are serious threats that can have significant consequences for both individuals and businesses. They are hard to detect and investigate.
By understanding how these scams work, implementing strong security measures, and educating employees, you can take the necessary steps to protect yourselves, your customers, or your businesses from the consequences of falling victim to these scams.
.svg)
