PayPal Fraud Chief Details OTP Theft, Phishing-as-a-Service and AI-Generated Fake Shops
Summary
PayPal’s fraud and threat intelligence chief urges teams to combine their expertise. He highlights OTP theft via phishing pages, phishing-as-a-service and AI-generated fake shops, and points to anomalies, customer complaints and infrastructure as fraud signals.
Key points
- Blake Butler, PayPal’s Head of Fraud and Threat Intelligence, says fraud and security teams can connect technical attack methods with how criminals monetize account abuse.
- Suggested fraud signals include phishing infrastructure, customer complaints about undelivered goods, account-creation patterns, and unusual traffic or data spikes.
- Butler cautions that normalizing data can remove anomalies that may indicate emerging abuse.
- Phishing pages can automate logins or password resets on legitimate sites and prompt users to provide one-time passcodes (OTPs).
- Phishing-as-a-service can let less-skilled attackers use more sophisticated phishing methods.
- Butler says criminals use AI to produce convincing phishing content, images for fictitious products, and code for fake online shops.
Article Details
- Topic
- Payment fraud detection and its convergence with threat intelligence, including account takeover, OTP theft, phishing-as-a-service, and AI-enabled fraud.