Five Defensive Layers for Detecting and Preventing Impersonation Scams
Summary
ThreatFabric outlines five layers for combating impersonation scams: call intelligence, remote-access detection, behavioral biometrics, real-time payment controls and consumer education.
Key points
- Scammers may pose as trusted organizations, create urgency and either use remote-access tools or persuade victims to transfer money to mule accounts.
- Call detection can combine whether a user is on a call during a banking session with call duration and call type to identify potential vishing.
- Remote-access detection can use network-port scanning alongside device and behavioral indicators; fragment scanning may identify injected content on banking websites.
- Behavioral biometrics can flag deviations in typing, navigation and mouse or touch behavior, especially when combined with device-risk signals.
- Payment systems can correlate device, behavioral, customer and transaction risks to challenge or block suspicious payments in real time.
- The article recommends targeted consumer education alongside technical controls; it cites a study in which reported student money-mule recruitment fell from 66% to 6% after a 45-minute educational video.
Article Details
- Defense Focus
- Detect and prevent impersonation scams through layered call, device, behavioral, transaction, and consumer-education defenses.
- Detection Methods
- Correlate active-call status during banking sessions with call duration and call type, including whether the call uses WhatsApp, Signal, or Telegram rather than a cellular network.
- Detect remote-access and screen-sharing tools using network-port scanning where applicable, plus device indicators such as screen size, resolution, and color depth.
- Monitor behavioral indicators associated with remote control, including mouse overshoots, changes in hit zones, and other RAT-specific behavior.
- Scan banking-page fragments for unauthorized content modifications.
- Analyze keystrokes, navigation, mouse movement, touch, and device rotation for statistically significant deviations from a user's historical behavior.
- Correlate device and behavioral risk with transaction size, velocity, payee relationship age, and incoming/outgoing transaction ratios.
- Data Sources
- Call status, duration, and call type
- Device screen characteristics and behavioral indicators
- Banking-page fragments
- Behavioral biometrics: keystrokes, navigation, mouse movement, touch, and rotation
- Customer, device, behavioral, and transaction risk signals
- Defensive Actions
- Use real-time decisioning to challenge or block high-risk transactions before funds leave the victim's account.
- Evaluate behavioral-biometric models for adaptation to changing user behavior, evaluation period, and user-level or application-level training.
- Combine fraud-awareness campaigns with education in schools and universities.
- Correlate multiple independent risk signals to reduce alert noise and improve fraud detection.
People
Vendors
Products
AnyDeskThe fraudster may direct the victim to download a legitimate remote access tool (RAT), such as AnyDesk to gain access to the victim’s device.Fraud Risk Suitelike to learn more about our market-leading device intelligence and behavioural biometrics solution, Fraud Risk Suite, which is helping banks detect a range of digital fraud, including impersonation scams.Microsoft Quick AssistHowever, several ThreatFabric customers report a wave of RAT fraud originating from RATs such as Microsoft Quick Assist which do not open network ports.TeamViewerAnyDesk and TeamViewer) open network ports and therefore can be detected using port scanning technology.
Countries
AustraliaIn Australia, Aussies lost a staggering $92 million to impersonation scams last year, accounting for more than 70% of reports made to Scamwatch.NetherlandsWe can take motivation and learnings from countries, such as the Netherlands, who have been fighting back.NorwayIn Norway, DNB reported earlier this year that safe account fraud, another term for an impersonation scam, was the fastest-growing fraud type in the region.United KingdomIn the UK, impersonation scams were the second most costly in 2023, costing UK consumers and businesses £72m in H1.