Malicious attacks are diverse and negatively affect online organizations in various ways, including tarnishing brand reputation, undercutting online revenue, decreasing operational efficiency, and increasing the risk of a data breach. There are many bot-enabled attacks that plague digital businesses. Here are a few common bad bots and their attack techniques:
Account Takeover (ATO)
Fraudsters use various techniques to take control of user accounts, a process known as account takeover (ATO). One common method is credential stuffing, where fraudsters deploy bots armed with stolen username and password credentials to target the sign-in page of online accounts, such as an e-commerce, bank, or email account. ATO attacks affect any organization with a customer-facing login. Common targets include online gaming, retailers, financial services firms and travel merchants.
Due to the diverse forms of fraud that cybercriminals can commit from compromised accounts, ATO attacks are one of the fastest growing attack techniques. Successful ATO attacks result in data breaches, identity theft and fraudulent purchases, costing online businesses millions.
Carding and Credit Card Stuffing
In carding attacks, bots test stolen credit or debit card information on merchant sites with small purchases to avoid detection. When small purchases are successful and the card is proven valid, the card data is used to retrieve funds from associated accounts or to purchase gift cards or goods that can be quickly converted to cash. Even when fraudulent transaction attempts are unsuccessful, businesses receive charged card authorization fees for card-not-present transactions, racking up card validation costs of up to 10 cents for each transaction attempt. When you consider that carding bots initiate tens of thousands of transaction attempts, this can cost merchants a significant amount of money.
While carding attacks are similar to ATO attacks, the big difference is that ATO attacks focus on the login page using stolen usernames and passwords, while carding attacks focus on the checkout page using stolen card information.
Scraping
With scraping, or data harvesting, bots are used to crawl web pages to steal prices, content, product reviews, and inventory data. This information can be used to inform a competitor’s business strategy, or to be resold or reposted with the aim of capturing and redirecting users to another website.
Denial of Inventory
Denial of inventory is a form of product inventory hoarding, where fraudsters use automated bots to hold items in digital carts without completing the sale. This is done with the intention of making the item, usually a high-demand or limited-availability item, unavailable to others. Often, the checkout process is never completed, preventing real users from actually purchasing the item, leaving the merchant with low sales and a large inventory.
Scalping
With scalping, bots rapidly buy high-demand and limited-availability items, such as sneakers or concert tickets. The bots used in these attacks are sometimes even referred to as sneaker bots, due to their prevalent use in sought-after sneaker releases. Once a merchant’s inventory is liquidated, fraudsters sell the scarce items in secondary markets at much higher prices.