E-Commerce Fraud Prevention, Detection, Legal Aspects, and the Role of Crime-As-A-Service
Total Page:16
File Type:pdf, Size:1020Kb
Die approbierte Originalversion dieser Diplom-/ Masterarbeit ist in der Hauptbibliothek der Tech- nischen Universität Wien aufgestellt und zugänglich. http://www.ub.tuwien.ac.at The approved original version of this diploma or master thesis is available at the main library of the Vienna University of Technology. http://www.ub.tuwien.ac.at/eng e-Commerce Fraud Prevention, Detection, Legal Aspects, and the Role of Crime-as-a-Service DIPLOMARBEIT zur Erlangung des akademischen Grades Diplom-Ingenieur im Rahmen des Studiums Business Informatics eingereicht von Thomas Ebner, Bakk.rer.soc.oec. Matrikelnummer 0726345 an der Fakultät für Informatik der Technischen Universität Wien Betreuung: Ao. Univ.-Prof. Mag. Dr. iur. Markus Haslinger Wien, 23. April 2018 Thomas Ebner Markus Haslinger Technische Universität Wien A-1040 Wien Karlsplatz 13 Tel. +43-1-58801-0 www.tuwien.ac.at e-Commerce Fraud Prevention, Detection, Legal Aspects, and the Role of Crime-as-a-Service DIPLOMA THESIS submitted in partial fulfillment of the requirements for the degree of Diplom-Ingenieur in Business Informatics by Thomas Ebner, Bakk.rer.soc.oec. Registration Number 0726345 to the Faculty of Informatics at the TU Wien Advisor: Ao. Univ.-Prof. Mag. Dr. iur. Markus Haslinger Vienna, 23rd April, 2018 Thomas Ebner Markus Haslinger Technische Universität Wien A-1040 Wien Karlsplatz 13 Tel. +43-1-58801-0 www.tuwien.ac.at Declaration of Authorship Thomas Ebner, Bakk.rer.soc.oec. Talgasse 4/27, 1150 Vienna I hereby declare that I have written this Diploma Thesis independently, that I have completely specified the utilized sources and resources and that I have definitely marked all parts of the work - including tables, maps and figures - which belong to other works or to the internet, literally or extracted, by referencing the source as borrowed. Vienna, 23rd April, 2018 Thomas Ebner v Acknowledgements & Dedications I would like to express my gratitude to those who were involved in the creation of this thesis: First and foremost, I would like to thank Prof. Dr. Haslinger for supervising my thesis, the guidance, continuous support, and the valuable feedback. Furthermore, I would like to thank all interviewed experts who shared their knowledge and expertise, and contributed valuable information and insights to the success of the thesis. Last, but definitely not least, I would like to thank Katrin for sparking my interest in the topic of e-commerce fraud, our subject-specific discussions and exchange, and for your highly appreciated support throughout the process of writing my thesis. I dedicate this thesis to my parents, Monika and Chrysanth, even though neither this dedication nor words can express how grateful I really am. Thank you for your unconditional support and for everything you did and have made possible for me. I also dedicate this thesis to my brother, Daniel. Thank you for everything you did for me, for always being there for me, and - quoting him as there are no better words to express it - “for accompanying me all my life and some nine months more, and for proving that brothers can be friends too”. vii Abstract E-commerce has become a self-evident part of our everyday life over the last few years, and its importance continues to grow. However, the success comes at a price: Not only has the volume of e-commerce transactions grown, but also the volume of fraudulent e-commerce transactions has increased in parallel too, at an even greater rate. Fraudsters are trying hard to emulate legitimate behaviour and behave like genuine customers, which tricks retailers and causes not only financial damage. The thesis at hand is focused on B2C e-commerce fraud. The relevance and impact of e-commerce fraud is highlighted, and indicators for fraudulent e-commerce transactions are determined. Moreover, e-commerce transactions are analysed, and their vulnerabilities and their susceptibility with regard to fraud attempts are investigated and evaluated. Measures to prevent and to detect e-commerce fraud are gathered and analysed as well. Interviews with investigators and experts in this field are conducted to gain practical insights, and to enhance the knowledge and discuss the results acquired from the literature research. Furthermore, legal aspects with regard to e-commerce fraud are examined. This comprises an analysis of the Austrian legislation as well as international endeavours against e-commerce fraud (with an impact on Austrian laws), as e-commerce (and, consequently, e-commerce fraud) is inherently cross-border. Another factor contributes to the rise of e-commerce fraud as well: Over the last few years, cybercriminals have advanced to profit- and service-oriented business models, leading to a phenomenon referred to as Crime-as-a-Service. Cybercriminals provide their goods and services to other criminals, which is why the entry barrier is diminished, making it easier for criminals to commit crimes like e-commerce fraud. An investigative research of the relevance and impact of Crime-as-a-Service on e-commerce fraud and its facilitating role is also included in the present thesis. ix Kurzfassung Im Laufe der letzten Jahre hat sich E-Commerce zu einem festen Bestandteil unseres täglichen Lebens entwickelt, und die Bedeutung wird weiter steigen. Der Erfolg hat aber auch seine Schattenseite: Während einerseits das Volumen an E-Commerce Transaktionen zunimmt, steigt andererseits zugleich auch der Anteil an Betrugsfällen, sogar in einem noch höheren Ausmaß. Betrüger treten als vertrauenswürdige Kunden auf, und verursachen den dadurch getäuschten Online-Händlern nicht nur finanziellen Schaden. Die Diplomarbeit beschäftigt sich mit E-Commerce Betrug im B2C-Bereich, also mit E-Commerce Transaktionen zwischen betrügerischen Endkunden und Online-Händlern. Die Bedeutung und die Auswirkung von E-Commerce Betrug wird aufgezeigt und Indikatoren für betrügerische Transaktionen ermittelt. Der Ablauf von E-Commerce Transaktionen wird analysiert; dargelegte Schwachstellen werden hinsichtlich ihrer Anfällig- keit für betrügerische Aktivitäten untersucht und evaluiert. Zudem werden Maßnahmen zur Vermeidung und zur Erkennung von Betrugsversuchen analysiert. Interviews mit Ermittlern und Experten im Bereich E-Commerce Betrug werden durchgeführt, um so Informationen aus der Praxis zu erhalten, und um das in der Literaturrecherche gesammelte Wissen zu erweitern und zu evaluieren. Darüber hinaus werden auch die rechtlichen Aspekte hinsichtlich E-Commerce Betrug untersucht. Dies umfasst eine Analyse der österreichischen Gesetzeslage als auch internatio- naler Bemühungen gegen E-Commerce Betrug, welche Auswirkungen auf die österreichische Gesetzgebung haben, da E-Commerce (und somit auch E-Commerce Betrug) von Natur aus länderübergreifend ist. Ein weiterer Faktor trägt zum Anstieg von E-Commerce Betrug bei: Über die letzten Jahre haben sich Cyberkriminelle profit- und serviceorientierten Geschäftsmodellen zugewandt, was zur Entstehung des sog. Crime-as-a-Service (etwa: Verbrechen als Dienstleistung) geführt hat. Cyberkriminelle stellen ihre (zumeist illegalen) Güter und Dienstleistungen anderen Cyberkriminellen zur Verfügung, was dazu führt, dass für diese die Einstiegsbarriere gesenkt wird, wodurch es einfacher wird kriminelle Machenschaften, wie etwa E-Commerce Betrug, zu begehen. Eine investigative Recherche hinsichtlich der Bedeutung und der Auswirkung von Crime-as-a-Service auf E-Commerce Betrug ist ebenso Teil dieser Diplomarbeit. xi Contents 1 Introduction 3 1.1 Motivation and problem definition . 3 1.2 Expected results . 5 1.3 Methodological approach . 6 1.4 Structure of the work . 7 2 E-commerce 9 2.1 Definition of e-commerce . 9 2.2 Relevance of e-commerce . 10 2.3 Categories of e-commerce . 11 2.4 E-commerce transaction: Processes and stakeholders . 13 2.4.1 Agreement . 13 2.4.2 Payment . 14 2.4.3 Delivery . 15 2.5 Online payment . 16 2.5.1 Online payment methods . 16 3 E-commerce fraud 23 3.1 Definition of e-commerce fraud . 23 3.1.1 1st vs. 3rd party e-commerce fraud . 25 3.2 Relevance and impact of e-commerce fraud . 26 3.2.1 Impact on consumers . 27 3.2.2 Impact on merchants . 28 3.2.3 Impact on payment facilities . 29 3.3 Anatomy of e-commerce fraud . 29 3.3.1 Agreement . 29 3.3.2 Payment . 31 3.3.3 Delivery . 37 3.4 Indicators of e-commerce fraud . 41 3.4.1 Agreement . 42 3.4.2 Payment . 43 3.4.3 Delivery . 44 xiii 4 Preventing e-commerce fraud 47 4.1 General . 47 4.2 Collection and analysis of fraudulent transactions and attempts . 47 4.3 Measures for identity verification . 48 4.3.1 Data verification . 49 4.3.2 ID check . 50 4.3.3 Trusted virtual identity . 50 4.4 Security measures provided by payment methods . 51 4.5 Restriction of payment methods . 53 4.6 Restrictions and security measures for delivery services . 54 5 Detecting e-commerce fraud 57 5.1 General . 57 5.1.1 Transaction scoring . 59 5.1.2 Costs . 60 5.1.3 Challenges . 60 5.2 Manual review . 64 5.3 Information provider . 64 5.3.1 Data verification provider . 65 5.3.2 Credit score provider . 65 5.3.3 Information sharing provider . 66 5.4 Data analysis . 66 5.4.1 Rule-based expert methods . 67 5.4.2 Supervised classification methods . 68 5.4.3 Unsupervised anomaly detection methods . 71 6 Legal aspects and prosecution of e-commerce fraud 73 6.1 Legislation in Austria . 73 6.1.1 Legal assessment of the contractual relationship . 73 6.1.2 Criminal offences . 76 6.1.3 Jurisdiction and venue . 91 6.2 Transnational endeavours against fraud . 94 6.2.1 Convention on Cybercrime (Council of Europe) . 94 6.2.2 Framework Decision on combating fraud (European Union) . 98 7 Crime-as-a-Service 101 7.1 Cybercrime and the emergence of Crime-as-a-Service . 101 7.1.1 As-a-Service business models facilitating e-commerce fraud . 105 7.2 Facilitating factors of Crime-as-a-Service .