Bots presenting a substantial risk to banks and retailers

Banks and online retailers are being increasingly targeted by bots, a report by ThreatMetrix has revealed.

Research carried out for its Q1 Cybercrime Report showed 35 per cent more attacks occurred over the last 90 days than in previous periods, although 311 million of these were stopped.

ThreatMetrix said it is increasingly finding hackers are using "low and slow attacks" to target banks and online retailers, which have the potential to evade detection because they look like genuine users, rather than fraudsters.

One of the reasons criminals are deciding to use this approach is because so much hacked personal information is available for them to buy from the dark web. This data can then be used to attack institutions as if they were real people.

"Consumer data is everywhere. Fraudsters can create pitch-perfect attacks because they know so much about us," Vanita Pandey, vice president of strategy and product marketing at ThreatMetrix, said.

The attacks are harder to detect because they are not always picked up by traditional control measures, meaning the usual ways of finding and reacting to threats aren't working anymore, Pandey added.

"The challenge for digital businesses today is that cybercriminals are becoming so sophisticated at building convincing identities using a jigsaw of stolen credential pieces, it is becoming harder than ever to distinguish them from legitimate customers," continued Pandey.

"It is only by looking holistically at the context of the transaction, along with all the information we know about the user, that organisations have the power to stop fraudsters in their tracks."

She said businesses must become smarter at detecting every type of attack, including automated identity testing sessions and those that seemingly hijack individual accounts.

"This starts with really understanding the digital identities of consumers so that high-risk behaviour can be detected in real-time," she explained.

Another way businesses can help to quash the threat is by developing tools that can work out the difference between a human and a bot before the risk becomes a problem.