Broadcom has launched Arcot Scam Defense, a feature of its Arcot 3-D Secure payment authentication service that is designed to block card-not-present transactions driven by social engineering, including after a cardholder has passed an authentication challenge.
3-D Secure is the protocol card issuers use to authenticate online card payments, and a cardholder may be asked to complete a challenge such as entering a one-time password (OTP) or using a biometric. Broadcom says that once the challenge is completed, the transaction is treated as legitimate and approved by a financial institution’s primary risk models, which are not designed to stop a legitimate account holder who is acting under a scammer’s influence.
Matt Cooke, vice president and general manager of Broadcom’s Payment Security Division, said fraudsters have turned to targeting customers directly. “By impersonating trusted brands and institutions, they trick cardholders into revealing passwords or completing step-up authentications,” he said. “Cardholders usually remain unaware that they have handed over the keys to the castle until after the scam.”
The new feature acts as a real-time second layer of defense during authentication. It analyzes transaction information, device intelligence, historical behavior and the challenge interaction itself for patterns that indicate social engineering. Broadcom lists examples such as differences in the location and behavior of the device used for checkout and the device used to authenticate, delayed OTP entry, the use of an alternative authentication method, or a significant physical distance between the two devices. The signals are evaluated together rather than relying on any single indicator, and the feature can integrate with third-party services that check whether the authenticating device is on an active phone call.
Broadcom says nearly half a billion dollars in fraud was reported over the last 12 months on successfully authenticated challenges. In pilot testing on a full month of live data, it says that reviewing just the top 1 percent of successful challenges at one major issuer would have protected an estimated $4 million in fraud, at a cost of 0.38 points off the issuer’s authentication success rate.
The company expects to add signals including cardholder and device attributes, along with a challenge history profiling engine that learns each cardholder’s past challenge behavior.
“Arcot Scam Defense closes a critical gap,” Cooke said. “It serves as the definitive safety net against social engineering attacks.”
Sources: Broadcom
–
By the ID Tech Editorial Team
