Home

In the past two years, call center fraud has grown at an alarming rate. Attackers target call centers to gain access to funds, as well as gathering, testing and augmenting personal data to use in future fraud attacks or to sell on the black market. To learn more about these attacks, the research team at Pindrop Labs has analyzed more than 10 million calls to major enterprise call centers between 2011-2016. These researchers believe the rise in the number of attacks can be traced to a migration of fraudsters to the phone channel, which is the weakest link into an organization. Factors influencing this migration include the US rollout of chip credit card technology, the global increase in data breaches, and stronger online and mobile security.

 

 

Stronger online and mobile security, recent data breaches, and the rollout of chip cards in the US means cybercriminals are changing tactics, exploiting the weakest link in the organization: the call center. Pindrop Labs researchers reviewed over 10 million phone calls to enterprise call centers between 2011-2016. In this report, enterprises will gain a deeper understanding of the growing threat of call center fraud, as well as the level of attacker sophistication.

 

Call centers have many vulnerabilities that make them an attractive target for fraud:

 

 

For the purposes of this report, call center fraud represents any interaction between a criminal and a call center agent. Though many of these calls involve attempting to complete a fraudulent transaction, the majority of fraudulent calls do not. Pindrop research suggests that a criminal makes up to five calls before completing the fraudulent transaction. Think of these calls as “pre-fraud.”  Examples of pre-fraud calls include:

 

Fraud in the call center has wide ranging effects on an organization. Online, mobile, and physical channels have many layers of strong authentication and security. Meanwhile, most call centers rely on ineffective security measures like Caller ID, live agents, and KBA. Criminals use the call center as a back door to the organization. Here, they complete pre-fraud, which allows them to move across channels to pass further authentication and complete attacks. Pre-fraud phone calls set the fraudster up for later cross-channel attacks. Aite Group research suggests 61% of all fraud activity can be traced back to the contact center, with several financial institutions reporting rates as high as 90%.[2]

The number of fraudulent calls received by the average enterprise call center continues to grow dramatically. In 2013, call centers saw an average of 1 fraud call in every 2,900 calls received. This year, fraud rates are at 1 in 2,000 calls. This rate represents a 45 percent increase since 2013. There are three main factors contributing to this increase:

 

 

In 2015, enterprises lost an average of $0.65 to fraud per call. This means a call center that receives 40 million calls per year should expect to see somewhere between $17 million to $27 million in fraudulent transaction losses annually. Phone fraud losses have grown 14 percent since 2013, when the average loss was $0.57 per call.  According to a recent survey by the Aite Group, 72% of contact center executives expect this fraud loss trend to continue on an upward trajectory, almost doubling in the next five years.⁴

Increased fraud losses are a result of more sophisticated attackers with a greater amount of data at their fingertips. Today’s fraudsters are able to identify and target higher value accounts to efficiently maximize their earnings.

 

Note, Pindrop only measures losses from fraudulent transactions that take place through the call center. However, many more fraudulent transactions that take place in the online, mobile, or physical channels can be traced back to phone channel pre-fraud.

 

These pre-fraud calls also account for the different growth of fraud call rates (45%) and phone fraud losses (14%). The number of pre-fraud calls that do not request transactions has grown significantly.

 

 

Call center fraud carries further consequences than just the cost of fraudulent transactions. These factors are far more difficult to put a number to. They include:

 

Several factors, including calling device type and geographic call origin can indicate a potentially fraudulent call. However, though the use of Caller ID spoofing, voice distortion, and other tools, fraudsters can hide these risk-factors and make their calls appear legitimate. Call centers then must not only be aware of the risk factors that indicate fraud, but must also find solutions to quickly and accurately assess these factors in incoming calls, allowing them to overcome fraud technology and separate fraudsters from legitimate callers.

 

 

 

 

Phone fraud rates at banks, brokerages, credit card issuers, and credit unions are perennially high. These entities offer a clear route to a profit because they deal with financial transaction accounts. Yet, different types of financial institutions experience different rates of phone fraud.

 

Retail banks report a fraud call rate of 1 in every 1,400 calls. Credit unions and brokerages show slightly less risk at 1 in 2,000 calls and 1 in 2,700 calls respectively.  Credit union and brokerage industries see lower fraud rates because these account numbers are used less frequently than credit card or bank accounts, and consequently fewer are stolen and sold on the black market. In addition, it may be more complicated for a fraudster to monetize a brokerage account than a bank account.

 

Credit card issuers experience phone fraud at nearly double the rate of other financial institutions, reporting 1 fraud call for every 800 calls to the call center. This is because credit cards are widely used and widely stolen. Credit cards are relatively easy to monetize with Card-Not-Present (CNP) style attacks.

 

Fraud exposure among financial institutions is very similar between banks ($11M), brokerages ($10M), and credit card issuers ($11M). Credit unions, however, expose nearly three times the amount of other financial institutions, at $29 million annually. This may be traced back to the fact that credit union members often use their financial institution as a one-stop shop, holding multiple accounts at the same credit union. According to research from RAND, “On average, bank customers use 5.4 services with their primary financial institution, while credit union members use 7.1 services.”[4] Fraudsters who are able to pass credit union authentication in the call center generally can gain access to a larger selection of accounts and funds than in a typical bank.

 

 

 

Fraudsters are increasingly finding ways to monetize attacks against some types of insurance companies. These schemes are often more sophisticated than the typical attacks against a financial institution. In this section, we will highlight two very different types of insurance and the types of attacks they face.

Life Insurance call centers experience a relatively small volume of fraud calls. At 1 fraud call for every 12,000 calls, life insurance organizations had the lowest fraud rate of any industry Pindrop surveyed.

 

However, fraudsters are still at work in these call centers. The damage that  these fraudsters do can be significant. Life insurance call centers actually have the highest annual fraud exposure of any industry in this study, at $31 million per year per institution.

 

Fraudsters targeting life insurance call centers have found two ways to monetize an account. The most damaging attack is a fraudulent policy surrender request. When a legitimate customer surrenders a life insurance policy, the company pays the policyholder the cash value of the policy, minus any surrender charges.

 

Fraudsters impersonating legitimate policyholders have been able to access very large cash payouts using fraudulent policy surrenders. This attack requires an impressive level of sophistication on the part of the fraudster.

 

The more common scheme in life insurance call centers aims for a lower, but still lucrative payout. Fraudsters call a life insurance company impersonating a customer taking out a loan against a life insurance policy. These loans are rarely suspicious, and because many consumers do not monitor their life insurance policies closely, loans against policies can go undetected for many years.

Device insurance call centers are seeing fraud at the rate of 1 in every 300 calls, the highest fraud rate among industries Pindrop investigated. Device insurance companies offer replacement phones and other devices if a consumer’s device gets lost, stolen, or damaged. As mobile devices have become more popular and more expensive over the years, this type of insurance has grown. Subsequently, fraudsters have found ways to take advantage of this flow of desirable goods.

 

Criminals commit fraud in device insurance call centers by filing false claims. Fraudsters impersonate legitimate customers, asking for replacement phones, but redirect the shipment of the device away from the address on file. They may request that the new device be sent to a “work address” or the place they are vacationing. Once the fraudster has the new phone, he or she will then sell the device on the black market.

 

 

Fraud attacks vary across the globe. This year, Pindrop examined the differences between financial institution call center fraud in the United States and in the United Kingdom. This comparison is interesting because both countries speak English and have similar types of financial institutions. The major difference at play between the two countries is the fact that the UK has had chip card technology (there more commonly known as EMV or chip and PIN) since 2004. The UK offers the US a preview of how to expect fraud to evolve in the coming years.

 

UK call centers see more than double the fraud calls when compared to the US. Financial institutions in the US have a fraud rate of 1 in 1700 calls. In the UK, fraud rates are as high as 1 in 700 calls. This is likely because the UK has had chip cards much longer than the US, and the fraudsters have effectively transitioned to fraud attacks that do not rely on physical cards, such as those in the call center. According to the Aite Group, these fraud attacks grew 79% in the UK in the years following the chip card rollout (2005 to 2008).[6] See US Chip Card Rollout on Page 3 for more information.

 

UK fraud calls are mostly domestic. In the UK, 72 percent of fraud calls to financial institutions originate from within the UK. This compares to only 48 percent of US financial institution fraud calls originating within the US. Again, this trend can be linked to the UK’s extended use of chip technology. Years ago, when the UK implemented chip cards, fraudsters who used card-present tactics switched to non-physical attacks like call center fraud, rather than relocate out of the country.⁸ (See Domestic Fraud on Page 6 for further information on how this works.) The UK is not unique in this shift. After France implemented EMV cards, it saw domestic card-not-present fraud attacks increase by more than 360 percent between 2004 and 2009^.9

Most UK fraud comes from mobile devices. Mobile phones are heavily used for fraud in the UK. UK financial institutions see 64 percent of fraud calls coming from mobile devices, while US financial institutions only see 37 percent from mobile. In the UK it is easier for mobile phones to be programmed to show a restricted caller ID. In fact, 70 percent of fraud calls in the UK use a restricted caller ID, rather than spoofing a phone number.

For this report, Pindrop analyzed millions of calls globally, using Phoneprinting to dissect the details of attacker techniques and behavior. Pindrop’s patented Phoneprinting technology analyzes the audio content of a phone call. Phoneprinting measures 147 characteristics of the audio signal in order to form a unique fingerprint for the call. This information provides an unprecedented level of insight into the phone channel.

 

Phoneprinting determines a caller’s true location and device type. The Phoneprint is highly resilient –detecting voice distortion, Caller ID Spoofing, gateway hijacking and other obfuscation techniques. In addition, Phoneprinting helps to  identify multiple callers associated with the same phoneprint, which allows enterprises to track fraud rings. Phoneprinting is the only technology that can see through these attacker tactics.

 

Pindrop is the leader in voice fraud prevention and authentication. Pindrop provides enterprise solutions to reduce fraud losses and authentication expense for some of the largest call centers in the world. Pindrop’s patented Phoneprinting™ technology can quickly and accurately identify, locate and authenticate phone devices uniquely just from the call audio, on the first call and every call. Pindrop has been selected by the world’s largest banks, insurers, brokerages and retailers, detecting over 80 percent of fraud. Pindrop’s solutions allow customers to reduce call time and improve their customers’ experience even while reducing fraud losses. Pindrop was founded in 2011 and is venture backed by Andreessen Horowitz, Citi Ventures, Felicis Ventures, Google Capital, GV and IVP. In total, Pindrop has raised $122 million.

 

 

 

Pindrop Labs is a group of scientists focused on researching threats and vulnerabilities in the audio and telecommunications channels. This area, traditionally neglected from a security perspective, is increasingly favored by attackers for pre-fraud, exploitation, account takeover, and other attacks. Pindrop Labs’ research falls into two main areas: phone fraud prevention and securing the increasingly ubiquitous voice interface. Phone fraud prevention includes security for call centers, telecommunications infrastructure, and phone-reliant systems, organizations, and consumers. Securing voice interfaces includes providing authentication, threat detection, and fraud prevention for voice-enabled infrastructure.

 

 

 

Matt Garland has over 15 years of experience with contact center technology and is an expert in call recording systems. Prior to joining Pindrop, Matt was Vice President of Architecture at Nexidia.

David Dewey leads the Pindrop Labs team. David began his career at Internet Security Systems, where he worked as a vulnerability researcher and manager of the X-Force Advanced Research Team.

Kailash Patil is a leader on the Pindrop Labs team, researching in the areas of forensic signal processing, feature extraction, speech processing, pattern recognition, and machine learning.

Nick Gaubitch leads Pindrop Lab’s EMEA team. Nick’s research centers around contact center phone fraud, ad-hoc microphone arrays for speech enhancement, and law enforcement audio research.

Valerie Bradford has eight years of experience in the information security industry.

---