As the world anxiously waits out a global pandemic, cyber thieves have been taking full advantage of our lives getting increasingly and rapidly digitalized to commit mobile fraud of epic proportions. Fuelled by unprecedented global uncertainty, mobile fraud has evolved to become a problem that is estimated to cost the wider industry as much as USD $20 billion[1].
What happened in 2020?
COVID-19 caused havoc, fear, and financial loss in myriad ways. With people trapped inside, mobile engagement rose exponentially as people connected virtually with family, friends and co-workers. This trend drove a shift in mobile fraud techniques exploiting process, control, and technical weaknesses in the mobile ecosystem. In turn, this caused operators – especially in emerging markets – to incur hefty financial and reputational losses through malicious apps and fraudulent ad clicks.
To assess how severely the pandemic has impacted the mobile ecosystem — and how it could change the playing field in the future, Upstream conducted a large-scale analysis of over a billion mobile transactions. Let’s take a look at some of the key findings from the Mobile Ad Fraud 2021 Report: A Pandemic on Mobile .
Mobile ad fraud fallout
Half of all digital ad fraud is implemented via mobile communications. In 2020, mobile fraud was most often conducted through two common methods. Together, these two techniques significantly affect the entire mobile ecosystem:
- Social engineering or “invisible buttons.” Consumers are misled into clicking a link they wouldn’t normally click. Direct Carrier Billing payment channels, where users charge goods and services to their phone bills, are popular targets for fraudsters.
- Falsifying ad conversions (impressions, clicks, purchases) via click farms, bots, etc. This is where advertisers unwittingly pay scammers for machine-generated actions.
For mobile operators, carrier billing fraud creates an erosion in customer loyalty and confidence, ultimately leading to churn. Customer service departments can become flooded with calls from angry subscribers who have been tricked into unwanted purchases or billed for high data usage. At the same time, advertisers will spend large sums of money on fake actions.
It’s a lose-lose situation for all involved, except the fraudsters.
Key facts at a glance
Aggregate data collected from 35 operators across 23 countries highlights the scale of this problem in the year of the pandemic:
- 1 in 6 users conducting a carrier billing transaction, had malware infected devices.
- 95% of all mobile carrier billing transactions processed were fraudulent
- More than 45,000 malicious apps were identified
- 29% of malicious apps went through the Google Play Store, with 71% of malware-laden apps on unregulated, third-party app stores
In an effort to remain undetected, mobile fraudsters looked to make small individual profits from a large number of users. As a low risk – high reward crime that can be difficult for mobile operators to tackle without the right systems in place, the true cost of this fraud is likely far greater than the numbers above suggest.
The issue is only made worse by the fact that end-users in emerging markets are often the target. These regions tend to have a larger number of people going online via their mobile phones for the first time, largely relying on Direct Carrier Billing for purchasing goods and services.
Risky game play
In much the same way that many of us adopted a ‘new normal’ during the COVID-19 pandemic, mobile cyber criminals found new ways to adapt and avoid detection. According to report data, fraudsters focused their efforts on fraudulent activity that exploited a desire for light entertainment, as well as the need for information about the pandemic.
As a result, 2020 saw the largest proportion of malicious apps in the “games” category (21%), followed by “tools and personalization” apps (20%) and the “entertainment and lifestyle” category (17%). This comes as no surprise as consumers spent more time at home looking for entertainment and diversions on their mobile devices. In other words, fraudsters followed the money trail.
Likewise, cyber predators didn’t think twice about preying on the uncertainty and fear caused by the pandemic. Report data reveals a surge in “pandemic news apps” promising access to unreleased information about COVID-19. Many of these apps, however, disguised a ruse to encourage unwitting end-users to enter their personal data.
2020 also saw many “copycat” apps made to look and feel like official, government-sanctioned mobile applications designed to track local infections and inform citizens. In reality, these apps install malware to gather sensitive data such as passwords and bank details.
What next?
Mobile ad fraudsters were already operating like multinational businesses before the pandemic. Yet this ecosystem became much more elaborate in the past 12 months with an operational structure that is:
- Highly complex with many moving parts, exploiting the human psyche
- Involves many stakeholders at different levels
- Global in reach, operating across multiple jurisdictions.
Along with the spread of the COVID-19 virus, we’ve seen a virulent spread of fraud throughout the mobile industry. Even so, preventing mobile fraud has not been a key focus for industry leaders, despite the risks being higher than ever before. In fact, more than half of mobile operators (52%) admit to having no data security strategy in place at all.
Mobile operators, app developers and advertisers all share the burden of losses caused by mobile fraud. But there are steps they can take to mitigate the risks, such as:
- Prioritizing security from the planning phase and implement new security measures, particularly in developing regions where the risks of billing fraud are much greater
- Carefully choosing the right platforms and reliable third-party vendors for ad publishing and distribution
- Keeping track of data patterns with advanced AI and machine learning technologies to identify questionable traffic patterns and spot fraudulent activity.
Tackling this issue will require a concerted effort throughout the industry ecosystem, as well as vigilance on the part of mobile subscribers. But considering how we all came together to slow the spread of a global pandemic, perhaps slowing the spread of mobile fraud is not an impossible task.
