Deception shows its face in many forms within online gaming.
Thanks to major data breaches and the rise of the dark web, personally identifiable information (PII) including names and email addresses is easy to acquire, which fraudsters can then leverage to trick gaming sites. According to the Q2 2018 ThreatMetrix Gaming and Gambling Cybercrime Report, identity spoofing is the biggest threat in online gaming fraud, with cybercriminals using spoofed or stolen identities to open new accounts (and snag sign-up bonuses) and place fraudulent bets.
Fraudsters also use these stolen identity credentials to take over existing accounts and seize control of any funds or loyalty points connected to the account. Account takeover tripled over the past year, with losses reaching $5.1 billion, according to the 2018 Identity Fraud Study by Javelin Strategy & Research.
Identity spoofing isn’t the only cause for concern, though — location spoofing became the fastest growing attack vector in the online gaming space, increasing 257 percent year-on-year, according to the ThreatMetrix report. Online gaming is a global industry with a high volume of cross-border traffic, which can prove challenging for gaming operators who are on the hook for meeting geographic jurisdiction requirements. Cross-border transactions, coupled with location spoofing, make it harder to verify the true location of a player. With location spoofing, fraudsters attempt to disguise their true location using increasingly sophisticated location spoofing tools in order to work around regional restrictions or to launder money.
Many online gaming operators have already onboarded online identity verification solutions out of a need to meet Know Your Customer (KYC) and Anti-Money Laundering (AML) mandates. But responsible operators should also leverage these solutions to do a better job at actual fraud detection in order to mitigate the high risk of financial loss. The growing prevalence of spoofing suggests that more attention and focus needs to be spent keeping fraudsters out (and letting the legitimate players in), and the right identity verification solution can help with these efforts.
Verifying the identity AND the location of players is key to combating spoofing.
The first step of the online identity verification process is to determine the validity of an individual’s government-issued ID. This on its own isn’t enough to ensure players are who they say they are, because IDs can be purchased on the dark web, stolen or convincingly altered or forged, and are therefore clearly not a reliable stand-alone indicator of identity. This is why identity verification solutions require the user to take a selfie, which is then matched the the face on the ID document, preventing a stolen or altered ID from passing. Criminals using spoofing attacks try to outsmart the system by using a photo, video or a different substitute for an authorized person’s face.
Gaming operators need to adopt robust online identity verification technology with biometric-based liveness detection that scans a 3D face with a standard 2D camera (built into most smartphones) to ensure the real user is physically present and that they match their previous enrollment, while also reliably detecting spoofing of the selfie. Adding liveness detection is yet another safeguard against a new spoofing threat — liveness spoofing — and this kind of liveness detection is another important weapon in the operator’s arsenal to mitigate against this growing threat.
The right identity verification solution also ensures geographic jurisdiction requirements are being met to help online gaming operators sniff out location spoofing attempts. One of the best ways to do this is through document verification and using a solution that pairs computer vision technology with document experts to extract and compare data from user-provided documents like credit card statements and utility bills to helps gaming operators determine that players are where they claim to be, thus helping to prevent spoofing and other types of fraud.
Want to learn more about how Jumio’s identity verification solutions can help gaming operators gain the upper hand over spoofing? We’ll be at Sigma iGaming Malta Nov. 28-30 and would love to see you there — find us at Stand B32.
