How mobile ad and carrier billing fraud flourished during COVID-19 pandemic

Telecoms.com periodically invites expert third parties to share their views on the industry’s most pressing issues. In this piece Geoffrey Cleaves, Head of Secure-D at Upstream, looks at how the unique circumstances of the past year or so have affected the fraud environment.

As the world anxiously waits out a global pandemic, cyber thieves have been taking full advantage of our lives getting increasingly and rapidly digitalized to commit mobile fraud of epic proportions. Fuelled by unprecedented global uncertainty, mobile fraud has evolved to become a problem that is estimated to cost the wider industry as much as USD $20 billion.

What happened in 2020?

COVID-19 caused havoc, fear, and financial loss in myriad ways. With people trapped inside, mobile engagement rose exponentially as people connected virtually with family, friends and co-workers. This trend drove a shift in mobile fraud techniques exploiting process, control, and technical weaknesses in the mobile ecosystem. In turn, this caused operators – especially in emerging markets – to incur hefty financial and reputational losses through malicious apps and fraudulent ad clicks.

To assess how severely the pandemic has impacted the mobile ecosystem — and how it could change the playing field in the future, Upstream conducted a large-scale analysis of over a billion mobile transactions. Let’s take a look at some of the key findings from the Mobile Ad Fraud 2021 Report:  A Pandemic on Mobile.

Mobile ad fraud fallout

Half of all digital ad fraud is implemented via mobile communications. In 2020, mobile fraud was most often conducted through two common methods. Together, these two techniques significantly affect the entire mobile ecosystem:

For mobile operators, carrier billing fraud creates an erosion in customer loyalty and confidence, ultimately leading to churn. Customer service departments can become flooded with calls from angry subscribers who have been tricked into unwanted purchases or billed for high data usage. At the same time, advertisers will spend large sums of money on fake actions.

It’s a lose-lose situation for all involved, except the fraudsters.

Key facts at a glance

Aggregate data collected from 35 operators across 23 countries highlights the scale of this problem in the year of the pandemic:

In an effort to remain undetected, mobile fraudsters looked to make small individual profits from a large number of users. As a low risk – high reward crime that can be difficult for mobile operators to tackle without the right systems in place, the true cost of this fraud is likely far greater than the numbers above suggest.

The issue is only made worse by the fact that end-users in emerging markets are often the target. These regions tend to have a larger number of people going online via their mobile phones for the first time, largely relying on Direct Carrier Billing for purchasing goods and services.

Risky game play

In much the same way that many of us adopted a ‘new normal’ during the COVID-19 pandemic, mobile cyber criminals found new ways to adapt and avoid detection. According to report data, fraudsters focused their efforts on fraudulent activity that exploited a desire for light entertainment, as well as the need for information about the pandemic.

As a result, 2020 saw the largest proportion of malicious apps in the “games” category (21%), followed by “tools and personalization” apps (20%) and the “entertainment and lifestyle” category (17%). This comes as no surprise as consumers spent more time at home looking for entertainment and diversions on their mobile devices. In other words, fraudsters followed the money trail.

Likewise, cyber predators didn’t think twice about preying on the uncertainty and fear caused by the pandemic. Report data reveals a surge in “pandemic news apps” promising access to unreleased information about COVID-19. Many of these apps, however, disguised a ruse to encourage unwitting end-users to enter their personal data.

2020 also saw many “copycat” apps made to look and feel like official, government-sanctioned mobile applications designed to track local infections and inform citizens. In reality, these apps install malware to gather sensitive data such as passwords and bank details.

What next?

Mobile ad fraudsters were already operating like multinational businesses before the pandemic. Yet this ecosystem became much more elaborate in the past 12 months with an operational structure that is:

Along with the spread of the COVID-19 virus, we’ve seen a virulent spread of fraud throughout the mobile industry. Even so, preventing mobile fraud has not been a key focus for industry leaders, despite the risks being higher than ever before. In fact, more than half of mobile operators (52%) admit to having no data security strategy in place at all.

Mobile operators, app developers and advertisers all share the burden of losses caused by mobile fraud. But there are steps they can take to mitigate the risks, such as:

Tackling this issue will require a concerted effort throughout the industry ecosystem, as well as vigilance on the part of mobile subscribers. But considering how we all came together to slow the spread of a global pandemic, perhaps slowing the spread of mobile fraud is not an impossible task.

Geoffrey Cleaves is Head of Secure-D at Upstream. He has a successful track record of providing direction, technical leadership, management, and implementation of leading edge information solutions. Secure-D provides real time fraud detection to mobile operators and digital marketers either as a standalone solution or integrated into Upstream’s GROW platform for user acquisitions & engagement.