The crypto landscape has often been seen as having trigger-happy, larger-than-life personalities. A place where the law only pokes its head in when it’s absolutely necessary. A wild west, in other words.
Most often, this is in reference to the high-profile exchange operators and the low-profile money launderers. Crypto exchanges may sometimes look to bend the definition of customer due diligence (CDD) and KYC in the name of onboarding more customers or providing a better experience.
But their finance-democratizing, control-decentralizing, owner-anonymizing approach can also invite unwanted criminal business.
While lawmakers develop scrutiny protocols to better monitor how these ecosystems operate, this space still offers opportunities to payment fraudsters who would take advantage. Here’s how to better protect your crypto business from payment fraud.
Why Is Payment Fraud a Problem for Cryptocurrency?
The inherently anonymized, low-scrutiny crypto exchange environment offers a more accessible playground for payment fraudsters. Naturally, every vertical of online business needs to have payment fraud on-radar, but crypto exchanges will always have trouble balancing security – and compliance – with the low friction experience that their customer base asks for.
This creates an alluring environment for instances of credential stuffing, targeted phishing attacks, payment with stolen cards, money laundering and account takeovers (ATO). The ability of cryptocurrencies to be fully “tumbled” to the point they are untraceable makes payment fraud in DeFi marketplaces an even more dangerous prospect.
Common Types of Cryptocurrency Payment Fraud
The following prevalent fraud tactics are not necessarily unique to crypto exchanges but offer unique challenges. They are not necessarily payment fraud in and of themselves but theft and payment fraud are their only possible outcomes when dealing with fraud and crypto assets. Types of crypto payment fraud include:
- Credential stuffing is a major threat for crypto exchanges. Fraudsters use breached username-password pairs and automated bots that rotate IP addresses to test login attempts. Because many exchanges prioritize low-friction access, they often skip protections like breached-password checks or device fingerprinting that more security-focused merchants use to detect and block these attacks.
- Phishing attacks ultimately lead to account takeovers and then payment fraud as well. They’re facilitated by the allure of much-hyped stacks of digital coins. Successful social engineering plots may result in the victim being tricked into simply handing over their login details, avoiding any of the possible security roadblocks that the exchange may (or may not) be exerting.
- Account takeover fraud often follows credential stuffing or phishing attacks. Once a fraudster accesses a crypto account, funds can be drained and laundered. If stored credit card details are used for unauthorized purchases, exchanges may face refund requests or chargebacks, leaving them responsible for both the financial loss and additional fees.
- Payments with stolen cards, such as credit card “fullz” from the dark web, are easier on platforms with limited security checks. While most merchants compare card details with buyer information, crypto exchanges often lack delivery address verification, making it harder to detect mismatches and increasing the risk of payment fraud.
- Money laundering in crypto is another pain point linked to this type of fraud, as the laundering can take place through exchange-enabled payments.
All of these threats are equally as present for companies accepting card-not-present payments, but crypto exchanges in particular want to smoothen bumps in the customer journey wherever possible. While this ushers in a userbase that is in favor of decentralization, pro-anonymity, and an overall off-the-grid mentality, it also lets payment fraudsters bypass security protocols more easily than at a non-crypto marketplace.
How Do You Detect Payment Fraud in Cryptocurrency?
For crypto exchanges to balance both low friction and high (or legally acceptable) security, fraud prevention platforms like SEON’s dynamic friction present a convenient payment fraud prevention software to effectively curb payment fraud.
A protocol of dynamic friction is where obviously good users, as determined by techniques such as IP lookup, browser and device fingerprinting, and email lookups, are presented with the smooth experience that crypto exchanges want. Meanwhile, users whose data returns red flags or question marks can be asked to complete hardened security checks, possibly submitting more data or completing MFA-type security measures. Obvious fraudsters will be flat-out blocked, if that is what the exchange’s risk appetite calls for.
The software scrutinizing data points throughout the customer journey, from onboarding to transaction, to look for anomalies like:
- passwords that have been associated with data breaches, risking credential stuffing
- multiple, apparently disparate users who have the same device fingerprint – also indicating credential stuffing
- accounts submitting payment data that appears very removed from the actual location as shown by device fingerprint or IP check – stolen credentials
- unexpected behavior like a large account suddenly changing payment details or draining the account – ATO
- new account registrations with new email addresses that are not associated with any other social media or online accounts – another potential indicator of an ATO attempt
SEON can be customized to monitor for these interactions, setting thresholds for what constitutes suspicion based on your company’s risk appetite. Notably, as regulations for both AML and customer safety coalesce into existence, these risk appetites may get reassessed. Thankfully, fraud management solutions like SEON can be endlessly retuned to fit into tighter security mandates, and ultimately help crypto exchanges steer clear of debilitating fines, or even sanctions.
Top 3 Custom Rules for Payment Fraud in Cryptocurrency
Crypto exchanges can deploy rules from the SEON platform that address the risks associated with payment fraud. Here are three such rules that help keep any merchant safe, yet be deployed dynamically to suit an optimized crypto exchange experience.
#1: Multiple Accounts With Identical Cookie Hash
Cookie hashes are part of browser fingerprinting. This rule helps detect credential stuffing attempts by identifying multiple login attempts linked to the same browser environment.
Automated bots testing leaked username–password combinations often run from a single browser without clearing cookies. If several accounts share the same cookie hash, it may indicate credential stuffing. When triggered at login, the rule can increase the user’s risk score or pause the session for further checks.
#2: User Has Never Connected from IP Country Before
This rule helps detect potential account takeovers (ATOs). When a registered user logs in from a country that has not previously been associated with their account, the system adds risk points to the user’s score.
For example, the rule might add +5 points, though this threshold can be adjusted depending on the exchange’s risk appetite. On its own, the signal may reflect legitimate travel, but combined with other risk indicators it can trigger a manual review by a fraud analyst.
#3: Suspicious Spike in User’s Spending
Monitoring sudden changes in spending behavior can help detect account takeovers (ATOs). This rule flags transactions that significantly exceed a user’s normal activity, for example purchases that are 200% higher than previous transactions.
When triggered, the rule increases the user’s risk score and may prompt a manual review or block the transaction. Thresholds can be adjusted based on the exchange’s risk appetite and historical fraud patterns.
SEON’s real-time protection, transaction checks, and login monitoring can be customized to stop account takeovers before they cause much damage.
Speak with an Expert
How SEON Helps Crypto with Payment Fraud
SEON’s dynamic friction-utilizing technology help cryptocurrency exchanges both fight fraud and maintain a smooth pathway from login to cryptocurrency transaction monitoring.
The methods that payment fraudsters employ to meet their nefarious goals are what SEON is engineered to prevent. The software suite shines when addressing the challenges that the crypto vertical faces: anonymity and necessarily low friction. Even users who connect anonymously, e.g. via a VPN, can be scrutinized for signs of malicious intent from the moment they log in, or attempt to.
By deploying SEON together with enforcing best practices such as spreading awareness of account takeover fraud prevention among your users, you can fight back against payment fraud as well as keep friction to a minimum, ensuring legitimate users appreciate their experience on your platform.
Related Case Studies for Cryptocurrency
- Crypto Platform Deploys SEON Custom Velocity Rules to Block Money Launderers and Cut Down Fraud by 60%
- FIAT <> Crypto API Reduces Weekly Chargebacks From $40K to $0 Thanks to SEON
