Dynamics Community Forum Thread Details

We are receiving reports of increased incidents of what is commonly referred to as “mule fraud”. This post outlines the characteristics of this fraud vector and helpful tips to tackle it.

Fraud vector : Mule fraud is where a fraudster uses common people without primary fraud intent as unsuspecting collaborators - “pawns” or “mules” - to carry out nefarious attacks. Often this involves taking advantage of unsuspecting people’s hardships by misleading them. In cases of targeting subscription or services, bad actors are posting work from home and part-time job openings. The applicants, or mules, are given a job offer and are advised to sign-up for certain subscriptions or services as part of their job. They are then asked to share the login credentials which the bad actors use for abusing the services or for re-sell. In case of targeting physical goods, bad actors are posting ads offering popular and basic necessity goods for free or at huge discounts. When viewers of the ad contact them, they are advised by the bad actors to place an order on the e-commerce website as normal. When the order is delivered, the mules are required to inform the bad actors who then call the e-commerce merchant to report that the goods were not delivered and request for a refund. When the refund is issued the mule pays a commission, a portion of the value of goods, to the bad actor.

Tips to tackle mule fraud : Undoubtedly, this type of fraud is one of the most difficult ones to prevent upfront since all characteristics of the subscription sign-up or purchase will have no resemblance or link to previous fraud. The “mules” are not professional fraudsters and they are not linked to previous known patterns of fraud. Some of these may even be linked previous non-fraudulent transactions from known customers. Hence, the most important move against this fraud vector is defense at depth strategy. In case of subscriptions or services, incorporate login & usage characteristics in your fraud workflows. While the initial sign-up may happen from the mule, subsequent logins to use the service can reveal fraudulent linkages to patterns or devices used by the bad actors. In case of physical goods, channel DNR (Did-Not-Receive) complaints to be submitted online to the maximum extent possible instead of accepting them over phone. The work put in by bad actors to earn the commission is to identify which merchants are vulnerable and then to report them. Channeling these complaints online will enable you to track device and usage characteristics to identify the pattern and also send a message to bad actors that you are actively monitoring this vector and send a message you are no longer vulnerable.

How you can use DFP to help you tackle mule fraud : Include account login risk and bot scores in your decisions. While initial sign-up may not seem suspicious, login assessments can reveal presence of this fraud vector where bad actors are logging to the accounts to take advantage of subscriptions and services. In case of physical goods, incorporate purchase assessment call on DNR complaints raised through web. You can use negative amounts for purchase amount field in the payload, to indicate these are refunds. And always update any fraud you identify through the labels API, to ensure the model’s assessment you receive are adapting to the patterns used to attack your business. In addition, augment any manual review workflows you have with detailed assessment and device data by using Manual Review (preview), event tracing features. Inform your review agents to take into account scores from all assessments as well as device details from device fingerprinting as part of their reviews.