CASE
STUDY

Recorded Future Helps Large Financial Institution
Proactively Anticipate and Mitigate Payment Fraud
Intelligence on Compromised Cards and Card Checkers Provides Proactive Warning Signs ofPotential Fraud
Use Case:
To provide financial institution’s fraud teamwith visibility into fraudulent card activity on
the dark web

Challenge:
Fraud detection and prevention is largely
reactive, after financial losses are incurredSolution:
Recorded Future’s Payment
Fraud Intelligence

Outcomes:• Shift to proactive, more efficient fraud
blocking• Reduction of false positives• Confidence to automate fraud processes• Prevention of fraud losses and improved
cardholder experience

Recorded Future has
truly helped us to mitigate
fraud, and many different
stakeholders can all cometo an agreement that theintelligence provided has
been really worthwhile."1

As payment fraud continues to rack up billions of dollars in losses, financial
institutions are looking for new ways to protect their cardholders. Reactively
attempting to limit losses after a fraudulent transaction occurs is no longer
sufficient. To protect their cardholders, one of the nation’s largest financial service
providers is taking a proactive approach to detecting and mitigating payment fraud
before it occurs.
Previously, the institution’s Cyber Threat Intelligence (CTI) and Fraud teams
relied on specific behavior rules to alert them to suspicious cardholder activity,
typically after fraudulent transactions had occurred. For example, if someone wereto suddenly purchase a large amount of gift cards the fraud rules may kick in.
However, they had limited information on what threat actors were doing on the dark
web, leaving them blind to threat actors’ new tools, tactics, and procedures used toskim, sell, and validate compromised cards.
These days the CTI and Fraud teams rely on Recorded Future’s Payment Fraud
Intelligence for valuable external data about threat actor activity on the dark web.
By helping to detect compromised cards and known tester merchants (merchantsbeing used by fraudsters to test the validity of stolen cards), the data provided
by Recorded Future identifies accounts at higher risk of fraud. Enriching theinstitution’s fraud rules with this actionable data enables them to disrupt fraudsters
before they can monetize stolen payment data, preventing fraud and cardholder
disruption from occurring.

Actionability and Automation Stop Fraud in Its Tracks
Recorded Future Payment Fraud Intelligence identifies compromised cards being
sold on dark web carding shops, and provides the institution with a continuously
updated feed to match the stolen payment card information with their internal
records. This helps enhance the detection rules in place, and enables them to takeproactive measures to ensure fraudulent activity is blocked.

Recorded Future® | www.recordedfuture.com

We find a lot of stolen cards manuallyand it's worth the human resources to doit, but that approach doesn't compete withthe automation that comes from the highly
actionable feeds that Recorded Future
gives us."
Actionability of the data is critical. “If it’s not actionable, it’sa big waste of time, both for the internal associates and forour cardholders,” explains the CTI VP. When fighting fraud,
time is of the essence. The sooner fraudulent behavior isdetected, the lower the financial losses. “When transactions
occur on customer cards identified by Recorded Future as
being present on the dark web or used on known tester
merchants, most of the time the transaction is actuallyfraudulent,” says the CTI VP. “When we ask for their
feedback, the fraud team is always pleased, and they
think it's very actionable.”
In addition to the compromised card data, the financial
institution incorporates intelligence from Recorded Future
on card checker services and the tester merchants they use.
Dark web marketplaces are known to use these services todetermine if compromised cards are valid prior to postingthem for sale, whereas criminals use card checker services
for the same purpose prior to monetizing them. Recorded
Future tracks major card checker services to identify thedozens of different tester merchants they use each week.

A Measurable Reduction in Fraud Risk
“Using the checker data has been extremely helpful in trying
to determine if there are those test charges on cards, which
signals we need to go and take action,” says the fraud
threat hunter.
Intelligence from Recorded Future has led to theidentification of at least 2 times as many at-risk active
customer payment cards as the institution’s manualcollection efforts via other vendors’ dark web forum
collections and peer-shared payment cards.
“We have really high confidence in Recorded Future —enough confidence to automate it. That’s Recorded Future’s
big advantage: automation,” says the CTI VP. The CTI teamhas other vendors who scan the dark web, and from theirintelligence, the team manually finds and reports stolencards to fraud operations. “We find a lot of stolen cards
manually and it's worth the human resources to do it, butthat approach doesn't compete with the automation thatcomes from the highly actionable feeds that Recorded
Future gives us.”
Recorded Future’s ability to prevent financial losses andimprove cardholder experience has made an impact acrossthe company. The CTI VP emphasizes, “Recorded Future
has truly helped us to mitigate fraud, and many different
stakeholders who have different missions and don’t always
communicate very frequently, they can all come to anagreement that the intelligence provided has been reallyworthwhile for us.”“The card checker data provides a critical feed that enables
us to quickly see that fraud is about to occur,” says a fraud
threat hunter at the institution. The identification of thetester merchants being used by card checker services helps
the institution immediately raise the risk score of cards
that are conducting low-dollar transactions or zero-dollar
authorizations with known tester merchants.

ABOUT RECORDED FUTURE
Recorded Future is the world’s largest threat intelligence company. Recorded Future’s Intelligence Cloud provides end-to-end intelligence across adversaries,
infrastructure, and targets. Indexing the internet across the open web, dark web, and technical sources, Recorded Future provides real-time visibility into anexpanding attack surface and threat landscape, empowering clients to act with speed and confidence to reduce risk and securely drive business forward.
Headquartered in Boston with offices and employees around the world, Recorded Future works with over 1,700 businesses and government organizations acrossmore than 75 countries to provide real-time, unbiased, and actionable intelligence.
Learn more at recordedfuture.com

2Recorded Future® | www.recordedfuture.com© Recorded Future®, Inc. All rights reserved. All trademarks remain property of their respective owners.