Awards season is upon us, and at CogX last month, Keyless took home its first for the year 

Last month we attended the CogX 2022 awards in London – and to our delight we left with the award for 

 and Privacy! It’s always humbling for our team whenever we receive awards like these. 

Although Keyless is new, our technology is the result of almost a decade of research into mobile biometrics and privacy-preserving cryptography, as well as months of testing and development. For those that weren’t aware, we’re the first in the world to build a privacy-preserving solution that enables businesses to securely adopt biometric solutions without any risk to biometric data.

Powerful, Seamless and Private Authentication

With its privacy-first passwordless technology, Keyless is helping companies to improve customer journeys while strengthening compliance and reducing the overall impact of fraudulent account takeovers and identity theft.

Since we launched in 2020, we’ve continued to receive awards and nominations for our unique use of technology. While we’re very humbled by the awards, we’re also proud to share them with the world. 

Below is a list of awards and nominations we’ve received so far 

Keyless Wins Best Innovation in Data Protection Award at CogX London 2022

The use of Buy Now, Pay Later (BNPL) platforms has skyrocketed in the past two years.

 have become household names in their own right, as consumers embrace the idea of being able to purchase expensive items without needing to pay upfront. 

In addition to the obvious benefits of being able to afford items that are normally beyond a person's purchasing power, BNPL platforms have gained significant popularity due to their relatively frictionless approach to providing short-term consumer credit lines. 

BNPL websites rely on scant few details from applicants and, in many countries, don’t require a hard credit check. And despite economical constraints from the ongoing cost of living crisis in the UK and Europe, the BNPL market shows little to no signs of slowing down – with some of the world's most recognized fintechs 

, recently introducing their own BNPL payment schemes.

Unfortunately, as with virtually everything online, the popularity of BNPL has also attracted the attention of nefarious groups. Fraudsters and hackers are exploiting the lack of oversight on these payment platforms. 

BNPL is expected to be a major contributor to global fraud losses, which are forecast to surpass 

. Over the course of this article, we will highlight how BNPL platforms can enhance security and prevent fraud from occurring on their platforms. 

When discussing BNPL fraud, it’s important to understand the 

Generally, onboarding processes for opening BNPL accounts tend to be less rigorous in terms of identity verification when compared to traditional financial institutions which are regulated. 

As such, it's easier for fraudsters to commit identity theft and fraudulently open a BNPL account using stolen personal information. It’s also lucrative for fraudsters to launch account takeover campaigns, aimed at compromising the login credentials and OTPs to hack into existing BNPL accounts. 

According to a recent report from Sift, the leaders in Digital Trust & Safety, account takeover (ATO) 

attacks on BNPL platforms have gone up 54% in the last year

 – with most stemming from compromised passwords and one time passwords (OTPs).

There are several tell-tale signs of BNPL fraud that BNPL platforms should look out for:

Due to most passwords and billing information being saved on a device or web browser that they’ve previously signed into, the majority of end users tend to stick to the same device when making purchases online. If an existing account has login attempts from a number of different devices, there is a greater chance that this account has been compromised. 

When compromising a BNPL account, fraudsters may attempt to order goods to a new address. If purchases are suddenly being sent to a new address, this is a strong sign that a customer’s account may have been hacked.

BNPL platforms should pay close attention to their customers' account order history, while also encouraging end users to review their order history if their personal data has been compromised. 

BNPL platforms should also look to re-authenticate a customer when an unfamiliar transaction occurs. Typically, a radical change in the type and price of the items purchased will indicate that an account has been breached.

There are four types of BNPL fraud that customers and BNPL companies should pay close attention to.

Account takeover (ATO) fraud is where a fraudster uses stolen credentials and personal information to hack into a genuine user's BNPL account. ATO attempts on a BNPL account may be secondary to email ATO and SIM Swapping attacks – which enable fraudsters to capture OTPs sent by the BNPL account during authentication. To make matters worse, many customers typically use similar, easily guessable, or 

Similar to an account takeover, identity theft will involve a criminal using stolen personal information (emails, passwords, identity documents, addresses) obtained from another data breach) to open an account with a BNPL platform like Klarna. Identity theft can go further, in some instances fraudsters use stolen passports, driver’s licenses, bank cards, and mobile phones to set up new BNPL accounts and make purchases using the stolen identification.

This type of fraud is not too dissimilar to identity theft, whereby a fraudster will set up a new account to make illegitimate purchases. However, synthetic fraud differs from identity theft because the information used to set up the account is typically fake.

Friendly fraud refers to BNPL purchases often made by friends, family members, and young children that have accessed a customer’s device and made a purchase without the owner of the account being made aware.

What is Keyless & how can it help prevent BNPL fraud?

While BNPL fraud is alarming, it is possible for BNPL platforms to enhance their fraud prevention strategies by eliminating credentials, which are easily compromised, from the authentication journey. 

One of the best ways to prevent BNPL fraud is 

, the world’s most advanced passwordless authentication solution. Keyless enables BNPL platforms to enhance security by replacing credentials with biometric authentication. 

Biometrics have been proven to be safer and more secure than passwords and OTPs, both of which can be easily compromised with the right technology. With Keyless, customers are authenticated using a combination of 

and background device verification checks that help to ensure that login attempts are coming from a known device.

In this way, Keyless offers frictionless strong authentication during authentication, or 

whenever a high-risk purchase or action is made

Keyless also integrates with major eIDV/KYC vendors, helping to close the assurance gap between identity verification and customer authentication. Thanks to these integrations, Keyless is able to offer high assurance that the real person is logging in or attempting to make a purchase – making it difficult for fraudsters to use stolen personal information to open or hack into an account. 

, now is perhaps the best time to consider enhancing your authentication strategy by switching to a passwordless solution. 

How to Protect Against Buy Now, Pay Later Fraud with Keyless

In recent years, account takeover attacks have become more prevalent than ever, with fraudsters closing in on the financial services sector with new ways to defeat multi-factor authentication challenges.

In this blog, we’ll look at three emerging methods fraudsters are using to bypass multi-factor authentication and execute account takeover fraud, as well as how businesses can effectively mitigate these emerging threats. 

Despite the roll out of strong customer authentication, in 2021, 8

4% of financial services firms experienced account takeover attacks

. According to studies from Juniper, that number is only set to rise, 

with losses forecast to surpass $206 billion by 2025

Rather than being deterred by the improvements to authentication security, attackers are simply inventing new ways to capture multi-factor authentication (MFA) credentials, such as OTPs, to execute attacks. 

We’ll now look at the techniques listed below that fraudsters are frequently using to bypass MFA security:

SIM swapping is a major concern for financial firms and cryptocurrency exchanges, with attacks becoming more frequent and pervasive, increasing by over 400% the last five years in the United Kingdom. 

To carry out a SIM swapping attack, fraudsters exploit compromised and leaked personal information to impersonate legitimate customers and transfer legitimate phone numbers onto new, fraudulent SIMs.

Once a new SIM is activated on a fraudster's device, they will receive OTPs meant for the customer. They will then often use these to bypass and disable MFA, make fraudulent payments, and launch further attacks on the victim’s accounts and contacts.

According to the European Union Agency for Cybersecurity, 

there are specific circumstances that open the opportunity for SIM swapping. These include

It goes without saying that these attacks can have serious financial repercussions for victims. Last year, 

Canadian police arrested a teenager for stealing a staggering $36 million from a single victim through a SIM-swapping attack

, and in Europe, criminals leveraged SIM swapping methods to 

steal over $100 million from US celebrities.

Another advanced method being used to capture OTPs are reverse proxy scams. Reverse proxy scams are a type of man-in-the-middle phishing attack that enable fraudsters to steal (MFA) credentials and session cookies from victims without the victim’s knowledge. 

To execute a reverse proxy scam, attackers intercept a victim’s credentials using a proxy web server that essentially acts as a layer between the victim and the website they’re attempting to login to. 

Microsoft announced this year that approximately 

10,000 organizations had been targeted with fake Microsoft Office login pages

. The campaign led the user to an attacker-controlled proxy site that sat between them and the server they were attempting to log into.

Reverse proxy scams like these use a number of advanced steps to capture genuine MFA credentials:

Unfortunately, these attacks can be especially insidious, as targets are often completely unaware that they’re being hacked, until it’s too late. Exacerbating the problem, b

ad actors can now purchase “phishing kits” online to execute such attacks 

– meaning you do not necessarily have to have the technical skills to launch attacks. 

The popularity of BNPL platforms, like Klarna and Clearpay, has recently exploded, 

with BNPL customers now exceeding 360 million globally

The adoption of BNPL payments has created an unprecedented opportunity for fraudsters, who are taking advantage of weaker security standards adopted by BNPL services and their retail partners.

Bad actors are attracted to BNPL accounts because there’s more opportunity to execute an account takeover attack. 

ATO attacks on BNPL accounts can be executed either by:

The latter method generally requires less effort as online retailers have weaker authentication standards compared to financial platforms and apps – meaning 2FA is often not required. 

Fraudsters can compromise a genuine customer's account either by purchasing compromised credentials online or by running automated credential stuffing or credential cracking attacks. 

According to recent research from Imperva, 

64.1% of account takeover (ATO) attacks make use of bad bots (software applications that run automated tasks such as credential stuffing)

, meaning they can execute these kinds of attacks en masse. 

Luckily, there’s a simple way for financial firms to protect their customers against these emerging threats, and that’s by eliminating passwords entirely – whether temporary or saved – from login and payment authentication flows altogether.

By eliminating all credentials, whether a password, PIN, or one-time code, businesses can effectively reduce account takeover threats caused by compromised credentials, phishing, and man-in-the-middle attacks to zero. 

By replacing passwords and OTPs with our advanced passwordless solutions, Keyless provides the ultimate protection against ATO attacks. Since there’s nothing to steal or phish, we help financial firms protect their bottom line and brand reputation, while simultaneously protecting their customers from the financial repercussions of fraud and cybercrime. 

3 ways hackers are bypassing MFA to commit ATO fraud

Between October 2020 and May 2021, nearly 

7,000 US consumers reported financial losses from cryptocurrency scams that totaled over $80 million

, a 1,000% rise from the previous six months.

Attackers are also becoming bolder, carrying out larger and more complex heists. In December 2021, BitMart – marketed as ‘the most trusted cryptocurrency trading platform’ – experienced a hack where approximately 

$190 million in assets was stolen from user accounts

In this blog, we’ll look at how Keyless can help exchanges stop account takeovers caused by compromised and weak credentials and SIM swapping.

Compared to traditional financial institutions, fraudsters are attracted to crypto exchanges because there’s a greater opportunity to steal funds without being caught, due to a lack of industry and regulatory oversight. 

Despite this oversight, a major attack can still have serious reputational and financial repercussions for an exchange. While not obliged to pay users back, in a bid to restore its reputation, 

BitMart promised to reimburse victims, costing it upwards of US $150 million

As well as this, the hack had operational consequences, with the exchange being forced to halt withdrawals until it identified the source of the attack, disgruntling customers even further. 

Often, the reputational and financial repercussions extend beyond the targeted exchange and its victims, causing a ripple effect that takes a toll on the entire crypto market. 

In 2016, the price of bitcoin fell 20% overnight after hackers stole 120,000 BTC

 (worth approximately US $2.3 billion) from Bitfinex, a Hong Kong-based exchange. 

,  attacks on Binance – the largest exchange in terms of trading volume – caused the price of BTC to fall once again, followed by an SEC probe. 

Likewise, the more recent BitMart attack has led to a probe by the FTC, 

. If the FTC discovers that BitMart misled its users over its security protections or didn’t comply with the law, this will have a major impact on consumer and regulator trust. 

Why authenticator apps and OTPs are failing the cryptocurrency industry

For years, cryptocurrency exchanges have enforced multi-factor authentication to protect users from attacks, mandating the use of authenticator apps, like Google Authenticator, or SMS 2FA. But with the evolving sophistication of cyber fraud and scams, hackers are finding ways around these security layers. 

In a display of this type of 2FA’s fallibility, in January 2022, 

 and stole $36.4 million in user funds, with over 483 accounts being affected.

To execute 2FA attacks, threat actors leverage stolen personal data and credentials to hack into an email account or steal a victim’s phone number, which enables them to fraudulently capture OTPs. Hacks like these are skyrocketing, with the 

FBI reporting over 1,600 SIM swap complaints in 2021, resulting in losses totaling over $68 million. 

In theory, third-party authenticator apps, like Google Authenticator, put a stop to threats from SIM swapping and email account takeovers, as they require the attacker to have access to the user’s mobile phone. However, bad actors have adapted methods to capture OTPs generated by apps.

One approach is to use reverse proxy websites that trick users into imputing genuine OTPs into a scam website, enabling fraudsters to gain access to private accounts by using them in real time. It’s also becoming easier for hackers to implement OTP bots and malware scripts designed for mobiles, which enable hackers to mimic mobile push notifications and applications, and combine them with email or automated phone calls to gain OTPs from unwitting users. 

, in the 2019 attack, hackers were able to bypass its 2FA systems by “

accumulating user account credentials over a long period of time

using Unicode domains, looking very much like binance.com

” that enabled hackers to capture the user’s OTP. 

After acquiring these user accounts, the hacker then simply created a trading API key for each account but took no further actions, until yesterday. Yesterday, within the aforementioned 2-minute period, the hackers used the API keys, and placed a large number of market buys

Passwordless authentication as a solution for crypto exchange security

When done properly, passwordless offers superior protection against account takeover attacks because bad actors have nothing to steal – no passwords, PINs, OTPs, or recovery seeds – that would enable them to otherwise fraudulently bypass authentication. 

Instead, passwordless solutions enable exchanges to:

However, not all passwordless solutions offer the same level of security, privacy, or consistency in terms of user experience. For example, magic links and social login have the same security risks associated with 2FA; and, due to multi-device limitations, passwordless solutions like FaceID don’t stop attackers from using stolen personal data and credentials to enroll for biometric authentication on other devices.  

As mainstream adoption of cryptocurrency increases, account takeovers targeting exchanges will continue to rise. To combat these risks, exchanges need to move away from legacy multi-factor authentication solutions that rely on weak authentication methods.

With our advanced passwordless solutions, Keyless addresses the issues of OTPs, passwords, and magic links by removing them entirely from the authentication journey. 

Instead, we provide strong authentication with a simple look into the camera by combining our patented privacy-preserving facial recognition software with invisible device verification, anti-spoofing, and liveness detection. 

Our privacy-preserving capabilities make it possible for cryptocurrency exchanges to identify genuine users via biometric authentication, without any risk to their biometric data or identity. In doing this, we eliminate the vulnerabilities of knowledge-based authentication and legacy 2FA, helping exchanges to strengthen their compliance posture and protect their brand reputation.

Awards season is upon us, and at CogX last month, Keyless took home its first for the year

Powerful, Seamless and Private Authentication

Below is a list of awards and nominations we’ve received so far

2022

2021

2020

Ready to get started?