How Avito identifies fraudsters and combats fraud

Hello, Habr. I am Igor, the head of the team combating fraud on Avito. Today, we will discuss the eternal battle against scoundrels who attempt to deceive online shoppers through product delivery.

We have been fighting against fraud for a long time. Today's scammers deceive people by mimicking the interfaces and functions of online trading platforms. For example, they concoct schemes involving courier delivery on marketplaces.

In January 2020, ready-made instructions for scammers and all the necessary tools appeared online. Subsequently, self-isolation fueled the fire: those who previously deceived and stole on the streets and in apartments were forced to move online. Perhaps you have recently received persistent calls, messages in messengers, SMS, and emails from these 'fraudsters'. They pose as bank employees, law enforcement officers, distant relatives, or notaries. Please comment on the type of fraud you encountered most recently.

Standard Fraud Schemes

The most common scam scheme involving product delivery looks like this:

1. The fraudster posts an advertisement with a popular product in the mid-price range. For example, they sell an electric scooter — a popular item in the summer.
2. They use various means to convince the potential buyer to opt for delivery. The excuses can vary: they might say they have left town due to the pandemic or that they are simply too busy to meet.
3. Upon receiving consent, the fraudster sends a fake payment link. The page linked resembles the standard Avito form.
4. The victim makes the payment and says goodbye to their money.
5. The fraudster tries to earn more money by offering to refund the payment. They send the buyer a new form for the money return, but in reality, they charge it again. The return page is the same as the payment page, but the text on the button has changed from 'pay' to 'refund'.

Below is an example of a fake page that a scammer might send. The domain mimics Avito, and the site looks like an order confirmation page from an online store. Fake pages often appear on the https protocol, making them indistinguishable by this criterion. After entering their details, the user is redirected to a payment page where they are prompted to enter their bank card information.

Fake payment and refund pages.

We block suspicious sellers. Therefore, to carry out such operations, scammers need to constantly create new accounts on Avito. They either register them independently using SMS on a temporary virtual number or buy stolen accounts. A virtual SIM card costs about 60 kopecks, while a stolen account on the gray market costs from 10 rubles. The expenses for either option are invariably less than even a single income from deceiving users.

This was Avito Scam 1.0, but versions 2.0, 3.0, and even 4.0 have already emerged. These are not our designations; they are used by the scammers themselves.

They deceive not only buyers but also sellers. The second scheme looks like this:

1. The buyer supposedly sent money through a secure transaction.
2. They send the seller a fake link where the seller can supposedly receive payment.
3. The seller lands on a page that asks for their card details, and in the end, the amount is deducted from their account.

The Scam 3.0 scheme works like this:

1. The seller posts ads with delivery activated through Avito.
2. When the buyer pays for the product, the scammer sends them a screenshot in which Avito supposedly requests a confirmation code.
3. Using the code, the seller accesses the user's account. In the buyer's profile, the scammer checks a box indicating that the buyer received the product. The buyer ends up without money and without the purchase.

And the scheme 4.0 is arranged as follows:

1. The buyer pretends to have paid for the product and sends a fake receipt. Receipts can be sent anywhere: to email or to a third-party messenger. It depends on what contact the seller provided to the scammer.
2. The seller receives an SMS that mimics a credit from the bank.
3. After a few minutes, the buyer writes that a product from another seller would suit them better and asks for a refund. Often, the argument "refund it, you are not a scammer" comes into play. The seller refunds the buyer, but from their own pocket, as no payment was actually made.

What scammers put pressure on

Five most common scenarios where people fall into the hands of scammers:

1. Unique selling proposition. The price or product significantly differs from other offers.
2. Hype. The seller has several buyers interested in the product, so they force a prepayment.
3. Urgency. The buyer offers to buy the product urgently for any price and asks for all the bank card details to transfer the money.
4. Kindheartedness. The scammer asks for help in purchasing a product: for example, the buyer has health problems or cannot pick up the product in person. The scammer asks for card details to transfer the money, claiming that a courier will pick up the product.
5. Different localities and cities. In this case, prepayment is a mandatory condition of the deal, which opens up a huge field of activity for scammers.

The 'work' scheme of scammers

The fraudulent scheme involves three groups of individuals: workers, support, and TS.

Workers, from the word 'worker', are the largest group, mainly consisting of schoolchildren and students. They independently create accounts on Avito and look for victims, referred to as 'mammoths'. They then use social engineering skills to convince the victims to pay for something and send a fake link. If the victim pays for the 'product', the workers' task, with the help of support, is to lead the victim to a refund, citing some technical issue.

Support consists of people who, for a fixed income, help novice workers deceive users. They provide advice, recommend 'profitable' products, and often, for a percentage of the fraudulent transaction, are willing to offer other services, such as preparing a fake passport in Photoshop, calling the victim, or writing to them on behalf of technical support.

TS, or Topic Starters on shadow forums where workers were originally recruited, essentially serve as organizers. They download or purchase software that consists of two parts:

1. A Telegram bot that serves as the primary tool for scammers. It provides a fake link to a product, sends notifications about transitions or payments.
2. Web version that handles the display of the payment/refund/receipt page. The payment system for processing transactions is connected to it.

Organizers profit from a percentage of each victim's transfer, referred to as profit. Therefore, they strive to promote their project and pay support staff to train newcomers. They also bear all costs associated with purchasing new domains and cards that receive the funds.

After reviewing the source code of many fraudulent scripts, we concluded that most are written in PHP, but at a very poor level. Almost all scripts collect information about their users, including the workers. One of the hypotheses as to why they do this is that when law enforcement approaches the organizer, they will cooperate with the investigation and attempt to reduce their sentence by revealing the workers.

In addition to scripts, scammers use bombers. These are bots that allow spamming the phone with text messages and calls. Bombers operate by visiting various websites and requesting registration or password recovery using the phone number. Typically, scammers link them to their victims for 2 to 72 hours. This is an important reason not to display your phone number online.

Some scammers also hire developers to make improvements for the bot or website. For example, they may add worker ratings or secure scripts against vulnerabilities present in free versions. However, in the pursuit of quick profit, the scammers may take all the revenue for themselves, deceiving their own workers. At the same time, there is a group of individuals who profit from the scammers by scamming them for various services.

The average daily income for a performer-scammer is 20,000 rubles, while for an organizer-scammer, it is 200,000 rubles. The main thing to remember is that despite the apparent impunity and benefits of the 'business', all these activities fall under Article 159 of the Criminal Code of the Russian Federation. Scammers are detained and given actual sentences even in cases where the damage from the fraud is 5 to 7 thousand rubles.

All information we have regarding fraud is forwarded to law enforcement authorities. We are convinced that despite the apparent profitability and ease of the scheme, our readers understand that only naive individuals who are unaware of all the risks engage in fraudulent activities.

An Epic Battle Between Anti-Fraud and Scammers

We will share the steps we took in the first months of 2020 to protect our users and how scammers responded.

The primary metric we focused on to assess effectiveness was the number of support requests related to payments made to scammers. We block most fraudulent listings before they reach the site. However, when almost all trading moved online, we recorded a surge in requests. Banks confirmed this information: in April and May, they sent out mass warnings about the rise in fraud during online purchases.

To receive quick feedback on new tools, someone from our team infiltrated dozens of closed scammer groups. In one of them, he was interviewed for a developer position and gained access to the source code of scam bots, as well as joined a group of organizers. Thanks to this, we always had fresh information from the source.

Understanding the risks triggered by the onset of self-isolation, we began working before the surge in requests. One of the first technical measures was the implementation of anti-hacking protocols to rescue user accounts from the hands of wrongdoers. For this, if the username and password were entered correctly but the geographic location seemed suspicious, we requested a code via SMS that was sent to the account owner. In response, scammers started registering more independent accounts. This works to our advantage — fresh seller accounts instill less trust in everyone.

Next, we began warning users about clicking on suspicious links in messenger apps. This reduced the number of clicks by a third, but it had almost no effect on our primary metric: those deceived by scammers were not deterred by any warnings.

Next, we introduced a whitelist for links. We stopped highlighting unknown links in the Avito messenger; they can no longer be clicked. When copying a suspicious link, we also displayed a warning. This solution positively impacted our metrics for the first time.

We started actively penalizing the transfer of suspicious links in the Avito messenger by blocking or rejecting seller postings. In response, scammers began luring users out of our chat into external messengers. So, we rolled out a warning not to switch to another messenger if we see its mention in the chat. This feature started with a regular expression search, and then we replaced it with an ML model.

Then, scammers began luring users to email. For that, they needed the same thing we all do—trust. They started sending potential victims images showing that Avito allegedly asks for the buyer's email. This is a deception—customer emails are not needed.

Here, our support supposedly responds that an email from the buyer is required for delivery.

And here, our interface seems to have a new field for entering an email.

While someone could still distinguish a fake link, an email can be easily forged in quality, and it inspires more trust. We started removing messages containing email and showing a warning to the user about the dangers of such action. If a user resends the email after the warning, we no longer remove it.

Scammers started asking buyers to send their email address in several messages or by replacing the @ symbol with something else. So, we began displaying a warning even when requesting the email. This set of measures almost completely prevented users from leaving the Avito messenger for email.

Our current mechanism is quite effective but not user-friendly. Messages containing email are completely removed, and they often contain other text as well. However, this was the fastest and cheapest solution to develop. We are considering how to redesign and improve it.

One of our latest initiatives is to call the listed phone number. Typically, the numbers used by scammers to register accounts do not last long. We call the seller's number after an ad is posted on Avito. If we're unable to reach them, the moderation team rejects the ad. Scammers have started changing their phone numbers right before publication so that we can call them while the number is still active.

And here's feedback from a scammer.

In suspicious cases, we lower the ad's priority in search results and remove it from recommendations. At the same time, we impose a delay of up to 48 hours in the results to ensure we have time to check everything carefully and cause scammers a bit more inconvenience.

This is just the tip of the iceberg; there are many more types of fraud.

Unfortunately, it's impossible to describe all types of fraud in one article. When we learned about the introduction of the lockdown, it became clear that scammers who made their money offline would turn to online methods. They wouldn’t want to change their behavior patterns for a few months and become decent citizens. This led to a real surge in fraud across all online platforms and via phone.

Among the types of fraud, there are rare and even amusing cases. For example, here a scammer pretends to be a robot to reduce communication costs:

Despite the fact that the number of scammers on Avito decreases every day, and raids are taking place across the country where law enforcement officers find them, despite proxies and VPNs, arrest them, and bring them to real sentences of up to 2 years in prison for scams ranging from 2500 to 5000 rubles, it's impossible to completely eliminate fraud.

We will not publicly discuss other ideas and innovations to avoid making it easier for scammers. We understand that this battle will continue. Our task is to make life as difficult as possible for scammers, making such activities on our platform simply unprofitable and too risky, while minimally impacting good users.

Results of our efforts

Here is the graph of support requests related to fraud in deliveries. For the past few weeks, it has remained at a consistently low level:

How to avoid becoming a victim of a scammer

Fraudsters are a spoonful of tar in a barrel of attractive offers. To stay safe, simply follow these rules:

1. Do not share sensitive information. None at all: full name, phone number, address, email, date and place of birth, family and income details, card information, contacts in other messengers. Never divulge codes from SMS and push notifications.
2. Conduct all communication solely within our messenger, so we can alert you in case of danger.
3. Check the seller's rating and profile age. Low prices, recent registration on the site, and negative reviews raise suspicion.
4. If the 'Buy with Delivery' button is inactive, there are no delivery options through verified Avito partners. Other delivery methods always carry risks.
5. Do not click on links. A link for payment or receiving money should come as a system message in the Avito messenger. A legitimate link always starts with the domain www.avito.ru. Any other combinations of words and symbols are fraudulent.
6. Do not rush and make all purchases with a clear head. Pay attention to every detail. Fraudsters often pressure potential buyers and threaten to sell the item to someone else. Honest sellers are loyal and open to additional questions.
7. Do not make advance payments for any services unless you are confident in the seller.
8. Do not install any third-party extensions or programs.
9. If you see a suspicious profile or advertisement, report it to our support. We will verify the seller. It’s best not to trust anyone on the internet and to conduct additional checks.

Source: habr.com