Summary
The 2024 Payment Fraud Intelligence Report from Recorded Future highlights a year of significant evolution in the fraud landscape, setting the stage for challenges in 2025. Key findings include a surge in stolen card data, with 269 million records posted across dark and clear web platforms, and a tripling of Magecart e-skimmer infections due to vulnerabilities like CosmicSting. Scam e-commerce and dark web card validation activities also saw notable increases, reflecting growing sophistication among threat actors.
Emerging trends indicate fraudsters’ increasing exploitation of modern payment technologies and social engineering to bypass anti-fraud measures. Predictions for 2025 include a rise in digital e-skimming and scam e-commerce, continued activity on dark web marketplaces, and persistent check fraud in the United States. The report emphasizes the need for financial institutions, merchants, and payment providers to adopt fusion intelligence strategies and rigorous verification processes to combat fraud effectively.
Key Highlights from 2024
Surge in Stolen Data
In 2024, 269 million card records and 1.9 million stolen US bank checks were posted on dark and clear web platforms. This surge reflects a combination of increased data compromise events and rampant reposting. Notably, card-not-present (CNP) data dominated, signaling the growing impact of e-commerce fraud.
Magecart E-Skimmer Infections
The volume of Magecart e-skimmer infections surged, reaching nearly 11,000 unique e-commerce domains—a threefold increase from 2023. This spike was driven by the CosmicSting vulnerability (CVE-2024-34102), alongside the use of out-of-the-box e-skimmer kits like “Sniffer by Fleras.”
Scam E-Commerce Websites
Nearly 1,200 scam domains were linked to fraudulent merchant accounts, with most registered in the United Kingdom and Hong Kong. Operators of these scams leveraged social engineering tactics and linked merchant accounts to defraud victims and monetize stolen data.
Dark Web Activity
Dark web marketplaces remained central to the fraud ecosystem, offering stolen card data and facilitating fraud workflows. Telegram, despite recent disruptions, continued to be a source of unique fraud data.
Trends to Watch in 2025
Digital E-Skimming and Scam E-Commerce
Fraudsters will increasingly target e-commerce platforms using advanced e-skimmer tactics and scam websites. The adoption of digital wallets will further expose vulnerabilities in payment ecosystems, particularly through OTP interception techniques.
Dark Web Marketplaces
Despite law enforcement efforts, dark web marketplaces will continue to thrive, offering anonymity and scalability. Platforms like Telegram will remain active, though less experienced threat actors may dominate these channels.
Persistent Check Fraud
The explosion of check fraud in the United States is unlikely to subside in 2025. However, advancements in prevention methods, including intelligence-driven strategies, will help financial institutions reduce losses.
Mitigation Strategies
- Encourage acquired merchants to identify and close vulnerabilities on e-commerce websites that threat actors can exploit to implant Magecart e-skimmer infections.
- Increase the rigor of merchant onboarding processes to deter threat actors seeking to fraudulently acquire merchant accounts.
- Enhance validation requirements for digital wallet provisioning attempts.
- Implement push provisioning through online banking applications.
- Leverage Recorded Future Intelligence:
- Establish intelligence feedback loops to align cybersecurity and anti-fraud teams for proactive fraud detection and prevention.
- Utilize Recorded Future insights to identify at-risk accounts, breached merchants, and fraudulent activities involving Magecart e-skimmers, scam merchants, tester merchants, and stolen checks.
- Use structured data and transaction analysis to automate workflows, block high-risk merchants, and implement fraud controls.
- Continuously fine-tune fraud prevention tactics using threat landscape data and internal input.
To read the entire analysis, click here to download the report as a PDF.
