Attackers walk through the front door
by acting like real users


Criminals masquerade as customers by co-opting
real behavior, devices and even identities

Real Behavior: Attackers simulate entire populations of users with genuine human characteristics to conduct fraud at scale. For example, to test out thousands of stolen credit cards for validity, an attacker may record a genuine human session with the application, with real mouse-movements, key strokes, timing, etc., and then replay that interaction thousands of times.

Real Devices: Attackers hijack devices via malware and pretend to be the device owners. For example, an attacker may use man-in-the-browser malware to divert funds after a victim has successfully logged into her own bank account via MFA.

Real Identities: Attackers steal pieces of real people’s identities, to pass themselves off as those customers online. For example, an attacker may steal a username and password to hijack a user’s online account or use a social security number to commit identity fraud.

Credential Stuffing

Credential stuffing attacks are responsible for account takeover (ATO).

Fake Accounts

Bad actors use fake accounts to commit financially-motivated attacks such as reward abuse on retail sites and money laundering via online banking.

Credit Application Fraud

Attackers use stolen personally identifiable information (PII) to open an account in another person’s name.

Gift Card Cracking

Attackers check millions of gift card number variations on a gift card balance lookup application to identify card numbers that hold value.

Scraping

Attackers use automated tools to collect large amounts of data from a target application in order to reuse that data elsewhere.

You used a Shape-protected application 10 times this week

Shape protects over 4 Billion transactions per week from imitation attacks on behalf of the world’s largest companies. So when you search for flights online, check your bank balance on your phone, or order clothes via Alexa, chances are, Shape protected that experience.

Shape Enterprise Defense

Mitigates automated attacks on web and mobile applications.

Blackfish

Alerts enterprises when users’ credentials have been compromised, proactively preventing account takeovers.

May 9th: Join a live webinar to learn how Starbucks partners with Shape Sign Up