Page 36 - gs260802

Insights and Expertise

From signup to signal:

How tumbling, sequencing and

gibberish reveal modern fraud

Gibberish is another structural indicator. At first glance,
these identities look random—strings of characters with
no obvious meaning. They are often produced by algo-
rithms designed to mimic randomness while adhering to
specific rules. That consistency, when analyzed at scale,
becomes detectable.
Velocity as a signal of coordination

Velocity adds a time dimension to identity creation, ex-
posing how structured patterns are deployed. Synthetic
and automated fraud is built for throughput. Tumbling,
sequencing and gibberish generation are not used in iso-
lation; they are executed rapidly and repeatedly. Large
By Diarmuid Thoma volumes of similarly constructed identities appear within
compressed timeframes, often targeting specific entry
AtData points such as signup flows or promotional campaigns.
raud has become an identity engineering prob- This speed is difficult to replicate through genuine user
lem. Automated tools now generate email behavior, so when identities sharing structural similari-
addresses, usernames and full account profiles
F at a scale that outpaces traditional controls.
These identities are not crude fakes; they are constructed When identity fraud reaches the merchant
to pass validation, blend into legitimate traffic and exploit For merchants, automated identity fraud may first
systems from the inside.
appear as something less dramatic than a stolen ac-
The shift requires a different lens to flag and protect count. A promotion suddenly attracts an unusual
against fraud. While we previously anchored identity number of new customers. Free trials multiply. Loy-
alty accounts proliferate. Signup volume spikes with-
fraud to whether an identity is valid, today identity re-
flects genuine human behavior. Answering that comes out a corresponding rise in genuine engagement.
down to how three identity signals—structure, velocity
and context—are interpreted in real time including some Those seemingly minor anomalies can have real
costs.
of the clearest indicators of automated fraud today: email
tumbling, sequencing and gibberish generation.
Manufactured identities can be used to exploit new-
Structure as a signal of intent customer offers, abuse referral programs, test stolen
payment credentials, accumulate loyalty rewards or
Structure reveals how an identity was created. Fraudulent establish accounts for later fraudulent activity. The
identities generated at scale tend to follow repeatable con- individual transactions or signups may look legiti-
struction patterns. Email tumbling is a clear example. By mate enough to escape notice.
inserting dots, numbers, or slight variations into a base
email address, fraudsters can create thousands of unique- That makes patterns across accounts increasingly im-
looking accounts that all route back to a single inbox. Each portant. Multiple customers appearing within min-
address passes validation, yet the underlying structure utes, similarly constructed email addresses, newly
exposes its origin. created domains or clusters of accounts behaving in
nearly identical ways can reveal activity that no sin-
Sequencing operates similarly. Email addresses or user- gle account would expose.
names are generated in predictable increments: names
followed by ascending numbers, slight character shifts or For merchant service providers, helping clients recog-
formulaic combinations. Individually, they appear benign. nize those patterns can make fraud prevention part
In aggregate, they form a pattern that is highly unlikely to of a broader conversation about customer acquisition,
occur organically. payments, promotions and account security.

36