First Things First. What’s the Common Thread?

While not identical in meaning, policy abuse, promo abuse, first-party fraud, friendly fraud, and similar issues share an identity in the fact that they are illicit acts perpetrated by individuals or coordinated attackers that don't necessarily hide or misrepresent their identities. In these forms of fraud, which we will refer to as policy abuse for simplicity, customers who are who they say they are behave in illicit ways to exploit companies’ policies to their advantage.

The implications of this definition are noteworthy. First, traditional fraud-prevention measures and tools are not great at detecting policy abuse because they are designed to look for instances where identities, credentials, and payment methods are compromised, as is not the case with these issues. Second, organizations are responsible for designing the policies that they offer their customers and must do so while taking into account the possibility of abuse.

It is also worth keeping in mind that policy abuse vulnerabilities can be exploited by organized criminals. In this sense, the line between policy abuse and third-party fraud can be quite thin. Fraudsters could exploit policy abuse vulnerabilities such as lax sign-up bonuses using bots and batches of false identities, leading to exponential losses for well-intentioned financial institutions and retailers.

While most policies could potentially be exploited by fraudsters, some types tend to be particularly prone to abuse. Some of them are:

Promotion Abuse