An innocent click, an unpretentious purchase, an unmissable discount. Everything seems safe, until the invoice arrives with a value that you do not recognize. Behind the scenes of e-commerce, while consumers enjoy the convenience of digital, an invisible war is fought every day against increasingly sophisticated scams.
In 2024, more than half of Brazilians have been victims of some type of fraud, according to Serasa Experian. And the impact is real: 54.2% reported financial loss, many of them without even realizing the moment of the coup. If before the fraud came in bulk and crudely, today they are surgical, silent and expensive. The average ticket of the blows has grown 30% and already passes R$ 1,300 per request.
Crime has evolved, and digital security needs to run behind. E-commerce is the new playground of cybercriminals.Febraban data shows that financial losses from digital fraud in Brazil reached R$ 10.1 billion in 2024, 17% more than in the previous year.“The digital environment, especially for e-commerce, has become a minefield”, warns Wagner Elias, CEO of Conviso, specializing in application security.
Threats are varied, from phishing attacks (representing 15% of cases) to the use of stolen credentials (16%), to malicious insiders, these, incidentally, with average cost per violation of US$ 4.99 million, the highest on the list.
Elias says that one of the techniques on the rise is digital skimming and account takeover (ATO). In skimming, the criminal injects malicious codes directly into the payment page. Already at the ATO, the scam is cooler and methodical: with leaked credentials, accesses real accounts, exchanges passwords and makes purchases. According to the company AllowMe, 72% of fraud in digital retail come from these improper accesses.
The preferred targets? Games, mobile phones, computers and electronics, products with high liquidity in the informal market and easy resale. Already the preferred means of payment of scammers remain credit cards. The reason is simple: quick purchase, little verification, and only discover when the invoice arrives.
THE COMBAT
And what can be done? The answer lies in technology and, above all, in security planning since the beginning of application development. “The answer lies in technology, yes, but above all, in the way it is implemented. Leave to think about security only after the system is running is a fatal error. It is necessary to include practices such as PCI DSS from the beginning of development and invest in tools such as WAFs to protect websites against real-time attacks”, says Wagner Elias.
This is where tools such as WAFs (Web Application Firewalls) come in, which monitor traffic in real time, block suspicious patterns and protect websites from attacks such as code injection and unauthorized access. The use of AI (Artificial Intelligence) has also been important to anticipate malicious behavior, reducing up to US$ 2.2 million the costs of violations, according to the IBM “Cost of a Data Breach 2024” study.
Another essential point is the use of practices compatible with PCI DSS (Payment Card Industry Data Security Standard), a set of international standards that help protect card transactions.“Companies that operate with payment data need, by obligation and business intelligence, to follow PCI to the letter. This is what separates a secure system from an open door to the” scam, adds Elias.
Even with the advancement of technology, the average time to contain a breach is still long: 258 days. In the case of stolen credentials, it can reach 292 days, almost a year. Part of the blame is the shortage of specialized professionals, which increased 26.2% in the last year and raised the cost of violations in US$ 1.76 million.
However, the expert warns: those who bet on automation, security from the base and simulations of attacks - the so-called penetration tests IO - are more likely to leave unharmed or at least reduce damage.
Reports from leading cybersecurity authorities prove the effectiveness of PCI DSS and WAF protections: according to Verizon DBIR 2024, compliance with the PCI DSS standard reduces security incidents by 52%, while WAFs block up to 80% from attacks on web applications. The IBM Cost of a Data Breach 2023 study reveals that companies with WAFs save US$ 1.4 million per breach, and PCI DSS accelerates the response time to breaches by 54TP3T when combined with 2.
“So, companies that follow the PCI DSS standard have half the problems with data leaks, and Web application firewalls (WAFs) prevent 8 out of 10 hacker attacks. Those who use the two technologies together limit financial losses to only 25% of the value normally expected after” invasions, he explains.
In the US, a rape costs, on average, US$ 9.36 million, the largest in the world for the 14th year in a row. There, 63% of companies already admit that they will pass this cost on to customers, which shows that investing in security is not only a precaution: it is a matter of competitiveness and image. Elias concludes: “In times of heated e-commerce and valuable data, ignoring digital security is leaving money on the table, compromising revenue and reputation at the same time. In addition to also losing customer trust and the credibility of the brand”.