View attachment 7403
Antifraud In Focus: SEON
Lets cut the bullshit. Were kicking off a new series called "Antifraud In Focus." Were gonna rip apart the top
antifraud systems piece by fucking piece. Why? Because
knowledge is power and if youre gonna try to outsmart these bastards you better understand how they tick.
Every
antifraud provider has its own damn territory.
Forter is sniffing around luxury retail
Riskified has its claws in the travel industry and today were putting
SEON under the microscope β a name that makes online gambling and crypto exchange operators shit their pants. Knowing their turf is crucial; its like knowing the layout of a bank before you rob it.
What the Fuck is SEON?
SEON emerged from the crypto chaos cooked up by some guys who were fed up with getting ripped off on their own exchange. These guys arent just checking if your card is hot; theyre all about
data enrichment. Theyre the digital equivalent of a stalker digging into your email phone IP and device to build what they call a "
trust score."
How Seon Operates:
1. Data Enrichment and Transaction Assessment:
SEON is that creepy ex who knows your entire life story. They conduct a full-blown investigation into your digital identity zeroing in on:
- Email history and social accounts: How old is your email? Does it have a Facebook or Instagram profile attached? A brand-new email with no social links is a surefire way to pump those risk scores. SEON loves old emails with a history of legit use. Lots of active social profiles linked to the email? You look more legit. Been in a breach? Believe it or not thats a good thing. It means your email isnt fresh out of the oven. Gmail or Outlook? Good. Some temporary email service? Bad.
- Phone number and linked profiles: Is your number legit? Can it be traced back to online accounts? A burner phone with no history is a red flag.
- IP address quality and hosting type: Are you using a clean residential IP or some shitty datacenter proxy? SEON checks your IPs reputation and whether its been linked to shady shit. Datacenter IPs raise eyebrows. Clean residential IPs are your best friend. Trying to hide your real IP? SEONs got a knack for detecting that shit. IP in one country billing address in another? Thats a red flag. IPs with a history of fraud are flagged.
- Device fingerprinting: Whats your device setup? Trying to hide something? SEON analyzes your browser OS and hardware. Weird configurations or masking attempts trigger alarms. A consistent normal setup blends right in. Common consistent setups are good. Consistent specs across sessions build trust. Frequent changes or spoofing? Red flag. SEON uses Canvas/WebGL fingerprints to track devices. Messing with them makes you look suspicious. VPNs proxies etc. can trigger alarms. Theyre often used to hide your true location and identity.
View attachment 7408
View attachment 7409
2. Scoring Engine: Every transaction gets a fraud score from 0 to 100. This score determines your fate:
- APPROVE (low risk): Youre in the clear. Aged email consistent device clean IP β you look like a regular Joe.
- REVIEW (manual check): Somethings fishy. Maybe a newish email or a slightly dodgy IP. A human will take a closer look.
- DECLINE (high risk): Youre toast. Brand-new email suspicious IP and a device that screams "fraudster." SEONs got your number.
View attachment 7410
SEONs logic is simple: legit people build a digital footprint over time. They have old social media accounts use the same devices and do normal shit online. Fraudsters? They use
fresh emails burner phones and try to cover their tracks.
SEON spots these inconsistencies. A real person leaves a trail of digital breadcrumbs. A fraudster is a ghost popping up out of nowhere with a fake identity.
SEONs job is to separate the ghosts from the real people.
Beating the System
View attachment 7411
If youre targeting a site protected by
SEON you need a multi-pronged attack. Youre not just trying to push through a transaction; youre crafting a believable digital persona. Heres the playbook:
1. Email Preparation
- Use aged email accounts: A couple of months old the older the better.
- Connect multiple social media accounts: Active and varied profiles. Make them look real for fucks sake.
- Ensure legitimate activity history: Newsletters sent/received emails β make it look like a real inbox.
- Avoid free/disposable email providers: Stick to Gmail Outlook or Yahoo.
2. Device Setup
- Avoid privacy tools and VPNs: Use a clean setup.
- Use common browser configurations: Dont over-spoof. Blend in with the sheep.
- Dont modify canvas/WebGL fingerprints: Keep them consistent and natural.
- Maintain consistent device profiles: Dont switch devices or configurations like you change your underwear
3. IP Selection
- Use clean residential IPs: Less likely to be flagged.
- Ensure IP location matches billing: Discrepancies are a huge red flag.
- Avoid IPs from known proxy services: SEONs got a list and theyre checking it twice.
- Maintain consistent IP throughout session: Dont switch IPs mid-transaction.
Understanding SEONs Rules
SEON isnt some static piece of shit. It uses three types of rules:
1. Default Rules: These are the pre-configured rules based on known fraud patterns. Think of them as the basics like detecting disposable emails and known proxy IPs.
2. Custom Rules: These are tailored by the merchants. Theyre specific to each site and their unique fraud challenges.
3. Machine Learning Rules: This is
SEONs AI. These rules adapt in real time learning from new data. Even if you crack the default and custom rules the ML rules are a moving target.
SEONs machine learning models retrain multiple times a day. A tactic that works today might get flagged tomorrow. You need to constantly adapt monitor your success rates analyze declines and adjust your game plan. Its a damn game of cat and mouse.
Sneak Peek to An Actual SEON Panel
Lets talk about
SEONs panel the dashboard where all the juicy data is displayed. This thing is a fucking treasure trove of information for anyone trying to understand how
SEON operates. Heres a glimpse of what you can find with screenshots from yours truly:
Transaction Details
- Transaction Summary: Gives you the lowdown on each transaction including ID score user ID amount date and status. Actual images:
- Fraud Score Breakdown: Shows the individual scores for email IP phone and device as well as the overall fraud score.
- Identity: Details about the user including registration score full name username email password hash registration date and merchant ID.
- Addresses: Users address and IP geolocation.
- Devices & OS: Information about the device used in the transaction including device hash browser hash OS browser and device type.
- Phone Information: Phone number details including carrier country and social media profiles linked to the number.
- Email Information: Email address details including domain data breaches and social media profiles linked to the email.
- IP Information: IP address details including location type ISP and whether its a proxy or VPN.
- User Revenue: Tracks the users deposits withdrawals and revenue.
Actual Images:
* Hidden text: cannot be quoted. *
* Hidden text: cannot be quoted. *
* Hidden text: cannot be quoted. *
* Hidden text: cannot be quoted. *
Customer Connections
- Shows connections between users based on IP address phone number user address password hash browser hash device hash cookie hash and email address.
* Hidden text: cannot be quoted. *
Activity
- Provides a timeline of user actions such as account logins with details like score action type amount IP address and device hash.
* Hidden text: cannot be quoted. *
Raw Log
- Displays the raw JSON data sent to SEON for each transaction.
Alerts
- Enumera las alertas activadas por actividad sospechosa, como varios usuarios con la misma direcciΓ³n IP en un dΓa.
Texto oculto: no se puede citar.
Casos
- Proporciona un resumen de los casos de fraude, incluido el ID del caso, la prioridad del analista asignado, la fecha de creaciΓ³n, el monto afectado, las transacciones vinculadas, los clientes vinculados y los activadores de alertas.
Texto oculto: no se puede citar.
BΓΊsqueda manual
- Permite bΓΊsquedas manuales de direcciones de correo electrΓ³nico, nΓΊmeros de telΓ©fono, direcciones IP, BIN de tarjetas e informaciΓ³n AML.
Texto oculto: no se puede citar.
Motor de puntuaciΓ³n
- Muestra estadΓsticas sobre las reglas aplicadas, incluido el nombre de la ID de la regla, las veces que se activaron y los porcentajes de aprobaciΓ³n/revisiΓ³n/rechazo.
- Muestra una matriz de confusiΓ³n con los resultados de las decisiones de SEON (aprobar revisar rechazar).
- Enumera reglas predeterminadas, reglas personalizadas y reglas de aprendizaje automΓ‘tico.
Texto oculto: no se puede citar.
Texto oculto: no se puede citar.
Texto oculto: no se puede citar.
ConclusiΓ³n
El poder de SEON reside en verificar la legitimidad digital. No se trata solo de una tarjeta vΓ‘lida, sino de una identidad digital creΓble. CΓ©ntrese en crear perfiles digitales confiables. Una tarjeta con un saldo alto y un correo electrΓ³nico actualizado probablemente le perjudicarΓ‘. Una transacciΓ³n pequeΓ±a con una identidad digital establecida tiene muchas mΓ‘s posibilidades.
Para aumentar la confianza en tus correos electrΓ³nicos, crea varias cuentas en redes sociales vinculadas a ellos. Piensa en ello como si le dieras a tu correo electrΓ³nico una identificaciΓ³n falsa que realmente funciona. Haz que parezca que la usa una persona real, no una cuenta desechable. Esto ayuda a construir una presencia online creΓble, como si fuera un disfraz digital.
SEON apuesta a largo plazo, analizando patrones histΓ³ricos y huellas digitales. Su Γ©xito depende de crear y mantener perfiles digitales de apariencia legΓtima. Es una batalla de desgaste digital y solo los mΓ‘s perseverantes sobrevivirΓ‘n.
EstΓ©n atentos a la prΓ³xima entrega, donde analizaremos a otro actor clave en la lucha contra el fraude. Cada sistema tiene sus peculiaridades y debilidades, y seguiremos investigΓ‘ndolas. Β‘MantΓ©nganse alerta, bastardos!