2024 Payment Fraud Report: Trends, Insights, and Predictions for 2025
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-34102 | XXE vulnerability enabling RCE in Adobe Commerce and Magento Open Source CVE-2024-34102 is an improper restriction of XML external entity reference (XXE) vulnerability (CWE-611) in Adobe Commerce and Magento Open Source, where the platform does not properly restrict external entities when processing XML, so an attacker who can submit crafted XML containing external entity references can have it parsed with attacker-controlled resources. XXE flaws classically enable local file disclosure and server-side request forgery, and in this case Adobe states the flaw allows remote code execution on the affected server. Any organization running a vulnerable Adobe Commerce or Magento Open Source storefront is affected, and because these are internet-facing e-commerce platforms that routinely process XML input, exposure is likely to be broad. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2024-07-17, confirming exploitation in the wild, and its EPSS score of ~100% (100th percentile) indicates near-certain near-term exploitation activity; no public proof-of-concept is known and CVSS has not yet been scored. CISA lists ransomware use as unknown, so a ransomware connection should not be assumed. Do: Apply Adobe's security updates for Adobe Commerce and Magento Open Source per the vendor's June 2024 advisory (APSB24-40), or, per the CISA KEV required action, apply vendor-recommended mitigations or discontinue use of the product if patches are unavailable. Review any endpoints or integrations that accept XML from untrusted users and hunt for signs of XXE exploitation, such as unexpected outbound requests, anomalous file reads, or webshell artifacts. Continue monitoring Adobe and CISA KEV for updated mitigation guidance and remediation deadlines. | 9.8 | 100% | KEV PoC |
| mass≈150,000+ storefronts (public technology scans report on the order of 100k-250k live Magento-based sites) |
Full article563 words · extracted from recordedfuture.com · click to collapse
Summary
The 2024 Payment Fraud Intelligence Report from Recorded Future highlights a year of significant evolution in the fraud landscape, setting the stage for challenges in 2025. Key findings include a surge in stolen card data, with 269 million records posted across dark and clear web platforms, and a tripling of Magecart e-skimmer infections due to vulnerabilities like CosmicSting. Scam e-commerce and dark web card validation activities also saw notable increases, reflecting growing sophistication among threat actors.
Emerging trends indicate fraudsters’ increasing exploitation of modern payment technologies and social engineering to bypass anti-fraud measures. Predictions for 2025 include a rise in digital e-skimming and scam e-commerce, continued activity on dark web marketplaces, and persistent check fraud in the United States. The report emphasizes the need for financial institutions, merchants, and payment providers to adopt fusion intelligence strategies and rigorous verification processes to combat fraud effectively.
Key Highlights from 2024
Surge in Stolen Data
In 2024, 269 million card records and 1.9 million stolen US bank checks were posted on dark and clear web platforms. This surge reflects a combination of increased data compromise events and rampant reposting. Notably, card-not-present (CNP) data dominated, signaling the growing impact of e-commerce fraud.
Magecart E-Skimmer Infections
The volume of Magecart e-skimmer infections surged, reaching nearly 11,000 unique e-commerce domains—a threefold increase from 2023. This spike was driven by the CosmicSting vulnerability (CVE-2024-34102), alongside the use of out-of-the-box e-skimmer kits like “Sniffer by Fleras.”
Scam E-Commerce Websites
Nearly 1,200 scam domains were linked to fraudulent merchant accounts, with most registered in the United Kingdom and Hong Kong. Operators of these scams leveraged social engineering tactics and linked merchant accounts to defraud victims and monetize stolen data.
Dark Web Activity
Dark web marketplaces remained central to the fraud ecosystem, offering stolen card data and facilitating fraud workflows. Telegram, despite recent disruptions, continued to be a source of unique fraud data.
Trends to Watch in 2025
Digital E-Skimming and Scam E-Commerce
Fraudsters will increasingly target e-commerce platforms using advanced e-skimmer tactics and scam websites. The adoption of digital wallets will further expose vulnerabilities in payment ecosystems, particularly through OTP interception techniques.
Dark Web Marketplaces
Despite law enforcement efforts, dark web marketplaces will continue to thrive, offering anonymity and scalability. Platforms like Telegram will remain active, though less experienced threat actors may dominate these channels.
Persistent Check Fraud
The explosion of check fraud in the United States is unlikely to subside in 2025. However, advancements in prevention methods, including intelligence-driven strategies, will help financial institutions reduce losses.
Mitigation Strategies
- Encourage acquired merchants to identify and close vulnerabilities on e-commerce websites that threat actors can exploit to implant Magecart e-skimmer infections.
- Increase the rigor of merchant onboarding processes to deter threat actors seeking to fraudulently acquire merchant accounts.
- Enhance validation requirements for digital wallet provisioning attempts.
- Implement push provisioning through online banking applications.
- Leverage Recorded Future Intelligence:
- Establish intelligence feedback loops to align cybersecurity and anti-fraud teams for proactive fraud detection and prevention.
- Utilize Recorded Future insights to identify at-risk accounts, breached merchants, and fraudulent activities involving Magecart e-skimmers, scam merchants, tester merchants, and stolen checks.
- Use structured data and transaction analysis to automate workflows, block high-risk merchants, and implement fraud controls.
- Continuously fine-tune fraud prevention tactics using threat landscape data and internal input.
To read the entire analysis, click here to download the report as a PDF.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.recordedfuture.com/research/annual-payment-fraud-intelligence-report-2024