Broadcom Arcot Scam Defense Targets AI-Enhanced Social Engineering in Payments
Broadcom's new Arcot Scam Defense feature integrates with 3-D Secure to detect and block AI-driven social engineering attacks targeting cardholders during online transactions.
Broadcom has introduced Arcot Scam Defense, a new capability within its Arcot by Broadcom payment security suite, designed to combat the growing threat of social engineering fraud in card-not-present (CNP) transactions. This feature specifically aims to thwart attackers who leverage artificial intelligence to impersonate trusted brands and institutions, tricking customers into divulging sensitive information or completing fraudulent authentication steps.
According to Matt Cooke, VP and GM of Broadcom's Payment Security Division, financial institutions are witnessing a significant surge in fraud attempts fueled by sophisticated, AI-enhanced social engineering tactics. While traditional technological security systems have become adept at identifying and blocking suspicious transactions, fraudsters are increasingly shifting their focus to directly manipulating customers. These attackers exploit the trust cardholders place in legitimate entities, leading individuals to inadvertently compromise their own account security.
The core of the problem lies in how current 3-D Secure authentication processes operate. Once a cardholder successfully completes a challenge, such as entering a one-time password (OTP) or using biometrics, the transaction is typically deemed legitimate by primary risk models and approved. This system, while effective against automated fraud, is vulnerable when a legitimate user is actively being deceived by a scammer.
Arcot Scam Defense is positioned as a critical solution to this gap, acting as a "definitive safety net against social engineering attacks." It functions as a real-time, second layer of defense that analyzes various signals during the authentication process. This includes examining transaction details, device intelligence, historical user behavior, and the specifics of the challenge interaction itself to identify patterns indicative of a social engineering attempt.
Key indicators that Arcot Scam Defense scrutinizes include discrepancies between the location and behavior of the checkout device and the device used for authentication, unusual delays in OTP entry, the use of alternative authentication methods, or a significant geographical distance between the two devices. The system evaluates these signals collectively, rather than relying on any single indicator, to make a real-time decision. Furthermore, it can integrate with third-party solutions to detect if the authenticating device is engaged in an active phone call, a common tactic in social engineering scams.
Even if a cardholder succumbs to a scam and provides their credentials, Arcot Scam Defense is designed to detect the behavioral shift and block the transaction before it is finalized. Pilot testing with a major issuer demonstrated the feature's efficacy, identifying that reviewing just the top 1% of successful challenges could have prevented an estimated $4 million in fraud within a single month, with a minimal impact of only 0.38 points on the authentication success rate.
Broadcom plans to enhance Arcot Scam Defense further by incorporating additional signals, such as cardholder and device attributes, and a dedicated profiling engine to learn individual cardholder challenge behaviors. The company emphasizes that Arcot by Broadcom is exclusively focused on 3-D Secure payment authentication, aiming to provide specialized protection against evolving fraud vectors in the digital payment landscape.