SIDN and Currence team up to fight fake webshops

How did the link-up between Currence and SIDN come about?

Wabeke: "SIDN was talking to Currence about SIDN BrandGuard. As the talks progressed, it became clear that the two organisations had a lot in common. Both are characteristically Dutch organisations committed to internet security. And both firmly believe that you can't make the internet more secure without cooperation." Van den Wittenboer: "We soon started to look for ways that we could complement each other... ways of working together. What should we tackle first? This study is the first thing to come out of our partnership."

What exactly did you study?

Van den Wittenboer: "Fake webshops try to look as normal as possible. One way they do that is by using the logos of popular payment methods and accreditation schemes to give visitors a false sense of security. We wanted to find out more about webshops that abuse the iDEAL logo or the iDEAL payment system." Wabeke: "That raises the question of how you're going to find webshops that use the iDEAL logo in the first place. We decided to develop a deep learning algorithm capable of automatically detecting new webshops that use iDEAL logos. Of course, you could in principle get people to visit the sites and look for the logo. But .nl has more than 5.9 million domain names. So checking all the associated websites manually just isn't on. In our trial, we concentrated on websites offering hand gels and facemasks to the public. Since the Coronavirus pandemic started, they've been springing up like mushrooms, while the healthcare sector has been struggling with shortages of those products. It wasn't immediately apparent whether the webshops in question were legitimate." Van den Wittenboer: "Otherwise, the study design was straightforward. SIDN can see what new domain names are registered. Using the algorithm, they did a scan and produced a list of domains with webshops that have the iDEAL logo. Currence then took a look at the shops. We checked whether the Trade Register number and contact information were real, for example, and whether they did actually support iDEAL payment."

What's the value of the study?

Wabeke: "SIDN can disable a fake webshop, but the scammers can easily set up a new one. Efforts to stop fraud are more effective if you can stop the fraudsters taking payments. After all, every malicious webshop needs a domain name and a payment system. Without a domain name, a scam site isn't findable and without a payment mechanism it can't take your money. A robust strategy for tackling fake webshops should therefore look at both of those things. This study was the first step towards that goal." Van den Wittenboer: "However, there are also webshops out there that use the iDEAL logo, but don't in fact support iDEAL payments. Instead, they do things like send a payment request by e-mail once the customer has placed an order. Or, when the customer tries to pay with iDEAL, a message comes up saying there's been a technical error and asking for an internet banking payment. Anything like that is a strong indicator that people should be suspicious."

What did you do about the webshops identified in the study?

Van den Wittenboer: "It's hard to be certain whether a webshop really is a fake. As a rule, you only know for sure when a victim complains to the police. So what we do is look for risk pointers. We referred the first forty webshops offering iDEAL as a payment option to the associated iDEAL service providers. Those service providers have iDEAL contracts with businesses such as webshops. And, when a consumer pays with iDEAL, it's the service provider's name that appears on their bank statement."

What did you get from the study?

Van den Wittenboer: "It told us a lot about the various types of webshop selling facemasks, hand gels and other COVID-related products, about the scope for investigating them and about the additional knowledge and resources needed to set up a permanent monitoring system based on this principle. The study also brought us into contact with other organisations, including the Netherlands Consumer Authority (ACM). That's really useful, because we've now opened up a channel of communication, meaning that we're better placed to act against fake webshops in the future." Wabeke: "We can also take a number of technical lessons from the study. Visual detection is a resource-intensive process – relatively speaking, it requires considerable computation power. On the other hand, it has one big plus: we're seeing websites exactly the way consumers see them. The study has highlighted a lot of follow-up questions as well. How can we scale up this approach, for example? And are there other ways we can use visual detection – for finding sites that use accreditation logos, for instance? And, obviously, how can we make the most of the partnership between SIDN and Currence?"

Will there be a follow-up study?

Wabeke: "We'd like to take this idea further, because we think that it can help to make the internet more secure. But we don't yet have any clearly defined plans. That's partly to do with the ongoing pandemic: we could really do with sitting down together and brainstorming without any distractions, but we haven't been able to organise anything like that. Maybe in the autumn." Thymen and Alice have written a separate (technical) blog, describing the detection method used for the study in more detail.