E-Commerce Fraud Campaign Uses 600+ Fake Sites: How to Fight Back

Security researchers have uncovered Eriakos, a sophisticated information-stealing fraud network that lures mobile shoppers to over 600 fake e-commerce sites via malicious Facebook ads. By leveraging brand impersonation, time-sensitive offers, and rapid domain churn, this campaign evades traditional scanners—and nets criminals card data, personal information, and direct payments.

In this post, we’ll:

Break down how the Eriakos campaign operates
Highlight detection challenges with malvertising and domain churn
Share AI-driven strategies—BIN lookup, machine learning for payments, and card fraud APIs—to prevent chargebacks
Offer best practices for fintech fraud prevention and securing mobile transactions

1. Anatomy of the Eriakos Fraud Network

Malvertising-Only Access: Campaign ads exclusively target mobile devices on Facebook, ensuring scam URLs never appear in generic crawls.
Rapid Domain Churn: Researchers found 608 unique scam domains—each spun up briefly to avoid takedown and then discarded.
Brand Exploitation: Fake stores impersonate top e-commerce platforms and power-tools manufacturers, using urgent “flash sale” messaging to drive impulse purchases.
China-Based Merchant Accounts: Domains and payment merchant IDs trace back to registrations in China, suggesting centralized orchestration.

“By overwhelming Facebook’s filters with hundreds of concurrent ads per domain, Eriakos ensures at least some ads slip through and reach victims,” Recorded Future notes.

2. Why Traditional Defenses Struggle

Blacklist Evasion: Short-lived domains and constantly changing URLs make static blocklists obsolete.
Malvertising Stealth: Ads never link to known bad domains—so URL scanners and email filters miss them.
Mobile-First Tactics: Mobile wallets and in-app browsers bypass enterprise desktop protections.
Scale Over Speed: Hundreds of ads per domain means even if some are removed, others continue to funnel victims.

These factors underscore the need for real-time fraud detection layers that don’t rely on precompiled lists.

3. AI & Machine Learning: Leveling the Playing Field

Instant BIN Lookup for Merchant Verification

Docs: https://bincheck.app/api-docs/bin-lookup

Issuing Country Check: Compare card’s issuing country versus merchant domain registration to flag mismatches.
Bank & Scheme Info: Block transactions where BIN data doesn’t align with expected merchant profiles.
Prepaid/Commercial Status: Heighten scrutiny on prepaid cards often favored by fraudsters.

Use Case: A U.S. shopper’s Visa BIN indicates a U.S. bank, but the checkout merchant ID registers in China—trigger an immediate challenge.

ML-Powered Fraud Detection for Real-Time Scoring

Docs: https://bincheck.app/api-docs/fraud-check

Dynamic Risk Scoring: Evaluate hundreds of features—device fingerprint, transaction velocity, BIN lookup results—to generate a fraud risk score per transaction.
Chargeback Prevention: Automatically decline or challenge high-risk orders before settlement.
Adaptive Learning: Models continuously retrain on new Eriakos-style patterns (rapid domain churn, malvertising sources).

Use Case: Multiple small orders from new domains within minutes—ML model raises suspicion and pauses fulfillment pending human review.

4. Best Practices for Fintech Fraud Prevention

Early Enrichment: Run BIN lookup at the first touchpoint to detect suspicious merchant-card mismatches.
Layered Scoring: Invoke ML-Powered Fraud Detection both pre-authorization (prevent chargebacks) and post-settlement (monitor refunds & disputes).
Device & Geo-Analytics: Combine IP geolocation, mobile device IDs, and behavioral biometrics to spot malvertising-driven anomalies.
Ad Traffic Monitoring: Integrate ad network logs into your fraud analytics to correlate sudden spikes in unknown domains.
Human-in-the-Loop: Empower analysts to review flagged transactions and feed confirmed fraud cases back into model training.

Conclusion

Large-scale fraud campaigns like Eriakos exploit malvertising and domain churn to slip past static defenses. To stay ahead, merchants and fintech platforms must adopt real-time AI-driven fraud detection:

Instant BIN Lookup for rapid merchant validation
ML-Powered Fraud Detection for adaptive risk scoring
Multi-layered analytics tying together device data, ad sources, and transaction patterns

By implementing these APIs and best practices, you’ll minimize chargebacks, thwart emerging e-commerce scams, and safeguard your customers’ trust. Ready to fortify your defenses? Explore the BIN Lookup API and Fraud-Check API today.