Fraud-as-a-Service (FaaS)

The one-time passwords (OTPs) that are delivered by the use of SMSs have become a very attractive target of telecom fraud since it can be used as a second line of authentication. OTP Bots are automation-based interception services that run through Telegram-based Fraud-as-a-Service (FaaS) platforms that have become a systemic tool of real-time avoidance of multi-factor authentication, caller-ID spoofing, and abusive number-porting. In this paper, we systematically investigate the OTP bot threat space and make three main contributions, namely: (i): four-tier taxonomic framework distinguishing between Vishing Bots, SMS Interception Bots, SIM-Swap Bots, and AI-enhanced hybrid bots; (ii): five-step operational life cycle model superimposed on the MITRE ATTACK framework; and (iii): a hybrid detection architecture that uses rule-based analysis in combination with a Random Forest classifier that we tested on 50 thousand artificial authentication sessions. It has an accuracy of 96.84% and recall of 94.67% as well as a falsepositive rate of 2.9% and a detection latency of 42 milliseconds, which is better than both rule-based and machine learning-only baselines. Threat-intelligence reports suggest that during the next year, 2023 to 2024, the activity of dark-web OTP bots is expected to increase by 31 per cent each year, and the cost of services is USD 10-50 per session, and success rates can be up to 90 per cent. It is estimated that artificially inflated traffic (AIT) contributes to 20% of OTP SMS volume, which implies USD 1.15 billion of fraudulent charges per year. We offer a tiered mitigation structure that operates on the level of telecom operators (implementing STIR/SHAKEN, SS7 firewalling, and porting KYC verification), financial institutions (migration to FIDO2 and reducing the OTP validity window), regulators (attestation requirements and coordinated takedown), and end users (improved social-engineering awareness). The evidence indicates that, without reform at the infrastructure level, OTPs, which are based on SMS, do not currently offer a high enough level of second-factor authentication to prevent the high-assurance authentication