How MFA Makes Quick Service Restaurants (QSR) Promotion Fraud-Free
Quick-Service Restaurants are seeing a boom in engagement, but so are the scammers. Read this blog to find out how to boost your restaurant’s confidence in its capacity to defend itself from hackers.
The restaurant industry is still adapting to the digital-first paradigm brought on by the pandemic, but online order volume is growing for quick-service restaurant QSR chains and is not going away anytime soon. In fact, it is becoming mission-critical for QSR restaurants to take advantage of marketing opportunities afforded by this new normal.
Mobile-savvy restaurant owners are seeing a boom in engagement, but so are the scammers looking to get a piece of the pie. Restaurants have made security a primary concern, with many implementing multifactor authentication (MFA) methods to stop such attacks.
Multi-factor authentication is a type of authentication service that requires a user to give two or more verifications to obtain access to a resource like an application, an online account, or a VPN. Robust identity and access management policy should include multi-factor authentication.
MFA needs one or more additional verification criteria in addition to the login and secure password, which reduces the chances of a successful cyber attack.
Why Should Restaurants Implement MFA?
The major benefit of MFA is that it increases the security of your business by forcing users to identify themselves with more than just a username and password. Despite been for a long time, usernames and passwords can be stolen by third parties and are vulnerable to brute force attacks.
Enforcing the use of multi-factor authentication (MFA) features like a fingerprint or a genuine hardware key boosts your restaurant’s confidence in its capacity to defend itself from hackers.
How Does MFA Work?
MFA works by seeking further information to verify its claims (factors). One-time passwords (OTP) are one of the most prevalent MFA elements that consumers face. OTPs are four to eight-digit codes that you may get by email, SMS, or a mobile app.
When using OTPs, a new code is produced regularly or whenever an authentication request is made. The code is produced using a seed value provided to the user when they initially register and another element, such as an incremental counter or a time value.
Three Factors of MFA
The majority of MFA authentication methods rely on one of three sorts of extra data:
-
Passwords and PINs are examples of things you know.
-
Your possessions, such as a badge or a smartphone
-
Biometrics, such as fingerprints or voice recognition, are examples of things you are.
In an interview with PYMNTS, Vikram Dhawan, vice president and senior product leader at Kount, an Equifax business, warned that QSRs and other merchants must safeguard their promotions and customers' accounts to strengthen their defenses against an assault of faceless, digitally-mounted attackers.
The news came as PYMNTS research revealed that 44 percent of respondents indicated they were more likely to order from restaurants that offered specials or discounts. According to Dhawan, this circumstance allows for marketing misuse and fraud.
“Anytime you have the option to give anything out for free or at a very low cost,” Dhawan added, “you will draw traffic.” And the question is, "How much traffic is good and how much is bad?"
It's not simple to tell which is which, especially when a good campaign may increase traffic dramatically.
He recalled how one of the restaurants Kount now works with ran into issues when it started giving free things and noticed an "enormous" amount of signups for free products.
Monitoring Endpoints
Fraudsters discover ways to try account takeover tactics in the face of such volume increases, he added. The endpoints of a transaction are the first thing merchants must understand to prevent account takeovers.
He mentioned Kount's technology, allowing clients to see how many accounts are generated from the same endpoint device, such as a phone, laptop, or tablet. A few accounts arriving may be acceptable, but hundreds, if not thousands, of accounts arriving from a single endpoint, indicate a problem.
Many shops require that email addresses be used for signups, but he pointed out that creating an email account can be done for free and indefinitely these days. Criminals can generate several fake emails to sign up for an offer and take advantage of it.
He claims that his company's "Email Insights" service may provide information on an email's "reputation," such as if it was produced lately and how frequently it could be utilized. Restaurants and shops can choose whether to halt account creations or redirect them to a secondary authentication method.
He believes that modern technology — such as internet platforms — may also be used to halt promo code misuse. He claims that bad actors are aware of a promotional code or 17-digit alphanumeric string structure and go out of their way to find current promo codes.
He said, "When they locate an active promo code, they disseminate it across their networks, which is how promo code abuse happens." Tracking many such attempts to a single device can help detect whether a fraudster is attempting to apply "brute force" on a code.
The Balancing Act
When it comes to anti-fraud measures and consumer experiences, there is a delicate balance to be struck. Raising the barrier excessively high so that no one can get in harm, real customers.
Merchants must determine how high to elevate the threat level and at what degree to implement payment authentication difficulties based on their business operations.
“Perhaps it's dependent on the pricing or the amount of money you spend,” Dhawan said, citing an example of a customer who previously spent $5 and $10 each transaction but suddenly spent $5,000 on order. That's a good sign that suggests we should "double-check that it's you."
In an age where, even after the pandemic, digital transformation, online ordering, and online marketing, particularly among QSRs, will endure, he added, the necessity to employ modern technology and acceptable levels of friction remain especially essential.
“Consumers who order items and services from QSRs using digital technology are not going away,” Dhawan told PYMNTS. They appreciated how the systems work since they didn’t have to wait in lines, said another participant.
Consumers may now eat these goods in a variety of ways. So it would be fascinating for merchants to react to that change and that dynamic nature.”
