OTP Bank Details How It Detects Professional Cashback Hunters and Card Rental Schemes
OTP Bank has outlined its approach to identifying clients who systematically exploit cashback and loyalty mechanics without committing classic fraud. In an interview, Alexander Shirokov, head of information security control and financial operations, described the boundary between advantageous product use and abuse.
Shirokov noted that simply receiving benefits is not abuse. The key factor is whether operations reflect genuine need or are engineered exclusively to maximize rewards. Large volumes of bonuses or deep knowledge of tariffs alone do not trigger action; instead, the bank examines whether behavior deviates from the product’s intended purpose.
The bank acknowledges a distinct category of non-fraudulent yet highly active clients, including professional cashbackers and individuals who allow others to use their cards. This activity places additional strain on loyalty programs and can concentrate rewards among a small group, prompting potential revisions to program economics.
Card rental cases occur when owners share cards or details so others can make purchases while the owner collects cashback. Although not always fraudulent, such use violates personal-use terms and distorts the program’s design assumptions.
To differentiate rental from normal sharing with family, OTP Bank applies algorithms that compare current transaction patterns against historical profiles. Frequency, locations, timing, and technical signals are analyzed. Regular payments for relatives do not automatically indicate abuse unless multiple indicators suggest the card is used by several people over time.
Professional cashbackers study tariffs, categories, and bonus rules as meticulously as fraudsters study anti-fraud systems. Some participate in communities that exchange optimization tactics. While financially literate, their behavior can still affect program sustainability when it becomes the primary goal of card usage.
The bank also encounters collusion between clients and merchants to generate artificial cashback. Detection relies on joint analysis of client and merchant patterns, looking for sustained anomalies rather than single transactions.
Privilege resale, such as transferring taxi, restaurant, or lounge access, is identified through deviations from a client’s normal usage profile. No single factor leads to conclusions; decisions require aggregated data over extended periods.
Shirokov stated that professional abuse can pose an economic risk comparable to traditional fraud because it gradually erodes program viability. Automated models flag unusual behavior, but analysts, risk specialists, and product teams review complex cases. In some instances, the bank deliberately avoids action on isolated signals to prevent inconvenience to legitimate users.
Related articles
Russian Li Auto Owners Face Master Account Theft and Extortion Up to 45,000 Rubles
Russian owners of Li Auto vehicles are experiencing a wave of master account compromises that allow attackers to seize control through the official mobile app. After losing access, some vehicles lose screen functionality, climate control, and in certain cases the ability to start. Attackers then contact victims demanding 35,000 to 45,000 rubles for account return. Approximately 20 confirmed cases have been reported, though the real number may be higher. The exact infection vector remains unknown, and even owners who previously used the paid eSender service to retain Chinese phone numbers are now affected. Li Auto and official distributor Sinomach Auto are developing recovery procedures and plan to migrate account binding from Chinese numbers to email addresses.
How Vacation Photos Enable Family Impersonation Scams and Data Exposure
Public photographs from vacations and family events can reveal names, relationships, addresses, travel dates, and even security question answers without any hacking required. Attackers combine airport shots, hotel tags, school certificates, and relative comments to build convincing stories for emergency scams targeting grandparents or parents. The FTC has documented how scammers impersonate relatives using real details pulled directly from social media. NIST explicitly discourages security questions based on easily discoverable personal facts such as pet names or school names. Metadata like EXIF GPS coordinates and visible documents in the background further increase exposure risks. Practical steps include reviewing backgrounds, removing metadata, limiting audience settings, and establishing family code words that do not appear in public posts. The guidance covers iPhone, Android, Windows, and macOS methods for stripping location data before sharing images.
Russian Minister Proposes Blocking All SIM Cards of Scammers Banned in MAX Messenger
The head of Russia's Ministry of Digital Development has suggested expanding account bans in the MAX messenger to include full disconnection of all mobile numbers belonging to the same owner. Maksut Shadaev stated that simply restricting the messenger account is insufficient and that operators must continue countermeasures. The proposal also includes a cooling-off period preventing the individual from registering new numbers after a ban. Details on the duration of restrictions, data transfer procedures to operators, and appeal mechanisms remain undisclosed. Questions around accurate owner identification and cases of compromised or misused numbers are highlighted as critical for implementation. The measures target fraudsters specifically and would not apply automatically to every MAX rule violation.
Avito Develops Cyberdetective Browser Game to Train Employees on Real-World Attacks Using MITRE ATT&CK Techniques
Avito security awareness specialist Ilya Nikiforov created the browser-based Cyberdetective game over 74 days to move beyond traditional courses and train practical responses to attacks. The game places players in the fictional company Lumi where they control mascot Spok the honey badger, investigating six cases based on authentic attack chains documented in MITRE ATT&CK. Scenarios cover physical access via unlocked laptops, invoice domain spoofing, voice cloning of executives, MFA fatigue attacks, and evidence preservation during incident response. The project relied heavily on AI agents including Claude Code and Codex for coding and testing while Nikiforov handled scenario design, methodology, and acceptance. Additional AI tools generated art, animations, voiceovers, and music, resulting in 80 JavaScript modules, roughly 2,200 automated tests, and 18 distinct interactive mechanics. The game emphasizes safe mistake-making, chain-of-events thinking, and specific actions such as callback verification rather than blanket refusal of all requests.