--:-- --
↓ Scroll for more

Unit 4.case

Case Study: Digital Wallet Fraud Controls

Balancing UX and Security

IT 204: E-Commerce

Learning Objectives

By the end of this case study, you will be able to:

  • ✅ Analyze the tension between user experience (UX) and security in e-commerce.
  • ✅ Identify multi-layered fraud detection techniques used by digital wallets.
  • ✅ Evaluate the role of policy and user education in a security framework.
  • ✅ Connect theoretical concepts from Unit 4 to a real-world implementation.

The Challenge: A Surge in Fraud

The Problem ⚡

A leading digital wallet provider faced a sharp increase in successful fraud attempts.

  • Social Engineering Attacks
  • SIM-Swap Scams
  • Account Takeovers (ATO)

The Dilemma 🎯

How to stop fraudsters without frustrating legitimate users?

The Goal: Reduce fraud losses while preserving a fast, frictionless checkout experience.

This connects directly to our study of the Threat Landscape (Ch. 4.2).

Activity: Identify the Fraud Type

Read each scenario and select the correct fraud type, then check your answers.

Control 1: Dynamic Risk Scoring

Key Concept (Ch. 4.3): Instead of a single rule, the system calculates a risk score for every transaction in real-time.

🔍 Inputs for Scoring

  • Transaction Amount
  • Device Fingerprint
  • IP Address & Geolocation
  • Transaction Velocity
  • User History

🚦 Risk-Based Action

  • Low Risk: Seamless approval.
  • Medium Risk: Step-up authentication.
  • High Risk: Block & flag for review.

Simulation: Dynamic Risk Score Calculator

Adjust the transaction parameters below and see the risk level update in real time.


1,000


1

Low
Score: 3 / 100
Action: Seamless Approval

Control 2: Modernizing Authentication

The provider moved away from vulnerable SMS One-Time Passwords (OTPs) for high-risk actions.

Old Method: SMS OTP

  • Vulnerable to SIM-swap
  • Can be intercepted
  • Relies on telco security

New Method: Device Binding

  • Links account to a specific, trusted device.
  • Uses secure push notifications for approval.
  • Much harder for attackers to bypass.

Decision Tree: Which Authentication Response?

Walk through a transaction scenario step by step to determine the correct authentication outcome.

Control 3: Policies & Governance (Ch. 4.4)

Technology alone isn't enough. The solution required strong internal policies.

  • Tiered Transaction Limits:
    • Limits based on user's KYC (Know Your Customer) verification level.
    • Higher verification = higher limits.
  • Cooling-Off Periods:
    • A mandatory waiting period after sensitive profile changes (e.g., changing phone number or password).
    • Prevents immediate fraudulent fund transfers after an account takeover.

Control 4: The Human Layer

Recognizing that social engineering bypasses technical controls, the wallet provider focused on user education.

📢 Banners

Prominent warnings about common scams displayed within the app.

💡 In-App Tips

Contextual advice during checkout or profile changes.

🚨 Rapid Takedown

A streamlined process for users to report scams, enabling fast response.

Activity: Match the Control to the Threat

Click a Threat, then click the Control that best mitigates it.

Threats

→

Controls

The Outcomes: Measurable Success 📊

Security Wins

60% reduction in fraud loss rate within the first 3 months.

  • Fewer support tickets related to fraud.
  • Clearer internal runbooks for handling security incidents.

User Experience Preserved

Checkout success rates for low-risk transactions remained unchanged.

This demonstrates a successful balance: security friction was only applied when genuinely needed.

Discussion: When Is Security Friction Justified?

Vote on whether adding authentication friction is worth it for each scenario, then reveal what this case study's system actually decided.

Practical Application: The Nepali Context

Thinking Locally 🇳🇵

Consider popular digital wallets in Nepal like eSewa or Khalti.

  • How do they implement device binding? (e.g., login alerts, trusted device lists)
  • What are their KYC tiers and how do they affect transaction limits?
  • Have you seen in-app educational banners warning about lottery scams or fake social media offers?
  • This case study's principles are directly applicable to securing Nepal's growing digital payment ecosystem.

Key Takeaways & Lessons

Lesson 1: Defense-in-Depth is Critical

A single control (like just having a password) is insufficient. Layering technical and policy-based controls creates a much stronger defense.


Lesson 2: Security Must be Adaptive

Fraud tactics evolve. Security thresholds and rules must be continuously tuned based on market behavior and emerging threats.


Lesson 3: Don't Forget the User

User education is a vital security layer. An informed user is less likely to fall for social engineering, which no technology can fully prevent.

Thank You

This case study illustrates the dynamic interplay of technology, policy, and user behavior in securing e-commerce platforms.

Next Topic: Unit 5 - E-commerce Marketing Concepts

Return to Course Home | Unit 4 Overview