Bot Attack

A bot attack is an attack carried out by automated programs, known as bots, that interact with a website, mobile app or API far faster and at far greater volume than a human could. In financial services, bots are used to test stolen card numbers, try leaked passwords against login pages, open fake accounts, abuse sign-up bonuses, scrape data or overload systems. Banks, payment providers, merchants, crypto exchanges and fintech apps are all frequent targets.

Not all bots are harmful. Search engine crawlers, monitoring tools and authorised API clients are legitimate automated traffic. A bot attack is defined by its intent to commit fraud, steal data or disrupt service, and by its use of automation to make that profitable at scale. Many attacks today use sophisticated bots that imitate human behaviour, run in real browsers and route traffic through large networks of residential IP addresses, which makes them harder to tell apart from genuine customers.

• Credential stuffing. Bots try usernames and passwords stolen from other breaches against a bank or wallet login, hoping customers reused them, a technique described under credential stuffing. Successful logins lead to account takeover.
• Card testing and BIN attacks. Bots run small payment attempts to check which stolen or generated card numbers work, as in card testing fraud and the BIN attack.
• Enumeration. More generally, bots cycle through possible values of account numbers, gift card codes, one-time codes or promotion codes, an approach known as an enumeration attack.
• Fake account creation. Bots fill in sign-up forms with stolen or invented identities to open accounts for money laundering, bonus abuse or later application fraud.
• Promotion and limit abuse. Bots repeatedly claim referral rewards, cashback or free trials, or split activity to stay under limits, overlapping with velocity abuse.
• Scraping. Bots collect prices, exchange rates or customer data from pages and APIs, sometimes for competitors, sometimes to prepare targeted fraud. See data scraping.
• Denial of service. Large botnets flood services with traffic, as in a distributed denial of service attack, sometimes as a distraction while other fraud takes place.

Automation makes fraud cheap. Lists of stolen passwords and card numbers are sold in bulk, and tools for running attacks are available as ready-made services. A success rate well under one percent can still be profitable when millions of attempts cost almost nothing. Attackers spread traffic across many devices, IP addresses and time windows to avoid simple limits, and can solve basic CAPTCHA tests using automated solvers or low-paid human workers. APIs built for mobile apps or partners are often less protected than websites, making them attractive targets.

The costs go beyond direct fraud losses. Targeted firms pay processing fees for every card test, suffer account takeovers that lead to customer losses and complaints, and spend heavily on investigation. High volumes of declined card attempts can push a merchant into card scheme monitoring programmes or lead its acquirer to close the account. Fake accounts distort growth figures and can expose a firm to money laundering. Bot traffic also raises infrastructure costs and can slow services for real customers.

Firms use several layers of control:

• Device and browser signals. Device fingerprinting and checks for headless browsers, emulators or automation frameworks.
• Network reputation. Scoring traffic by IP reputation, data centre ranges, proxies and anonymising services.
• Behaviour analysis. Behavioural biometrics such as mouse movement, typing rhythm and navigation patterns that bots find hard to mimic.
• Rate controls. Velocity checking per account, card, device and IP, with step-up challenges when limits are reached.
• Challenges and authentication. CAPTCHA and invisible challenges, multi-factor authentication and, for payments, 3-D Secure authentication.
• Specialist bot management. Services, often delivered through content delivery networks or web application firewalls, that classify traffic in real time and block, slow or challenge suspected bots.

Bot defence is an arms race. Overly strict rules frustrate genuine customers, particularly those using shared networks, privacy tools or assistive technology. Attackers study defences and change tactics quickly, and the growth of AI agents that act for real customers blurs the line between good and bad automation. Firms therefore tune controls continuously, share intelligence with peers and payment networks, and design products, such as gift card or referral schemes, with abuse in mind from the start.