Broadcom launches Arcot Scam Defense to block social engineering fraud in payments
New real-time detection layer targets social engineering attacks that bypass standard 3-D Secure authentication checks during card-not-present transactions.
Key points
- Broadcom released Arcot Scam Defense to detect social engineering during 3-D Secure flows.
- The tool analyzes device signals and behavior to flag fraud after successful authentication.
- Financial institutions face rising AI-enhanced scams where victims hand over credentials willingly.
Broadcom has launched Arcot Scam Defense, a new feature within its Arcot platform designed to stop social engineering fraud during card-not-present transactions. According to Help Net Security, the tool acts as a real-time safety net that operates even after a customer successfully completes a 3-D Secure authentication challenge. This addresses a gap where traditional risk models approve transactions because the account holder appears legitimate, unaware they are being manipulated by scammers.
In plain English
Fraudsters are increasingly using AI-enhanced social engineering to trick customers directly rather than attacking technical systems. Matt Cooke, VP and GM of Broadcom’s Payment Security Division, noted that criminals impersonate trusted brands to coax cardholders into revealing passwords or completing step-up authentications. Customers often do not realize they have handed over access until after the scam occurs. The new defense layer looks for signs of this manipulation during the payment flow.
The background
Standard 3-D Secure authentication treats a transaction as legitimate once a user enters a one-time password or uses biometrics. While real-time risk assessment models are effective at flagging suspicious activity, they are not designed to stop a legitimate account holder who is actively under the influence of a scam. Cooke stated that technological security systems have advanced but fraudsters have pivoted to hacking customers directly. Arcot Scam Defense closes this critical gap by serving as a second layer of defense.
What changes now
Arcot Scam Defense analyzes multiple signals including transaction information, device intelligence, historical behavior, and the challenge interaction itself. It identifies patterns indicative of social engineering such as discrepancies between the checkout device and the authenticating device location. Other indicators include delayed one-time password entry, use of an alternative authentication method, or significant physical distance between devices. The solution can also integrate with third-party tools to detect if the authenticating device is on an active phone call.
What made it possible
Security teams usually encounter this class of threat when attackers manipulate human psychology rather than exploiting software vulnerabilities. The weakness lies in the assumption that a successful authentication step proves user intent, which social engineering circumvents by coercing the victim to comply. This technique serves the initial access stage of an intrusion by granting the attacker valid credentials or authorization tokens. Organizations should check whether their authentication logs capture behavioral anomalies such as input delays or device context mismatches, as these often indicate coercion rather than technical compromise.
What to do and how to stay safe: Broadcom
- Monitor authentication logs for behavioral anomalies such as delayed input or unusual device switching during payment flows.
- Evaluate whether current risk models account for social engineering indicators like active phone calls or location discrepancies.
- Train customer support teams to recognize signs of users being coached by fraudsters during verification steps.
- Review integration capabilities with third-party intelligence sources to enhance real-time detection of coercive scenarios.
General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How does Arcot Scam Defense differ from standard 3-D Secure?
It operates as a second layer of defense that analyzes behavioral signals even after a user successfully completes the standard authentication challenge.
What specific signs does the tool look for?
It evaluates discrepancies in device location, delayed password entry, use of alternative authentication methods, and whether the device is on an active call.
Who is the primary target of this new feature?
Financial institutions experiencing increases in fraud attempts driven by sophisticated, AI-enhanced social engineering attacks against their customers.
