One-third (33.6%) of New Zealand’s Internet Traffic in 2021 Wasn’t Human As Account Takeover and Online Fraud Increases
AUCKLAND, NEW ZEALAND — May 19, 2022 — Imperva, Inc., (@Imperva) the comprehensive digital security leader on a mission to help organisations protect their data and all paths to it, releases the 2022 Imperva Bad Bot Report, the ninth annual in-depth analysis of bot traffic across the internet by Imperva Threat Research. Bad bots, software applications that run automated tasks with malicious intent, accounted for 27.7% of all global website traffic in 2021. The three most common bot attacks were account takeover (ATO), content or price scraping, and scalping to obtain limited-availability items.
In New Zealand, a third (33.6%) of all internet traffic in 2021 was not human, with 20.3% of traffic originating from bad bots and 13.3% from good bots.
“While New Zealand’s bad bot traffic is relatively low compared to the global average, we expect this percentage to grow over time,” says Reinhart Hansen, Director of Technology, Office of the CTO. “As digital maturity grows, bot operators are using more sophisticated scripts that can evade the common defenses. Organisations need to invest in a solution that spot and manage even the most advanced bots.”
Bad bots are often the first indicator of online fraud and represent a risk to digital businesses, as well as their customers. This breed of bot uses the latest evasion techniques, including cycling through random IPs, entering through anonymous proxies, changing identities, and mimicking human behaviour to evade detection. In 2021, evasive bad bots — a grouping of moderate and advanced bad bots that elude standard security defenses — made up 58.2% of all bad bot traffic in New Zealand.
2021 Bad Bot Sophistication: New Zealand vs Global
Bad bots enable high-speed abuse, misuse, and attacks on websites, mobile apps, and APIs. Successful attacks can lead to the theft of personal information, credit card data, and loyalty points. For organisations, automated abuse and online fraud contributes to non-compliance with data, privacy, and transaction regulations. Bad bot traffic is rising at a time when organisations are investing in improving customer experiences online. It’s resulted in more digital services, new online functionality, and the development of expansive API ecosystems. Unfortunately, this array of new endpoints is a ripe target for automated attacks by bad bot operators.
“Businesses cannot overlook the impact of malicious bot activity as it is contributing to more account compromise, higher infrastructure and support costs, customer churn, and degraded online services,” says Hansen. “With automated fraud growing in intensity and complexity, APAC organisations need to urgently implement advanced bot protection to safeguard their customers’ interests.”
Key Findings from the 2022 Imperva Bad Bot Report:
- Account takeover increased 148% in 2021: In 2021, 64.1% of ATO attacks used an advanced bad bot. Financial Services was the most targeted industry (34.6%), followed by Travel (23.2%). The United States was the leading source of ATO attacks (54%) in 2021. The implications of account takeover are extensive; Successful attacks lock customers out of their account, while fraudsters gain access to sensitive information that can be stolen and abused. For businesses, ATO contributes to revenue loss, risk of non-compliance with data privacy regulations, and tarnished reputations.
- Travel, Retail, and Financial Services targeted by bad bots: The volume of attacks originating from sophisticated bad bots was most notable across Travel (34.2%), Retail (33.8%), and Financial Services (8.8%) in 2021. These industries remain a prime target because of the valuable personal data they store behind user login portals on their websites and mobile apps.
- 6% of bad bots hide as mobile web browsers: Mobile user agents were a popular disguise for bad bot traffic in 2021, accounting for more than one-third of all internet traffic, increasing from 28.1% in 2020. Mobile Safari was a popular agent in 2021 because bots exploited the browser’s improved user privacy settings to mask their behaviour, making them harder to detect.
Imperva Threat Research concludes that no industry was immune to bad bot activity in 2021. While examples of bots hoarding popular gaming consoles or clogging vaccine appointment scheduling sites made headlines in 2021, any level of bot traffic on a website can cause significant downtime, degrade performance, and reduce service reliability.
As online fraud evolves and attack tools become readily accessible to bad actors, traditional security tools become less effective. The Online Fraud Prevention solution from Imperva combines best-in-class application security products to mitigate bot activity, minimise the costs associated with fraud, and reduce compliance risk — while contributing to improved customer experiences.
Additional Information:
- Download a copy of the 2022 Imperva Bad Bot Report for additional insights on bot behaviour and online fraud.
- Learn how the Online Fraud Prevention solution from Imperva, featuring Advanced Bot Protection with new behavioural anomaly detection and enhanced detection for leaked credentials, stops automated threats that lead to online fraud, such as account takeover.
- See why Imperva is positioned as a Leader with the strongest current offering in the The Forrester Wave: Bot Management, Q2 2022.
- Read the Imperva Blog for the latest product and solution news, and threat intelligence from Imperva Threat Research
# # #
Press Contact
Cristina Fletcher
APJ Communications Manager