Question

I have a website that contains a secure area accessible by logging in with account info. Within the secure area, I have some expensive IP. I have been finding that people are sharing their passwords with other people. Are there any existing technologies / solutions / methods that I can implement to detect fraud patterns?

Thanks in advance for the help.

Answer 1

• check geographical region. If within some timeframe multiple logins from regions geographically far apart log in, then you know those credentials have been shared.

  Friday morning a log in from NY, Friday evening a log in from China

• bandwitdh consumption: if your site offers lots of content, if a user goes over some high limit, it means its credentials have been shared

  max bandwidth 5MB/s; then in one day 60*60*24*5MB is your upper limit per day per user

• keep a counter of live sessions so you can see how many people log in at the same time. This is imprecise because the same person can log in through multiple browsers from the same IP and have a session on each one.

  if they have 100 sessions (4 times/hr), that seems more than one person can do, unless your site expects this behaviour