Neobank Reduces Infostealer-Driven Payment Fraud by 41% with Real-Time Identity Intelligence

The Challenge: Mobile Sessions Are High-Value Infostealer Targets 

The bank’s fraud model was built on behavioral analytics: device fingerprinting, login velocity, geographic consistency, transaction pattern analysis, and session duration monitoring. The model performed well against credential stuffing attacks and anomalous transaction patterns. It did not perform well against infostealer-sourced session replay.  

The reason is specific to how infostealers operate on mobile and desktop devices. An infostealer infection harvests the authentication tokens and session cookies stored in the browser or application credential store after a legitimate user has authenticated. The harvested session carries the correct device fingerprint (because it was generated on the real device), the correct geographic origin (because the real user authenticated from their home region), and the correct session parameters (because the real user’s authentication flow generated them). When an attacker replays this session, the bank’s behavioral model sees a session that is indistinguishable from the legitimate user’s session. 

The bank’s fraud team had identified three payment fraud patterns that were consistently evading the behavioral model: 

• Bill Pay Redirect Fraud: Attackers authenticated via replayed session cookie, added new bill payees linked to money mule accounts, and authorized same-day bill pay transfers before the session expired or the account holder logged in independently. Behavioral signals were minimal: one new payee addition followed by one payment event, individually consistent with normal account management. 

• Peer-to-Peer Transfer Fraud: Stolen sessions were used to authorize P2P transfers to newly added recipients. The bank’s behavioral model flagged new recipient additions for amounts above a threshold, but the infostealer attacks were structured to stay below the flagging threshold across multiple sessions, accumulating losses through repeated low-value transfers. 

• Account Modification Pre-Staging: In a subset of cases, attackers used the stolen session not to immediately transfer funds but to modify the account’s recovery email and phone number, completing a full account takeover that survived the original session’s expiration. The behavioral model did not flag contact information changes as high-risk events, because legitimate customers update contact details regularly. 

Why Behavioral Models Cannot Solve This Problem Alone 

Behavioral fraud models are trained on internal signals: the historical transaction and session patterns of the account holder. They are exceptionally good at detecting deviations from established behavior. They have a structural limitation: they cannot evaluate whether the session presented to the authentication layer was generated by the real account holder or harvested from an infected device. 

That determination requires external intelligence. It requires knowing whether the account’s associated email address appeared in a recently ingested infostealer package containing session data for the bank’s mobile domain. That knowledge exists only in a threat intelligence provider monitoring criminal markets for infostealer activity. It cannot be generated from internal logs, however sophisticated the behavioral model. 

The Solution: External Infostealer Intelligence at the Authentication Layer 

The bank integrated Constella’s Identity Intelligence API and infostealer monitoring into its real-time authentication pipeline. The integration operated in two distinct modes that addressed both proactive and reactive fraud prevention: 

• Real-Time Pre-Authentication Enrichment: For every login event, the bank’s authentication system queried Constella’s API with the account’s associated email address. Constella returned a risk signal indicating whether that identity had appeared in recent breach or infostealer activity, and specifically whether session data associated with the bank’s mobile domain had been captured in a recent infostealer package. This signal was added to the behavioral model’s risk scoring before the authentication decision was finalized. Accounts with a current, verified Constella infostealer flag were routed to step-up verification before any payment action was permitted. 

• Continuous Background Monitoring: Constella’s monitoring ran continuously against the bank’s full account holder population, generating proactive alerts when any monitored email appeared in a newly ingested infostealer package. When a monitoring alert was triggered, the associated account was placed in an elevated-risk state, meaning the next authentication event would automatically trigger step-up verification regardless of whether the login’s behavioral signals were anomalous. This proactive mode caught accounts before an attacker attempted to use the stolen session. 

The infostealer-specific signal quality was the critical differentiator. Constella’s infostealer alert payload included the specific URLs for which session data had been captured, the infected device’s hardware metadata, and the malware strain responsible for the harvest. When the bank’s mobile domain URL appeared in a Constella alert’s session capture inventory, the fraud team had high-confidence, specific evidence that the account was actively compromised, not an anomaly that might or might not indicate fraud.