THE 3-LAYERED EVASION STRATEGY
The threat network actively A/B tested the policy engine. They manipulated three distinct layers of identity to keep threat scores artificially low, triggering specific ThreatMetrix detection flags.
1
NETWORK EVASION: Proxy Matrix
To bypass transaction velocity limits, devices routed traffic through hundreds of IPs. By mixing DigitalOcean (85.2%) with residential StarHub mobile IPs (14.4%), they spoofed geographic distribution.
TMX Flag Fired: [GEO_Spoofing] (96 hits)
2
DEVICE EVASION: Synthetic Masks
Just 8 physical SmartIDs mathematically generated 604 unique ExactID browser profiles. This tricked perimeter filters into treating each connection as a "new customer" rather than a returning threat.
TMX Flag Fired: [Device_Spoofing] (822 hits)
3
BEHAVIORAL EVASION: Hit & Run
The syndicate targeted 264 victim accounts, but purposefully abandoned 78.7% of attempts (778 sessions) when they encountered security friction, leaving the events in an incomplete (Null) state.
TMX Flag Fired: [Identity_Spoofing] (576 hits)
TMX Flag Fired: [Automated_Script] (20 hits)
FINANCIAL IMPACT & FRAUD KPIs
78.7%
Friction Abandonment Rate
75:1
Device Spoofing Ratio
778
Sessions Abandoned (Null)
264
Total Accounts Targeted
*Data reflects the aggregate 988 sessions executed by the 8 physical devices linked to LexID c723cabd. Total Operation Volume: $48,416.47.
DEFENSE MECHANISM: HOW $61.6K WAS PROTECTED
The fraud syndicate successfully bypassed initial static IP and User-Agent rules by rotating infrastructure. However, $61.6K across 158 targeted accounts was successfully defended through dynamic behavioral friction.
When the ThreatMetrix engine identified underlying hardware anomalies—triggering [Identity_Spoofing] or [Device_Spoofing] despite the rotating IPs—the session risk scores spiked. Rather than completing the transactions, the automated scripts abruptly terminated the sessions, leaving hundreds of events in an abandoned (Null) state. The scripts were forced to instantly sever the connection upon encountering these high-friction rules, resulting in a 78.7% Friction Abandonment Rate and saving the bank from massive systemic loss.
THE SMOKING GUN: LEXID RESOLUTION
Legacy fraud tools analyze IP addresses and User-Agents in silos. Because the attacker constantly randomized both, traditional filters only saw thousands of isolated, low-risk events. LexID and SmartID technology cut through the spoofed noise.
By anchoring directly to the deep physical hardware telemetry, we established that even while wearing 604 different masks and bouncing through data center proxies, the underlying 8 physical devices remained static. This singular piece of un-spoofable evidence allowed us to unmask the organized syndicate and map the entire kill chain.