As part of the rapid growth of Internet and World Wide Web use, there has been an ever increasing growth in the availability of online services. Such online services include, for example, online banking and financial services, online email services, online retail services, online dating services and online social networks. A given online service provider may provide a number of such services, which users of the online services typically access using a username and password, or other user login credentials that may be used by a provider as a mechanism for verifying users of the provider's services.
Accessing online services using such login credentials is, however, subject to fraud and abuse. For example, malicious actors may obtain user login credentials using improper means. Such improper means may include the use of malicious software, such as could be installed on publicly available computers (e.g., in libraries, Internet cafes or other locations), to monitor keystrokes on an affected computer to capture users' login credentials. User credentials could also be improperly obtained using brute force attacks by trying various combinations of usernames and passwords through an automated trial and error process. These techniques for improperly obtaining login credentials are provided by way of example and a number of other approaches for improperly obtaining user credentials may be used. For example, login credentials may be improperly obtained from a user through a process referred to as phishing. Phishing may be accomplished by malicious actors that masquerade as a trustworthy entity (e.g., a bank or credit card company) by sending, for example, a fraudulent email message that appears to be from a trustworthy entity. These phishing messages may include a request that deceives a user into providing login credential information to a malicious actor.
Once a malicious actor has acquired a user's login credentials for a given online service provider, the malicious actor may then gain access to the user's account with that provider. Depending on the specific provider and online services provided by that provider, the malicious actor could then make fraudulent purchases using the user's financial information, gain access to the user's bank accounts, or perform other acts of identity fraud, posing as the legitimate user for whom the malicious actor has obtained login credentials.