The criminals are winning. According to the most recent data report from credit bureau Experian, there were 16.6 million reported victims of identity fraud in the U.S. in 2017, while the e-commerce fraud attack rate rose 30 percent over the prior year. The number of victims equals about 6.6 percent of the U.S. population, the company noted.

Experian said it determines the fraud attack rate by analyzing various data points such as IP addresses, geography, payment method and device type. “Fraud attack rates are the number of attempted fraudulent e-commerce transactions against the population of overall e-commerce orders,” the company said, adding that millions of online transactions were used in the analysis.

Matt Tatham, manager of content insights and data analyst at Experian Consumer Services, which is a division of Experian, said in the report that online shopping fraud “rose dramatically” last year in two specific categories: shipping fraud and billing fraud.

“Shipping fraud occurs when a criminal uses their address for the delivery of stolen goods purchased online,” Tatham said in the report. “Rates of shipping fraud increased 37 percent in 2017 versus 2016. From a regional perspective, the Western U.S. saw a nearly 60 percent increase in attack rates for shipping fraud.”

Tatham said billing fraud is when the victim’s address is “tied to the payment account used to purchase the stolen goods; those rates increased 34 percent. The North Central region saw a 50 percent increase in attack rates for billing fraud.”

In regard to the sources of criminal activity, Tatham said in the report that while “Russian hackers and trolls received all the media attention,” it was China and Venezuela that were the sources of “the most overseas e-commerce fraud attacks in 2017.”

“The majority of bad traffic originating out of China hit Oregon and Delaware, followed by California,” Tatham said. “Beaverton, Oregon’s 97079 zip code had the highest shipping attack rates in the U.S. last year, and its shipping and billing attack rates were the highest from an IP address in China.”

The growth of e-commerce fraud can be viewed as the last stop on the larger fraud timeline, which often starts with a data breach. The uptick in data breaches, already 278 incidents in 2018, and the increased presence of the dark web marketplace have made personal information more accessible to criminals; that, in turn, makes it easier for fraudsters to access legitimate online accounts.

Tatham said Venezuela “would have been the riskiest IP country if it weren’t for the fact they have a 60 percent lower volume of online transactions compared to China.” He said the South American country is nearly 30 times riskier than the population average would otherwise suggest. The 33198 Miami zip code, which was in the top 10 for billing and shipping fraud in 2017, suffered its highest shipping attack rates (46.2 percent) from a Venezuelan IP address.

For more business news from WWD, see:

In Price Fight Between Walmart and Amazon, Bentonville Wins

Today’s Consumer: Frugal, Community-Minded and Tech Savvy

Amazon, Wal-Mart and Apple Top List of Biggest E-commerce Retailers