By Ray Birch
ST. PETERSBURG, Fla.—When credit union members receive credit card applications in the mail for their eight-year-old kids, they shouldn’t “laugh,” they should pay attention, says one data security expert, who has outlined some due-diligence CUs must perform.
Jack Lynch, chief risk officer at PSCU, said while it may be easy to make a joke and dismiss a credit card solicitation aimed at a kid, “that could be a big mistake.”
Lynch said the mailer could be a sign the child is part of a synthetic identity scam, where crooks create fake IDs from personal data of Americans. It’s a crime technology has poured fuel on, with youngsters and the elderly prime targets.
“Kids don’t have a credit score. They typically don’t have financial accounts,” said Lynch, adding the elderly don’t often manage their money well or monitor their account activity closely—just the ingredients crooks are looking for in creating synthetic IDs.
What it Means
Synthetic ID fraud occurs when crooks create a fake identity and open accounts at financial institutions to obtain funds via loans or other means.
It had been expected that once EMV took hold crooks would begin shifting their focus to other fraud avenues, such as card-not-present fraud and account takeover, which has happened, as CUToday.info has extensively reported. A previous CUToday.info report detailed how account takeover fraud is skyrocketing as crooks move on this crime with industrial scale.
“Kids are becoming more targets of synthetic ID fraud because they don't have a credit score,” said Lynch. “More than a million children we know are targets of identity theft—that's not all necessarily synthetic, but it shows how crooks are going into social media sites. They're even stealing information from birthday clubs. They are piecing together identities on the children, and sometimes the kids and parents don’t find out until the child turns 18 and applies for a credit card.”
The Long-Game
Lynch said synthetic ID fraud is often a “long game,” as crooks create the false identity and then begin transacting over a period of time before they pull off the big money-making crime.
“It’s a really fascinating subject,” said Lynch. “When people think of crimes like account takeover, typically criminals take the account over and then commit their crime right away, before somebody figures out what's going. But with synthetic ID fraud, it’s becoming more common that criminals bide their time, even as long as 10 years.”
Lynch said the crooks will wait years as the trust the financial institution has in them rises—and so does their credit limit.
Busting Out
“They will wait and then when their limit gets high enough, bust out with their crime,” he said.
That could mean maxing out their credit card for major purchases and never being heard from again by the credit union, or getting a large loan for a car and driving off for good.
Lynch said synthetic ID fraud totally changes a financial institution’s approach to detecting and catching crime, as the typical tools, like those that alert for suspicious activity, are not often helpful here.
What Credit Unions Must Do
Jack Lynch
What credit unions need to do, said Lynch, is perform a little more due-diligence up front when a new member joins.
“You got to have more than one source of information on a new member—you have to have a holistic approach to verifying someone is who they say they are,” said Lynch. “There's still too much reliance on credit bureau scores, and that's fraught with danger.”
What CUs need to do is examine as many sources of data on the person as possible without invading their privacy and turning enrollment into a “crime scene investigation,” which would upset the new member. What the credit union is typically looking for, said Lynch, are data mismatches.
“Look across different channels. Link analysis is good,” said Lynch. “For example, link analysis can reveal that multiple names are linked to the same address. Now, it might be a slight variation on the address, but it’s the same location when you look closely.”
Another Step to Take
He said CUs can also run regular scans of their member database to look for data mismatches or anomalies within accounts. Lynch also recommended monitoring for sudden spikes in activity—where an account has not been that active and suddenly the person makes a big move.
“That could well be a sign that the crook is breaking out with his crime,” said Lynch. “Let’s say he calls and asks for a big credit line extension because he’s heading out for a long vacation. These can be warning signs that the synthetic ID fraud is finally going to occur on the account in a big way. Problem is, when you receive this kind of sign, you have very little time to act before the crook takes action.”
Growing Quickly
Synthetic ID fraud is growing quickly, as are the costs from the crime. Lynch said data show that synthetic ID fraud cost financial institutions more than $6 billion in 2016.
“And that is just from what’s reported,” said Lynch, adding that the total is likely much higher as FIs often write off these expenses and there is no consistency in how they formally report the crime.
Lynch suggested credit unions engage with members on the issue.
“One thing they can do is educate their members about the crime. Encourage them to pay attention for warning signs, like their kids getting a mailer for a credit card,” said Lynch. “While that may seem like something that’s humorous, it could be a signal that synthetic ID fraud is happening.”