By Ray Birch
BOSTON—Criminals are ramping up efforts to create synthetic IDs at financial institutions and then perpetrate fraud—as one CU that recently suffered $200,000 in losses can attest.
Julie Conroy, research director at Aite Group, told CUToday.info there are ways to address this rapidly rising crime.
“Synthetic ID fraud has grown substantially over the past few years,” said Conroy. “And it’s only going to get worse.”
Conroy pointed to Aite Group data that shows that U.S. losses from synthetic ID card fraud alone reached $820 million in 2017 and are projected to grow to $1.25 billion in 2020.
Synthetic identity theft relies on creating identities rather than stealing existing ones. Synthetic fraudsters buy stolen Social Security numbers or try to guess numbers not in use, then combine them with a sham identity. Using other people's real addresses, the crooks begin committing their crimes, such as taking out loans and failing to make a payment.
Conroy said she is aware of a credit union that recently suffered $200,000 in losses in less than three months from synthetic ID fraud.
“The credit union said these crooks passed all of their ID and verification checks and were asked dynamic, knowledge-based authentication questions,” she said. “They passed them all with flying colors, because they had nurtured these identities.”
Years in the Works
Experts have stated that fraudsters will spend years faithfully paying the monthly bills on a credit card tied to a false identity while watching credit limits tick higher. When the scheme is ripe, the fraudsters charge everything to the hilt, a phase commonly known as “busting out.”
As CUToday.info has reported, criminals are moving to new fraud tactics and away from stealing card data as EMV makes it much more difficult for thieves at the point of sale.
As experts have further stated, and Conroy agrees, all of the data breaches, such as the Experian hack, have made the crime easier to perpetrate as the result of enormous amounts of personally identifiable information being avaialble on the dark web.
“In the past few years we have seen this perfect storm sweep through that is driving the rise in synthetic ID fraud,” Conroy said. “So many factors are working in criminals’ favor. We’ve been in this steady economic recovery that is leading to lenders loosening standards and making it easier to get credit and therefore easier to get a synthetic ID through the door. We have now an unprecedented amount of personal data on the dark web. And, in 2015, the Social Security Administration decided to randomize the issuance of Social Security numbers, essentially taking away one of the tools in our arsenal to do some identity checking.”
Making it Easier for Crooks
Conroy, too, said that the increasing number of financial institutions that are allowing members and customers to enroll electronically is making it easier for crooks.
“We recently released a report that shows that the account application fraud rate is eight times higher with digital channels because it is so much easier to perpetrate fraud this way,” she said.
Conroy said there is no silver bullet for FIs to use in defending against this type of fraud. She said there are new scores being developed by the credit bureaus that help assess the legitimacy of the identity provided by a new member and customer.
Those new scores consider factors such as how long the ID has been in existence, how long the email address with the account has been functioning, if the identity was added for the first time as an authorized user of a credit card, and the type and frequency of activity associated with the ID.
“For example, did this person have an abnormal velocity of going out and getting a bunch of credit relationships at the same time,” Conroy said.
Solutions Available, But…
Conroy noted that more vendors are offering solutions to help financial institutions verify the identities of new accounts, but suggested that CUs look for a resource that does not require using multiple vendors.
“That can be cumbersome and difficult to manage, sewing together all of these different risk scores,” Conroy said. “We are seeing the emergence of identity authentication hubs that can be used for new account onboarding.”
If the credit union believes it may have spotted a synthetic ID among its new accounts, Conroy said it should follow carefully developed procedures for remediating the potential problem.
“Remember, these are typically carefully nurtured synthetic IDs,” Conroy said. “The bad guys can pass most of the standard authentication tools.
‘Be Careful’
She said that some FIs will begin to watch the activity on the account, closely monitoring to see if the individual is behaving as a typical new customer. Conroy said that others will begin asking the person for copies of utility bills and more.
“But be careful,” she cautioned. “You don’t want to lose a good, legitimate member. If the person does not comply with your requests, that’s not a clear indication this is a synthetic ID or just a person who does not want to jump through all those hoops.”
The recently passed Economic Growth, Regulatory Relief and Consumer Protection Act should provide FIs some assistance in fighting synthetic IDs. Under Section 215 of the new law, the Social Security Administration will have to provide financial institutions with an electronic system to check the name and date of birth linked to a given Social Security number. Results should be available in 24 hours.
“The devil will be in the details here,” said Conroy. “How this will all come about, the timeframe…The Social Security Administration still has to build the infrastructure and that won’t happen overnight.”