How randomized Social Security numbers aided identity fraud

Visa is leaning more heavily on its Issuers’ Clearinghouse Service (ICS) to help banks combat the rise of synthetic fraud, which it attributes in part to a security measure adopted by the Social Security Administration years ago.

Synthetic fraud is where criminals blend fictitious data with a real person’s information to create a synthetic identity. Oftentimes fraudsters will use an authentic Social Security number and tie it to a fake age and address to apply for a credit card. Key targets for the criminals are minors who have valid SSNs but have not reached adulthood or yet applied for credit.

This type of synthetic fraud is becoming more pervasive and difficult to uncover, due in part to changes in how SSNs are issued.

“We’ve seen a huge increase in synthetic fraud over the last few years, especially since 2011 when the Social Security Administration decided to change how they assigned Social Security numbers," Kolin Whitley, senior director of North America risk at Visa, in an interview during SourceMedia's annual PayThink conference last week in Los Angeles.

"Today SSNs are assigned through a process of randomization. This makes it harder to spot fraud,” Whitley said.

In the past, SSNs were assigned using a set of guidelines. The first three digits corresponded to the geography of the Social Security office issuing SSNs, and then later those digits represented the state of the applicant when SSN issuance was centralized. The second set of numbers was a group identifier and the third set of four digits was a serial number issued in order of request.

The move to randomization in SSN issuance made great improvements in extending the program’s longevity and adding a measure of privacy, however, it also made it much more difficult for banks to identify fraudulent applications. It was no longer easy to correlate a person age and geography to an application.

“I get why they changed how SSNs are issued, but it made it a lot harder to spot fraud," Whitley said. "In the past you could easily have determined someone’s approximate age based on when and where their SSN was issued. Now with randomized SSNs you can’t do that.”

So as banks wait for an upcoming electronic SSN verification pilot slated to launch in June 2020, Visa has been promoting its Issuers’ Clearinghouse Services program to clients as a tool to more effectively combat synthetic fraud today.

The Visa program is a risk management product specifically used for credit underwriting and fraud prevention. Usage of it is voluntary, however, all Visa issuers are required to provide data into it.

The Visa ICS is a nationwide centralized database of comprehensive approved and declined bank card application information, fraudulent applications and fraudulent account use reported by Visa issuers. Whitley stated that since many banks are dual issuers, the repository also holds Mastercard approved and declined application data.

“It’s a tool that has found increased value as synthetic fraud has grown. An issuer can more easily spot synthetic fraud when using the tool since they will be able to see all of the applications being attempted on a 15 year old’s SSN,” said Whitley.

The Social Security Administration is conducting pilot program to electronically verify SSNs, as required by last year’s passage of the Economic Growth, Regulatory Relief and Consumer Protection Act. The Act specifically called on the SSA to develop a database to facilitate the verification of consumer information upon request by a certified financial institution with the consumer’s consent and in relation to a credit transaction such as credit card or mortgage application.

Whitely added that the SSA pilot is starting out with only 10 institutions and that Visa is not among them. According to the Federal Register, the SSA will expand the pilot to additional companies six months after the initial rollout. The program is called electronic Consent Based Social Security Number Verification (eCBSV) service.

While the eCBSV program holds strong potential for combatting synthetic fraud, Whitely predicts that it will take years before it becomes a highly effective tool, so Visa is currently promoting the ICS program to issuers.

“The SSN verification service first needs to be built and issuers need to create programs that can effectively reach out to it," Whitley said. "These things take time, especially to get something running smoothly when it doesn’t even exist today."

The eCBSV program will collect an upfront development fee from all participants to create it. The Federal Register reports that the SSA will then charge an annual administrative fee of $3,693 and an annual tier-based transaction charge based on an issuer’s estimated volume.