Synthetic fraud brings the pain from many angles — a fluid mix of fake credentials and phony accounts that can overwhelm traditional identity theft tools.
Since the crooks use a variety of methods to build entirely
Research has indicated synthetic fraud in 2017 resulted in $800 billion in losses through credit cards alone, and that amount could reach $1.2 billion by 2020, according to Aite Consulting Group. In another hint of a flood of synthetic fraud brewing, an
With even the underlying foundation of what constitutes an account thrown into disarray by fake names and credentials that aren't tied to real people, security firms such as San Diego-based security company ID Analytics are under pressure to reimagine prevention and protection to match wits with fraudsters.
To combat this growing problem, ID Analytics has developed two products. The ID Score Synthetic is designed for organizations focusing on synthetic accounts as a fraud problem, and the Credit Optics Intentional Misuse for those viewing it as a credit issue.
"It's been the million dollar question, one we have been asking ourselves for several years, as to how to identify a completely fake account," said Kevin King, director of product marketing for ID Analytics. "The tools used to thwart identity theft and some synthetic fraud were not getting the job done, and we needed a purpose-built solution, so that is what we have worked on the past two years."
ID Analytics points to 2011 as the year in which the Social Security Administration made a change in its numbers issuing process that unwittingly opened the door for fraudsters to find the creation of synthetic accounts much easier and safer. After all, an account built on stolen credentials has a short window because the victim will eventually inform the bank and police. With synthetic, there is no real person to become a whistleblower.
The Social Security Administration learned the manner in which it was issuing numbers — in a certain sequence based on the time frame in which a person was born — made it too easy for fraudsters to figure out a person's number, King said. But that process also made it easier for fraud prevention tools to catch a thief who was using a number sequence issued in the 1950s, but claiming a birth date in the 1980s.
To thwart fraudsters from guessing a Social Security number based on a person's age, the administration began issuing random numbers to new citizens.
"The lenders could no longer look at a Social Security number they have never seen before and think it was out of the blue and needed a closer look — because it could easily be one of the new numbers issued randomly since 2011," King said.
Not surprisingly, synthetic account fraud rose dramatically in the following years and "became a popular crime as a result, and a trend that could be called an epidemic," King added.
ID Score Synthetic focuses more on the consistency of the identity as opposed to its individual parts. ID Analytics' database of addresses allows it to know which addresses in the U.S. have most often been seeking credit in the past 16 years. So the system knows what to expect from those addresses.
"Now, all of the sudden, we may see six or seven credit applications in just a few months from one of those addresses, whereas before, there might be one or two over several years," King said.
In addition, the software examines what the credit is for in terms of what a new applicant might be seeking to establish some stability in life. "If the first thing you buy is a TV and a pay TV subscription, before you have a house or an auto loan, or even a cell phone, that is concerning," King said. "You need an address to put that TV at, right?"
Also, ID Score Synthetic can spot any types of changes from the same applicant. It might be a date of birth, an e-mail address or phone number. "People don't change those things very often," King said. "But if we are seeing them change at a rate that makes you think there may be a problem, there probably is."
Credit Optics Intentional Misuse creates a credit score for an applicant and, taking into account all of the data and analytics, can pinpoint one that may intend to misuse credit. That tool would immediately decline the application based on a score; whereas ID Score Synthetic would simply trigger the organization to ask more questions before approving.
It's likely to be a growing trend for banks and organizations that sell on credit to seek ways to halt fake accounts seeking to build solid credit scores, said Julie Conroy, research director and fraud expert with Boston-based Aite Group.
"I do see a lot of banks and fintech lenders looking to front-end solutions that can help them analyze the risk of synthetic identity fraud, " Conroy said. "Early detection is important, not only to minimize future losses, but also because the treatment of suspected synthetics needs to be different than the treatment of third-party fraud."
Lenders can't expect knowledge-based authentication questions to work because the fraudster has established the fraudulent history for the fake identity, and would know all of the answers to questions, Conroy added.
Financial institutions interviewed by Conroy for Aite's research said they averaged losses of $10,000 to $15,000 per account in their prime portfolios. But the average loss for synthetic identity fraud depends largely on the type of loan, the research noted.
While Experian has cited an average of $6,000 for a synthetic fraud account, Aite cited TransUnion's analysis of trade lines opened from July 2016 to June 2017 that resulted in the following chargeoff average per account: credit cards at $3,481, unsecured personal loans at $3,791 and auto loans at $20,182.
