By Roy Urrico
Synthetic fraud and outstanding balances for suspected synthetic accounts at U.S. financial institutions declined significantly following declaration of a COVID-19 pandemic last March, according to TransUnion research. However, a study by technology analyst firm Aite Group finds the cost of synthetic fraud set to rebound to new elevations post-pandemic.
Synthetic identity fraud involves fraudsters creating false identities by patching together actual authentication elements and fake information to open sham accounts. Most companies do not grasp the complete scope of their synthetic account exposure, since synthetic attacks are often written off as credit losses (aka “diabolical charge-offs”), according to the study.
“The dip in synthetic fraud during the pandemic was a continuation of our 2019 findings that showed synthetic fraud was slowing amid the emergence of solutions that connect personal and digital identities,” said Shai Cohen, TransUnion senior vice president of global fraud solutions. “We believe this slowdown was compounded by fraudsters who went elsewhere and could be lying in wait to take advantage of pandemic loan forbearance programs that may not have come due yet. Once synthetic fraud reemerges, which we think it will, companies must be ready.”
Despite the recent drop in synthetic fraud at financial institutions, an Aite Group report, “Synthetic Identity Fraud: Diabolical Charge-Offs on the Rise,” sponsored by TransUnion, forecasts the cost of synthetic fraud to rise in the coming years. Aite Group estimates that synthetic identity fraud for unsecured U.S. credit products will reach $1.8 billion in 2020 and will grow to $2.42 billion in 2023. This report examines synthetic identity fraud’s impact and best practices in combating the issue. For its research, Aite Group surveyed 46 North American fraud executives in September 2020. The report also includes input and insights from ongoing Aite Group conversations with fraud executives at financial institutions (FIs) and fintech lenders.
“Synthetic fraud is an extremely difficult problem to solve,” said Aite Group Research Director, Julie Conroy. “Out of financial services firms that we recently surveyed, 72% said that they believe synthetic identities are a much more challenging issue to identify and address than identity theft.”
The majority of financial services firms recognize significant gaps in respective application fraud control frameworks, and 78% of executives who were surveyed plan to make substantive changes in the next one to two years.
The report also revealed, while financial services firms are certainly a key target of these attacks, a number of other vertical markets also feel the pain of synthetic identity fraud, including property rentals, utilities, telecom and gambling.
Outstanding Fake Auto, Card and Loan Balances
Chicago-based financial information firm TransUnion’s latest analysis of outstanding balances attributed to suspected synthetic identities for auto, credit card and personal loans found them at their lowest levels since the first quarter of 2016. The latest data available (third quarter 2020), discovered synthetic fraud balances in those sectors stood at $855 million — down from a high of $1.05 billion in quarter three of 2018. The TransUnion analysis found instances of synthetic fraud dropped markedly for most credit products for the second and third quarters of 2020. In the third quarter of last year, the percent of new auto loans and credit card accounts linked to a synthetic fraudster declined to the lowest points since TransUnion began tracking them in 2016.
TransUnion also documented a 32% decrease in new credit cards and a 23% decline in new auto loans linked to synthetic fraud from third quarter 2019 to third quarter 2020. Beyond financial services, which TransUnion documented had the highest amounts of digital synthetic fraud in 2020, it determined e-commerce and iGaming were the industries with the second and third highest amounts of synthetic fraud last year.
Boston-based Aite Group estimated business losses due to synthetic identity fraud for unsecured U.S. credit products — those that do not require businesses or individuals to put up any collateral for the loan — will reach $1.8 billion in 2020 and grow to $2.42 billion in 2023.
Detecting Potential Synthetic Identities
The Synthetic Identity Fraud report emphasized the U.S. market as a hotbed of this type of deception (given the historical lack of a centralized source of truth for consumers’ identities). “The topic has been gaining increasing scrutiny over the past few years. Many firms are investing in technologies to help better identify synthetic fraudsters at the time of application, as well as find those lurking in existing portfolios.”
The study cited how in 2018, the U.S. Federal Reserve launched an initiative to raise the financial services industry’s awareness of the risks of synthetic identities and the U.S. Congress passed a bill requiring the Social Security Administration to enable a real-time service allowing authorized firms to verify an applicant’s name, social security number (SSN) and birthdate. The resulting Electronic Consent Based Social Security Number Verification (eCBSV) program, slated to begin its pilot phase in June 2020, struggled to launch.
Synthetic identity fraud risk requires a layered approach to secure trust in digital channels. The Aite/TransUnion report suggested data exchanges and consortia are the most highly favored solutions by survey respondents; 82% believed them to be highly effective or effective when combating synthetic identity fraud. Third-party analytic models are a close second, with 72% of executives deeming these to be highly effective or effective.
While most of the executives surveyed believe that the eCBSV program will be a helpful tool, it will not be a silver bullet. The lack of fuzzy matching is a key concern; executives expect high levels of false positives as a result.
Synthetic Fraud Services
TransUnion has added a non-credit synthetic fraud algorithm to its synthetic fraud services, which historically relied heavily on Fair Credit Reporting Act (FCRA) regulated credit data. In addition to the credit and non-credit models, TransUnion also intends to offer full integration of eCBSV capabilities in the near future.
TransUnion noted its TruValidate Synthetic Fraud Models detect potential synthetic identities by analyzing consumer behaviors and uncovering anomalies or suspicious risk, offering a real-time indicator of the threat level before fraud is committed, while still supporting a great consumer experience for genuine consumers. TruValidate synthetic fraud solutions include both FCRA and now Gramm-Leach-Bliley Act (GLBA) compliant models.
“With almost every consumer’s information for sale on the dark web, today’s fraudsters are extremely adept at creating synthetic identities with fabricated or compromised identity elements,” said Bala Kumar, vice president of product management of global fraud solutions at TransUnion. “Most consumer-facing businesses rely on a variety of identity and digital verification methods to assess initial fraud risk. None of these are adequate to truly identify suspected synthetic identities since they can behave like legitimate accounts.”
TransUnion recently launched its GLBA Synthetic Fraud Model, which further ensures a friction-right experience for the majority of consumers who carry little to no synthetic fraud risk and do not warrant additional authentication steps. The model analyzes SSNs and other personally identifiable information (PII) sharing across identities, looking for anomalies, such as large numbers of consumers sharing an address or unusual address tenure patterns.
In its efforts to thwart synthetic fraud, TransUnion is also finalizing authorization by the SSA to be an eCBSV service provider. This will enable TransUnion to help financial institutions electronically verify an individual’s SSN.
The TransUnion synthetic fraud solutions are part of its flagship identity proofing, risk-based authentication and fraud analytics solution suite—TransUnion TruValidate. Formerly IDVision with iovation, TruValidate unites personal and digital data into a comprehensive data identity platform.