Synthetic Identity Theft – When Credit Risk is Not Credit Risk

Lenders and financial organizations lose billions of dollars every year to synthetic identity theft (also known as synthetic identity fraud), and most are unaware of it. That’s because many of these organizations don’t have the tools necessary to detect and prevent synthetic identity theft. Instead, synthetic identity fraud is often misclassified as credit risk. According to an Auriemma Consulting Group report, up to 20%, or about six billion dollars, of credit losses in 2016 were due to synthetic identity fraud.

Synthetic identity fraud is a technique where a fraudster creates an identity using a mix of personal information from different people or a combination of real and fake personal information. Fraudsters use synthetic identities primarily for application fraud, a form of fraud where a bad actor uses a stolen or synthetic ID to apply for a line of credit or a loan with no intention of paying back the lender. Synthetic identity fraud is difficult to detect because fraudsters often hide behind identities and emulated behavior that makes them look like authentic, real people. Fraudsters will mimic credit growth of a real person before they start to bust out on multiple loans. Based on Experian’s study, the average loss per synthetic identity fraud is ~$6,000 which is much higher than other fraud types.

Last year, Congress enacted a law that includes provisions intended to prevent synthetic identity fraud. We explain an important provision of this bill in a recent blog post. However, it may take several years for the law to be implemented. In the meantime, fraudsters are making the most of synthetic identity fraud while they still can. And because most lenders and financial organizations misclassify synthetic identity fraud as credit risk, fraudsters will continue to get away with this sophisticated form of fraud. Another consequence of misclassification is that many lenders and financial organizations are investing in more credit risk management solutions as opposed to fraud prevention solutions. These investments are misplaced since the losses are due to fraud and not credit defaults.

Differentiating Fraud Risk from Credit Risk

Organizations that offer lending services, lines of credit, or sell goods and services to the public incur both credit risk and fraud risk. The primary difference between credit risk and fraud risk is intent. For example, when a lender analyzes a loan application for credit risk, it is from the perspective that an applicant is a real person who has the credit standing to repay the loan. A traditional credit risk analysis includes checking FICO scores, reviewing credit histories, and verifying addresses- although, in the case of synthetic identity fraud, these things can be faked.

When a lender analyzes a loan application for fraud risk, it is from the perspective that the applicant is a bad actor with no intention of repaying the loan. The lender uses a fraud prevention system that prevents bad actors from opening accounts in the first place. A good fraud prevention system looks at different aspects of the digital data for all applications instead of the risk factors for each application in isolation.

Why Aren’t All Banks Separating Fraud Risk from Credit Risk?

In general, banks do treat credit risk and fraud risk differently. And most banks have disparate systems for managing credit risk and detecting fraudulent activities. However, synthetic identity fraud is difficult to identify. Fraudsters often spend months or years cultivating an account, the ongoing behavior of a synthetic identity is like that of a legitimate borrower. The fraudster will behave in a financially responsible manner- making the loan payments on time and building good credit scores. The fraudster evades detection through legitimate-looking behavior. So, when the fraudster finally defaults on the loan, the lender sees the default as a credit loss instead of loss due to fraud.

Ira Goldman, Senior Director at Auriemma Consulting Group, is quoted in a press release saying that “commonalities between customers in financial hardship and synthetic identities make distinguishing between the two loss classifications extremely difficult. But it’s clear that a significant portion of accounts in collections exhibit synthetic characteristics.”

These characteristics include a good account suddenly becoming inactive with no payments made and the account holder ceasing all contact with the lender.

When synthetic identity fraud lands in collections, it’s too late. Financial institutions must analyze massive amounts of data over an extended period of time so that the legitimacy (or fraudulence) of each account is revealed. For many financial institutions, fraud slips through the cracks because the traditional fraud prevention tools they are using weren’t designed to detect new or evolving forms of fraud.  Traditional fraud prevention tools also weren’t designed to handle the amount of data generated from billions of users. Organizations need new tools for the digital world that we live in.

The Need for New Tools in the Digital World

You can’t prevent sophisticated and evolving types of fraud with credit risk management tools. You need modern tools explicitly designed to detect and prevent fraud. Traditional credit risk approaches are not  reliable because fraudsters are nurturing synthetic identities for years until they have acquired decent FICO scores and formulated a credible financial history. It is difficult, if not impossible, for credit risk management approaches, such as queries to the credit bureau and verification identity databases to detect synthetic identity fraud.

Modern fraud detection solutions like DataVisor are designed to capture sophisticated synthetic identity fraud by taking a holistic approach to find hidden connections between fraudulent activities, even when they appear legitimate in isolation. By analyzing both structured and unstructured data such as profile information, cross-account linkage, account activity and behavior, digital footprints, content, and metadata , the machine learning model can capture both known and unknown frauds at the point of account approval without the need for labeled data or extensive training period.

DataVisor also utilizes the Global Intelligence Network, a proprietary database by DataVisor that leverages deep learning technologies to provide real-time, comprehensive intelligence. This intelligence is based on digital footprint data from more than four billion protected accounts across various industries worldwide.

Want to learn more about how DataVisor protects companies against sophisticated synthetic identity fraud saving them millions of dollars? Contact us to request a trial.