Identity Fraud: What Online Lenders Need to Know

Identity fraud is a pervasive and rapidly growing form of online lending fraud. Lenders lost over $6 billion from synthetic identity fraud alone in 2016. As data breaches of personal information continue to rise, the problem is only expected to grow. In 2018, data breaches exposed 5 billion records worldwide.

Identity fraud allows fraudsters to hide their identities, co-opt another entity’s credit history, and avoid liability for default. Bad actors can also use identity fraud alongside other forms of fraud, such as loan stacking and document fraud, to secure loans under false pretenses.

Read on to understand what identity fraud is in online lending, and how lenders can fight back using innovative technology.

Identity Fraud

Identity fraud is when a fraudster secures a loan using someone else’s identifying information. The method is popular in online lending since the application process is built for speed and does not require in-person relationships. Fraudsters can steal the identities of a real person, a dead person, or a fictitious persona.

With identity fraud, bad actors hijack the personal identifying information – such as name, Social Security number, bank account information, and credit card numbers –  of a real person. Fraudsters then apply for a loan using this stolen information. The funds are funneled to an email address, bank account, PayPal address, or some other payment conduit that the fraudster has control over.

Fraudsters can access or buy personal identifying information online, sometimes on the Dark Web, sometimes on the open internet. But identity fraud doesn’t even require bad actors to go that far. Every day, fraudsters steal the personal information of strangers, neighbors, acquaintances, friends, loved ones, and even dead people.

To combat identity fraud, TransUnion’s Fraud Prevention Exchange isolates fraudulent identities and suspicious behavior before margins are impacted. Members of the exchange share select transaction data during the loan application process and fraud outcomes from their verification activity. Evidence of fraudulent activities and reported fraud are monitored to alert members when they are likely to fall victim to identity fraud.

TransUnion’s Fraud Prevention Exchange detects fraud at multiple touch points: when a transaction is first started, when the identity verification process is completed, and before funds are released. The Exchange aims to reduce fraud losses without creating friction in the customer experience. Lenders receive alerts that track fraud and suspicious activity within seconds.

Synthetic Identity Fraud

Another rapidly increasing form of identity fraud is synthetic identity fraud. This is when a fraudster secures a loan using a fake persona that combines real data, such as a Social Security number, with false information, such as a phony name and address. Since these fraudsters often use the Social Security numbers of children and other low usage victims, the damage can go undetected for years.

Synthetic identity fraud is the fastest growing type of financial crime in the United States. The average loss for synthetic identity fraud across all sectors is $6,000. According to Gartner, 25% of all charge-offs are the result of synthetic identity fraud, and the number will increase to 40% by 2021.

With synthetic identity fraud, the fraudster will often attach the fake persona to legitimate accounts, possibly building credit by paying back certain loans and credit lines on time. When the time is right, the fraudster will “bust-out,” maxing out as many loans and lines of credit as possible before disappearing.

Synthetic identity fraud is often hard to detect. Both machine learning techniques and unstructured machine learning techniques are not consistently effective in fighting this form of fraud. McKinsey suggests that leveraging third party data is the best defense against synthetic identity fraud.

The idea is this: real borrowers have real histories, and leave trails across several physical and digital systems. These trails are difficult to fake going back many years. A real applicant would likely have previous loan histories, social media accounts, property records, cell phone numbers, prior addresses, and many more past identity data points.

Services such as ID Analytics combine these historical data points to fight synthetic identity fraud. ID Analytics is a credit and fraud risk service that has also become a leader in fighting synthetic identity fraud in online lending. The service gathers insights on identities – how they are behaving and how they are being used – by applying identity analytics to its proprietary ID Network for Know Your Customer (KYC) verification.

ID Network contains over 4.2 million confirmed frauds and is used by online lenders to authenticate nearly every U.S. consumer. ID Network receives more than 100 million new identity elements every day, from markets in nearly 20 industries. Coverage is currently growing into nearly 100% of credit-active U.S. consumers.

Business Identity Fraud

Business identity fraud is when a fraudster either hijacks a business’s identity or fabricates a business in order to secure a loan. The practice is similar to personal identity fraud, but the methods of execution can require more sophistication, due to extra layers of documentation and verification in the application process.

Unlike a consumer loan, a business loan often requires both personal and business credit scores, annual business revenue, business licenses and permits, balance sheets, and other documentation. So why do fraudsters bother with the extra steps? As it turns out, business fraud is 3 to 10 times more profitable than consumer fraud.

As with personal identity fraud, the methods of acquiring sensitive information on a business can range from opportunistic employees or ex-employees, trashcan divers, phishers, data breaches, and other sources of exposure.

Synthetic business identity fraud is a growing threat. Fabricated businesses are not hard to set up. Wyoming, Nevada, and Delaware do not require any proof of identification to incorporate a business. Fraudsters can set up a limited liability corporation (LLC) in twenty-six states without showing beneficial ownership.

Online services can also generate fake invoices and other paperwork that allow fraudsters to create false paper trails. Some fraudsters will go as far as purchasing office space, letterhead, or other business infrastructure to make the company seem real.

To help combat business identity fraud, lenders can harness the Small Business Financial Exchange (SBFE). The SBFE is a highly trusted business data exchange that is governed by the small business lending industry and managed independently from credit reporting agencies. The SBFE gathers data from a consortium of lenders who report on fraud, including identity fraud, and other loan data.

Membership is strictly limited to small business lenders, to ensure responsible use of the data. The SBFE Data Warehouse normalizes the data and maintains contribution quality and vendor compliance. Certified vendors develop fraud and risk products using SBFE Data exclusively for other members.

Identity Fraud: Growing Threat + Innovative Technologies = Manageable Problem

The threat of identity fraud is real and growing for online lending. But there have never been more technologies to minimize its impact. For lenders, the secret to fighting identity fraud is to weave together the right combination of innovative anti-fraud technologies into their underwriting processes.

New forms of synthetic identity fraud and vulnerabilities that lenders have yet to discover will emerge in the coming years. As fraud evolves, so too will the technologies that fight it. But lenders must remain vigilant. Any company that wants to fight back against identity fraud needs to continually monitor and reevaluate the technologies that work best for its particular underwriting process.

If you have initial questions about fraud detection and Ocrolus, visit our FAQ page and Glossary for more information. To learn more about synthetic fraud detection, get in touch with Ocrolus today.