• Stop being a LURKER - join our dealer community and get involved. Sign up and start a conversation.

Identifying and preventing synthetic identity fraud - for Dealers!

Jeff Kershner

Founder
Staff member
May 1, 2005
4,497
1,786
Awards
12
First Name
Jeff
Identifying and preventing synthetic identity fraud

(Auto Finance Excellence) While preventing fraud has always been a key challenge for businesses in any industry, the task has been made even more difficult by the prevalence of online sales and the increasing sophistication of fraudsters. As states and localities have imposed restrictions on businesses and consumers have dramatically altered their shopping habits in response to COVID-19, automotive dealers have rapidly embraced online sales and off-site deliveries. While this business model has proved to be a lifeline for many dealers, it also increases the opportunity for fraudsters to use synthetic identities to perpetrate fraud.

Unlike traditional identity fraud wherein the fraudster pretends to be another person and uses their credit, synthetic identity fraud involves the creation of a new identity. This can be done by creating a new fictitious identity from scratch without the use of any personally identifiable information (PII), or by combining real and fake PII to form a new identity.

Typically, fraudsters will build up positive credit history on these identities over time. ID Analytics, a credit and fraud risk analytics company, found that the majority of synthetic identities fell within the “good,” “very good,” or “excellent” credit-based Fico scoring model categories. Armed with a positive credit history and a good credit score, the fraudster will identify a final target and then “bust-out” to maximize the heist. “Busting out” happens when the fraudster maxes out its credit accounts and ceases payment.

Because many of these synthetic identities use PII and have attractive credit scores and histories, ID Analytics estimates that 85-95% of applicants identified as potential synthetic fraud would not be flagged by traditional fraud models.

For example, the velocity — or how fast an identity seeks credit — has limited impact because unlike traditional identity fraud, the fraudster is in full control over the identity. As such, the fraudster manufactures the identity over time and is not rushed in committing the crime. For that same reason, confirmed negative behavior and past fraud association measures that may be indicative of traditional third party fraud have limited impact in identifying synthetic identities.

Rather than rely on traditional methods for flagging high-risk applications, a dealer may be able to recognize patterns and behavior that are indicative of synthetic fraud. Real people have real history and will often show consistency over time by using the same physical address, email address, or phone records.

Conversely, synthetic identities are often inconsistent or incomplete because while some PII may be real, others are fabricated or non-recurring. If there is doubt about the veracity of an application or identity, consider the following:

Review the individual’s history: A review of the types of accounts an individual possesses (or lacks) may raise questions and concerns about the applicant. Consistency and permanency around an individual decreases the chance that an account will misuse credit. For example, if the identity has opened several accounts in various locations within a short period, that may be a sign that the fraudster has simply been cultivating a credit score.

Ask “out-of-wallet” or “challenge questions”: Because real people have real history, out-of-wallet questions can trip-up the fraudster and uncover inconsistencies in the application or identity. These questions do not rely on publicly available information and have answers that would be difficult for anyone but the real person to know. For example, though a synthetic identity may contain PII showing a person’s current employer, the fraudster might be unable to confirm where the person worked before beginning their current position, or other details related to their employment history. Likewise, a real person would be able to verify their previous addresses where a fraudster might not.

Implement multifactor authentication: As with out-of-wallet questions, using multifactor authentication is based on the premise that fraudsters can’t provide the same level of proof as a real customer. Providing customers with a one-time password or code used to confirm their identity is a popular way lenders can strengthen the authentication process. Real people generally use the same phone numbers and email addresses, and requiring the applicant to confirm they have access and ownership of these accounts is an easy way to curb synthetic fraud.

Review bank account data: Often, fraudsters will use stolen or counterfeit payment methods when building the identity’s credit and busting-out. Using a vendor or third-party service to review bank account information may uncover inconsistencies within the synthetic identity and reduce the risk that an account is fraudulent.

Incorporate non-traditional data: Non-traditional data, such as phone records or social media accounts, may serve as an additional line of defense. So much of people’s lives are online through their social media accounts, and a quick online search may be able to confirm whether the applicant is who they say they are.

As dealers move to online sales and off-site delivery, they should be especially vigilant to guard against synthetic identity fraud.
 
  • Like
Reactions: Tallcool1
I have bumped into a few extremely well designed fraud schemes in the past couple of years. One in particular stands out to me.

High line vehicle being sold 100% online. Vehicle was being shipped to Chicago, "customer" worked at a high end marketing firm. The deal made absolute sense on paper. Due to the nature of the transaction, I was extremely cautious. There was something that just gave me that feeling that we get. I didn't know what it was, but I just had this feeling. I emailed all documents with specific instructions regarding completion of the forms. When I received the documents back, the paperwork was executed at about a C+ level. Red flag, high powered business executives know how to follow directions and complete a simple document stack.

I decided to call the employer through the main switchboard as opposed to calling the direct line. Sure enough it was fraud.

This is getting harder every day. I just got lucky on this one.

My best advice is this: When the buyer is pushing, rushing, presents deadlines (I must have the vehicle by this weekend), etc.....SLOW THE FUCK DOWN!! These people are con artists and are extremely well versed in psychology and human nature. Keep your emotions out of these transactions and slow down!
 
I have bumped into a few extremely well designed fraud schemes in the past couple of years. One in particular stands out to me.

High line vehicle being sold 100% online. Vehicle was being shipped to Chicago, "customer" worked at a high end marketing firm. The deal made absolute sense on paper. Due to the nature of the transaction, I was extremely cautious. There was something that just gave me that feeling that we get. I didn't know what it was, but I just had this feeling. I emailed all documents with specific instructions regarding completion of the forms. When I received the documents back, the paperwork was executed at about a C+ level. Red flag, high powered business executives know how to follow directions and complete a simple document stack.

I decided to call the employer through the main switchboard as opposed to calling the direct line. Sure enough it was fraud.

This is getting harder every day. I just got lucky on this one.

My best advice is this: When the buyer is pushing, rushing, presents deadlines (I must have the vehicle by this weekend), etc.....SLOW THE FUCK DOWN!! These people are con artists and are extremely well versed in psychology and human nature. Keep your emotions out of these transactions and slow down!

This is almost identical to what we dealt with a few weeks ago.
 
  • Like
Reactions: Tallcool1
Working one now that seemed to fit this pattern, convincing them to appear in person, so we can verify a few things. At least verified they have facebook accounts, photos of each of them, etc - so perhaps they are legit.
 
Verify Employment with a phone call. Good Luck.

Yes, we did that a few times and many times they would not offer the information. And DO NOT call the number the customer provides. We had a customer that had someone on standby, pretending to be their place of employment. Easy to do with a burner phone/app.
 
  • Like
Reactions: Tallcool1