White Paper. Account Opening: The Front Door of Fraud. Effective Enterprise-wide Fraud Mitigation Solutions to Combat New-Account Fraud

Transcription

1 White Paper Account Opening: The Front Door of Fraud Effective Enterprise-wide Fraud Mitigation Solutions to Combat New-Account Fraud August 2010

2 Table of Contents Introduction The hidden costs of fraud Fraud challenges Beef up your front-line defenses first Scenarios for fighting application fraud Summary

3 Introduction Lenders are making progress in improving their fraud mitigation processes, but much work remains to be done. The number of identity fraud victims rose 12 percent in 2009 to 11.1 million adults. The total annual dollar amount of identity fraud increased 12.5 percent to $54 billion the highest level since the survey began in The faceless channel for account opening is highly vulnerable More than three-fourths of American adults are Internet-active at home, 4 and most Internet users have become comfortable in conducting their financial affairs online. As Internet access becomes ubiquitous for U.S. consumers, cyber-criminals have taken note. Fraudsters have stepped up their efforts to exploit the Internet for identity theft, account takeovers and other forms of fraud. The result: Online account opening for credit cards and other non-secured loans a preferred growth channel for lenders has become one of the most popular avenues for fraud. According to a Javelin study, the use of stolen identity information to open new credit card accounts increased 33 percent in In the online channel, new accounts opened fraudulently were more than double 2008 s levels. 2 This white paper: examines fraud trends from the lender s perspective, mainly focusing on fraud related to opening new accounts suggests specific solutions to protect against both true-name and synthetic identity fraud. The hidden costs of fraud Criminals are targeting easily monetized payment card information. Most are credit cards but debit cards, too, are vulnerable. Credit cards are an attractive target for fraudsters throughout a card s life cycle. Opportunities for fraud are present at account opening, during online account maintenance, during online transactions and at the point of sale, when a card is lost, and even after the cardholder has died. 1

4 Challenges in dealing with fraud 1. Fraud is hard to measure. Fraud has varying definitions, and even the definitions can be ambiguous. When fraud is suspected, lenders are often reluctant to pinpoint an account, application or transaction as being fraudulent without clear proof. Consequently, many fraudulent transactions are written off as credit losses. xxxxxxxxxxxxxxxxxxxxxxxxxxx 2. Fraud patterns are a dynamic, moving target. When lenders bolster their fraud defenses in one area, criminals find new soft spots and shift their attacks to these lessprotected areas. Mercator Advisory Group calls this the balloon effect, with fraudsters constantly probing for the most vulnerable, least defended areas and focusing their efforts on these weak spots. xxxxxxxxxxxxxxxx 3. Fraud mitigation efforts need to be dynamic, too. Lenders need to constantly scrutinize and upgrade their fraud defenses. Old methods may not need to be discarded many of them still need to be in place, just modernized and expanded to keep up with fraudsters ever-shifting tactics. xxxxxxxxxxxx 4. Fraud containment efforts may collide with growth goals. Lenders understandably want to maximize new business opportunities. Their dilemma is how to screen effectively for the likelihood of fraud without generating too many false positives legitimate applicants who are declined because they exhibit some traits often seen in fraudulent applications. 5. New customers and fraudsters both prefer the online channel. Look at the demographics of the customers you re trying to attract. More and more are likely to be younger professionals who rely heavily on the Internet. A new bank customer, for example, may be more familiar with the bank s website than its nearest brick-and-mortar bank. The trick is to exploit online channels without taking on excessive fraud risk. xxxxxxxxxxxxxxxxxxxxxxx 6. The scope of fraud activity is broad. Because there are so many aspects to fraud detection, prevention and resolution, and because they change so rapidly, fraud control managers face daunting challenges. There are no full-scale solutions that fit every lender s situation. Estimates or measurements of annual fraud losses of credit card issuers are difficult to find. However, Mercator Advisory Group has attempted to shed light on the extent of credit card fraud. Its December 2008 report, Credit Card Issuer Fraud Management, notes that fraud losses are keeping pace with the growth in the value of credit card transactions. The report pegs credit card fraud losses at around $1 billion in the U.S. or 1.2% of issuer expenses. 3 This, however, is just the tip of the iceberg. Unreported and undetected fraud losses at issuers, says Mercator s report, are significant and probably end up classified as credit losses. When hidden costs are considered, the total loss figure mushrooms. According to Mercator, the direct costs of fraud attributable in some way to U.S. credit cards could easily exceed $16 billion. And that doesn t include about $2 billion that banks spend on fighting fraud with technology, staffing, investigations and related fraud control expenses. Nor does it include the largest, murkiest, unknown cost category that Mercator calls the dark numbers of fraud: victim costs, damaged company reputations, unreported and undetected fraud, misclassified issuer losses, data breach forensics, lawsuits, and opportunity costs. Fraud challenges Financial institutions face a multitude of challenges in dealing with the many faces of fraud. (See sidebar.) For many, protecting against new-account fraud needs to be a top priority. Various point solutions address different pieces of the fraud mitigation problem, and some are specifically designed for the Internet channel. For example, during an online application process, the IP address can be checked for consistency with the applicant s billing address. Other tools can be applied to specific situations, channels or product lines. However, no comprehensive solutions exist for enterprise management of fraud. There are no swift-to-implement, turnkey solutions. Beef up your front-line defenses first Many financial institutions lack the resources to implement all best practices for fraud management in the near term. However, fraud mitigation demands constant attention. Inaction is not a realistic alternative for forward-thinking financial institutions. 2

5 Equifax recommends that lenders objectively assess their fraud control strengths and weaknesses, and use the assessment to set realistic goals. Industry Executive Concerned About New-Account Fraud BankInfoSecurity.com, a reference site for the banking community, named online account applications as one of ten predominant types of fraud that institutions and their customers can expect to see in 2010, according to industry experts. Criminals use new accounts not just for immediate financial gain; they also use multiple accounts to keep cash balances from becoming suspicious and to create identities for future activity. 4 Focus attention on any weak spots in your first lines of defense. Account opening needs to be a rock-solid bulwark in your fraud defenses. The best way to fight new-account fraud: Use an integrated suite of real-time defenses at the time and channel of application. A strong approach should have these attributes: Real-time processes for identity verification and out-ofwallet authentication Flexibility to apply different fraud mitigation solutions to different types of fraud Robust leveraging of internal and external data sources, supported by appropriate analytics Scenarios for fighting application fraud Equifax has expanded its line of fraud mitigation products into an integrated, real-time suite. Here are a few examples illustrating how the Equifax Identity Suite addresses some typical scenarios of application fraud: Scenario I: True-Name Identity Fraud Business problem: Criminals use stolen identities to open new accounts via a lender s online or call center channel. It is fairly easy for a criminal to obtain personal information (such as name, address, Social Security number and date of birth) to use in a fraudulent manner. As a result, identity theft continues to be a major white collar crime in the United States. Identity theft can be defined as any act in which someone uses the personal information of another without that person s knowledge or consent. A common term for this type of identity theft, where the fraudster poses as the actual consumer, is true-name fraud. Fraud scenario: Relying on the anonymity of a credit card issuer s Internet channel, a fraudster uses stolen personal information to apply for an account in the victim s name. 3

6 The ROI of Fraud Mitigation What s the value of real-time screening of loan applications? For one Equifax customer, a regional bank, the value exceeds $2 million per month. Previously, the bank s processes were unable to perform fraud checks until after loan decisions were completed so a few days often passed before fraud was detected. The bank turned to Equifax for a solution that would screen loan traffic for fraud in real time, enable custom fraud rules using multiple data sources, and perform analysis of fraud hits. Equifax designed a comprehensive solution, including verification and authentication tools, along with data integration, workflow management, analytics and decisioning capabilities. The new fraud mitigation program eliminates delays, minimizes manual activity and reduces potential fraud losses. Net savings the first year amounted to $14.2 million, after deducting the total first-year costs for the solution (about $400,000 for software, implementation and transaction costs). The latest data shows the savings from prevented fraud losses are ongoing and growing in fact, the savings now exceed $2 million per month. To detect attempts at true-name fraud, especially in the Internet channel, lenders need more than simple fraud tools that cross-check applicant-supplied information with various databases. Anti-fraud tools that merely check the validity of the name, date of birth and address, for example, don t thwart criminals who have already obtained that information through some means of identity theft. Solution: Use a combination of authentication and modeling techniques. Predictive modeling. Studies by Equifax have proved that predictive tools customized to a specific lender are effective in spotting fraudulent applications in a real-time environment. Predictive modeling can demonstrably reduce losses from true-name identity theft. Optimum performance is achieved when the model draws upon a variety of data types, including: credit-file attributes, such as balance, high credit, delinquency, and inquiry information. Mismatched attributes. Examples of mismatch situations that generate flags: drivers license number, house number, date of birth month/year, name/address/ssn. application-specific attributes channel and time of application can be indicators of fraud. Fraud is a difficult behavior to define and even more difficult to predict. The bad guys are constantly changing their methods, making patterns hard to establish. Therefore, predictive solutions must be continually updated with the latest data. From a technology perspective, there is no cookie-cutter, one-sizefits-all approach to fighting fraud. Just as you might use several tools to repair a leaking faucet, several tools may need to work together for specific fraud detection and mitigation situations. True-name fraud calls for a combination of strong defensive measures aimed at answering the key question: Is the applicant the person he or she claims to be? Advanced techniques can often identify true-name fraud at the source, at the time of application. Two of the best techniques are: Real-time authentication. In the high-exposure Internet channel for credit applications, one proven technique is to ask the applicants several knowledge-based questions. The answers, which are delivered in real-time, should only be known by the real person. 4

7 Many banks and credit unions rely on eidverifier as the cornerstone of their ID authentication defenses against true-name fraud. eidverifer can be used in call centers or via the Internet to authenticate a consumer s identity using an adaptive real-time quiz capability. The tool presents multiple-choice questions to the applicant that should only be known by that actual person. Equifax works closely with customers to include plenty of innovative, out of wallet questions from credit and non-credit sources. For example, using proprietary information from Equifax s unique The Work Number service, eidverifier can create queries based on current or former employment. In addition, eidverifier: performs transactional velocity checks to detect repeat attempts uses a statistical model to provide a fraud index score as part of the overall assessment relies on non-public sources to minimize false-positives Scenario II: Synthetic Identity Fraud Problem At the credit bureau, an inquiry on an identity fabricated in this manner created a no-hit just what the criminals wanted, knowing that this lender s policy allowed booking applications from no-hits. Business problem: A credit card issuer experiences fraud losses when criminals use fabricated account information, usually with a real SSN. To open an account, scammers may create a whole new identity using a combination of real and false information. Typically, the fraudster attaches a bogus name to a real Social Security number. Called synthetic identity fraud, this type of fraud is increasing and is becoming more common than true-name identity fraud. Up to half of all new account fraud involves synthetic identities that often go unreported, Gartner Inc. estimates. 5 Fraud scenario: A card issuer offered credit cards via the online channel. Criminals soon uncovered the opportunity for synthetic identity fraud. Taking advantage of the loose credit policy, they fabricated bogus identities. In most cases, the fraudsters concocted names and addresses, and gave each identity a birth date within the 21 to 23 age range. Then they assigned real social security numbers to each fictitious applicant. 5

8 Solution At Equifax we do not build synthetic fraud files. We do not add trades to a file when the Social Security number belongs to someone else. We do not add the inquiry Social Security number to the Social Security segment. Solution: Use identity component screening especially the applicant s SSN, which needs to be scrutinized closely. The crucial first step in recognizing, and combating, synthetic identity fraud is to scrutinize the identity s components (such as name, address, Social Security number, and telephone number). Are they accurate; what is known from existing records about portions of the identity? The overall goal is to verify the existence of this identity. Discrepancies in Social Security numbers are frequently a tip-off to synthetic fraud. Equifax has several products that complement each other in assessing the validity of Social Security numbers: 1. Identity Scan checks SSNs for high risk factors for example, has the SSN ever been issued by the Social Security Administration? Was it issued recently? Has the SSN been reported as deceased or misused? 2. Equifax SSN Affirm checks whether the SSN belongs to a real person. It uses a proprietary comparison algorithm to see if the SSN matches the applicant s name, the name of another consumer, or no names in the database. Moreover, Identity Scan found that many of the SSNs were issued in the 1950 s and 60s long before the birthdates of the applicants. Summary In the fight against fraud, there is no cookie cutter approach for lenders. Often the best strategy involves multiple layers of defenses. With the right mix of fraud mitigation tools, you not only minimize losses, you also improve compliance and staff productivity. The Equifax Identity Suite provides your organization with an integrated suite of real-time, industry-leading defenses against account opening fraud a proactive solution that acts at the time and channel of application. The suite consists of identity screening, verification and authentication tools that work in real time to minimize losses from various types of fraud. Equifax augments the Identity Suite with differentiated data assets and predictive analytics, all delivered through flexible decisioning technology. 6

9 Products in the Equifax Identity Suite can be quickly and seamlessly integrated into your account opening processes. The products provide high ROI, which comes from multiple sources: significantly reduced identity fraud losses reduced operational costs by eliminating much of the time wasted on excessive manual reviews of false positives and time-consuming verification processes higher profits by minimizing false negatives and application abandonment by legitimate prospects higher loyalty and retention of security-conscious customers Equifax has extensive experience working across multiple industries to help customers optimize their fraud prevention processes. We welcome the opportunity to explore the best fraud mitigation approaches for your environment and level of risk. 7

10 About Equifax Equifax empowers businesses and consumers with information they can trust. A global leader in information solutions, we leverage one of the largest sources of consumer and commercial data, along with advanced analytics and proprietary technology, to create customized insights that enrich both the performance of businesses and the lives of consumers. With a strong heritage of innovation and leadership, Equifax continuously delivers innovative solutions with the highest integrity and reliability. Businesses large and small rely on us for consumer and business credit intelligence, portfolio management, fraud detection, decisioning technology, marketing tools, and much more. We empower individual consumers to manage their personal credit information, protect their identity, and maximize their financial well-being. Headquartered in Atlanta, Georgia, Equifax Inc. operates in the U.S. and 14 other countries throughout North America, Latin America, Europe and Asia. Equifax is a member of Standard & Poor s (S&P) 500 Index and its common stock is traded on the New York Stock Exchange under EFX. Endnotes 1 Javelin Strategy & Research. Javelin Study Finds Identity Fraud Reached New High in 2009, but Consumers are Fighting Back. News release. February 10, Javelin. Javelin Study Finds Identity Fraud Reached New High in Paterson, Ken. Credit Card Issuer Fraud Management Report Highlights. Mercator Advisory Group, December McGlasson, Linda. 10 Faces of Fraud for Bankinfosecurity.com. December 14, Gartner, Inc. 7.5 Percent of U.S. Adults Lost Money as a Result of Financial Fraud. 8

11 This publication contains many of the valuable trademarks, service marks, names, titles, logos, images, designs, copyrights and other proprietary materials owned, registered and used by Equifax Inc. and its affiliated companies, including but not limited to the registered mark Equifax ; any unauthorized use of same is strictly prohibited and all rights are reserved by Equifax Inc. and its affiliated companies. All other trademarks and service marks not owned by Equifax Inc. or its affiliated companies that appear in this publication are the property of their respective owners. Copyright 2010, Equifax Inc., Atlanta, Georgia. All rights reserved. Printed in the U.S.A. EFS-1004-ADV 8/10