account takeover

Account Takeover: Risk Mitigation Techniques for Online Lenders

Over the last half decade, rates of account takeover have multiplied significantly. According to a PYMNTS.com report, account takeovers jumped 300% in 2017, and have been rising ever since. The trend was particularly pronounced in the lending space. Lenders lost $4 billion from account takeovers last year, according to Javelin Strategy and Research. In order […]

The post Account Takeover: Risk Mitigation Techniques for Online Lenders appeared first on Lending Times.

In order to combat this type of fraud with innovative technology, lenders must learn what account takeover entails.

Online Lending Fraud: What Is Account Takeover?

Account takeover is a form of financial identity fraud. It’s when a fraudster uses a victim’s identity and financial accounts to fraudulently secure a loan and then steal the funds. Fraudsters apply for a loan in the victim’s name, transfer the funds into the victim’s account, withdrawal the money, and then disappear.

Account takeover is riskier than other forms of identity fraud, but it comes with several advantages for fraudsters who want instant gratification. The fraudster does not need to build a fake identity or financial infrastructure to commit the fraud. The fraudster is essentially taking over a person’s identity, pre-existing accounts, and credit history to illicitly funnel money into a safe haven.

Account takeover is facilitated like most other kinds of identity fraud. A bad actor obtains sensitive information, such as bank account numbers, usernames and passwords, and other key credentials from personal contacts, malware, phishing, or other violations of a victim’s privacy. The fraudster takes out a loan in the victim’s name, and routes the funds into the victim’s account.

Once the funds are in the victim’s account, the fraudster moves the funds into an intermediary account by circumventing bank security protocols. These circumvention methods include SIM swaps, associating new phone numbers with the bank account, SMS-grabbing malware, cloning phone identifiers, and other methods.

After the money is in the intermediary account, the fraudster cashes out the funds by making ATM withdrawals, purchasing cryptocurrencies, transferring funds to online payment platforms, or buying e-commerce goods, among other methods. The fraudster might try to hide the origin of the money by employing “mules,” or agents who transfer illegally obtained money, either wittingly or unwittingly.

Combating Account Takeover with Technology Solutions

Account takeover poses unique challenges to online lending, but novel technologies can help lenders fight back against this form of fraud.

ThreatMetrix by LexisNexis Risk Solutions provides data that detects suspicious behavior or compromised devices before fraudsters can initiate account takeovers. ThreatMetrix’s Digital Identity Network analyzes millions of transactions across billions of devices for thousands of leading global businesses. This data allows organizations to verify that customers are who they say they are.

RSA Web Threat Protection uses behavioral analytics to separate fraudulent activity from legitimate transactions. The solution tracks a large variety of fraud threats, such as new account fraud, fraudulent money transfers, password guessing, credential harvesting, mobile and web session hijacking, and other behaviors that suggest potential account takeover attempts.

Fraud.net has an award-winning AI-powered suite of enterprise tools to manage risk for clients such as online lenders. Fraud.net’s AI, analytics, and data mining platform can quickly identify common schemes and attack methods, including account takeover. The suite’s ‘early-warning’ monitoring, powered by multi-dimensional risk analytics, helps to uncover account takeover fraud before it happens.

Account Takeover: A Manageable Issue With the Right Technology

Account takeover is one of the most expensive and fastest growing forms of online lending fraud. However, with the right solutions, lenders can combat account takeover and minimize the negative impact it has on profit margins, platform security, public image, and the customer experience.

Author:

Kevin Bartley is the content manager at Ocrolus.

About Ocrolus:

Headquartered in NYC, Ocrolus is an intelligent automation platform that analyzes financial documents with over 99% accuracy. By eliminating manual reviews, Ocrolus empowers companies to reinvest human capital and automate processes with industry-leading speed and accuracy. Ocrolus services hundreds of customers in the financial sector and analyzes millions of data points every day. The company has raised over $30 million in venture capital, backed by Oak HC/FT, FinTech Collective, Bullpen Capital, and QED Investors, among others. For more information about Ocrolus, visit www.ocrolus.com.

The post Account Takeover: Risk Mitigation Techniques for Online Lenders appeared first on Lending Times.

How to Predict First- and Third-Party Lending Fraud

According to Javelin Strategy & Research, account takeover fraud increased by two million new fraud victims from 2015 to 2016. That represents a 16 percent jump in new fraud cases of that kind in just one year. The problem isn’t getting better. As the alternative lending landscape grows with increased technological advancements, and the number […]

As the alternative lending landscape grows with increased technological advancements, and the number of lenders using alternative credit data and alternative lending practices increases, so too do the number of attempted frauds. Experian’s Clarity Services is an alternative credit data provider with solutions designed to decrease default rates and flag potential fraud before it happens.

Source: Clarity Services

Three Distinct Types of Lending Fraud

Online lending fraud can take on any number of different characteristics, many of them quite sophisticated. But there are three general categories of lending fraud that online lenders should concern themselves with.

First-party fraud is when borrowers use some sort of deception to trick a lender into believing they are a good credit risk and get away with money they do not intend to pay back.
Second-party fraud is a type of lending fraud in which the fraudster is a friend or trusted acquaintance of the party whose name is on the application.
Third-party fraud, often called “identity theft” or “identity fraud” is when someone submits a fraudulent loan application in someone else’s name pretending to be that person. However, unlike second-party fraud, the perpetrator is unknown to the victim and probably acquired the victim’s identity illegally or in underhanded ways.

Each type of fraud presents its particular challenges and should be fought in different ways. This article will focus on first- and third-party fraud.

The Threat of First-Party Lending Fraud

First-party fraudsters are difficult to detect because they apply for loans under their own names. In many cases, the clues that they do not intend to pay back a loan are very subtle and easy to miss.

One popular type of first-party fraud is loan stacking. This is when the applicant submits multiple credit applications at different lenders on the same day hoping to be approved for several unsecured loans. They then accept the various loan offers available to them, take the cash, and never intend to pay it back. For online lenders, where credit standards are often lower than at banks and loans are approved much more quickly, it has become a real problem. Javelin Strategy & Research claims it costs lenders $340 million in annual losses.

The good news about first-party fraud is that it can be detected using powerful predictive tools, which allow online lenders easy and quick alerts to inconsistencies, fabrications, and misrepresentations in loan applications.

The Varieties of Third-Party Lending Fraud

Third-party fraud is a little more subtle. In this case, another party is applying for a loan pretending to be someone else. They’re actually using real-life facts about the victim in order to deceive the lender into giving them money. It is really difficult to detect when fraud rings get their hands on stolen identity information that allows them to apply for multiple lines of credit at several lending institutions. Again, alternative finance lenders are often easy targets.

Here are six types of third-party lending scams often perpetrated against alternative lenders:

Identity theft – Identity theft takes place when personal financial information is obtained illegally for the purpose of assuming that person’s identity. Information can be acquired in a number of ways including dumpster diving and sifting through trash bins looking for credit card bills and other account documents, hacking into databases or mobile phone apps where personal identity information is stored, or buying it on the black market.
Account takeover fraud – An individual or fraud ring gains access to digital data, usually by hacking or phishing. Then they use credit information such as credit card numbers, bank accounts, etc. to access the victim’s money in those accounts.
Information fabrication – This type of fraud relies on falsifying information about a party in such a way that it is believable. For instance, falsified pay stubs for a fictional job are often used to prove current employment.
Synthetic identity fraud – This type of identity fraud now accounts for 85 percent of all identity fraud in the U.S. Fraudsters combine real identity information with falsified information about a supposed credit applicant in order to defraud the lender.
Credit piggybacking – This sophisticated scheme involves a fraudster being added as an authorized user on a credit account in good standing in order to instantly increase the fraudster’s credit score and thus, the likelihood of a loan approval.
Loan stacking – As mentioned previously, loan stacking occurs when an individual applies for multiple loans from different lenders. Third parties can wreak havoc on a victim’s credit file and get away with a lot of cash using this fraudulent scheme.

Fraud can be quite sophisticated, targeting alternative lenders and, in many cases, the most unlikely victims. For instance, a loan stacking ring could obtain the credit information of subprime individuals, use credit piggybacking to boost their credit scores, and add some synthetic identity elements to bamboozle a small lender into approving someone who otherwise would never be approved for credit. Often, they get away with such schemes due to lack of detection and fraud prediction tools.

How to Catch a Fraudster

Experian’s Clarity Services has designed solutions specifically to detect fraud before it happens using predictive variables to look at over 250 fraud-specific attributes. Clear Fraud Insight is designed to lower alternative lender default rates and detect potential fraud before a loan is approved. Some preliminary results have shown a 60 percent increase in acceptances while defaults remained constant, and alternatively, an 11 percent reduction in defaults as acceptance rate remained unchanged.

Different lenders should expect different results. Nevertheless, isn’t it time to upgrade your risk assessment tools?

Author:

Allen Taylor

3 Types of Fraud Threatening Online Lending

After exploring Ancestry.com to assemble her family tree, a woman was shocked to discover that someone had been using the identity and social security number of her deceased nephew who had died in infancy, for more than 20 years. That story, as recently reported by CBS News, is just one example of the growing trends of identity fraud that Americans and businesses are facing today. It’s also become a key challenge in the financial and lending sector and has raised an important question across the industry: how do we thwart the rise of fraudsters while still offering consumers fast, accessible lending options? For many organizations, the answer lies in a multi-layered approach.

FRAUD: A GROWING THREAT

As with most things today, consumers want immediate, convenient results. The same is true for getting a loan. Many consumers are choosing to go online for lending options as opposed to a traditional bank. At the same time, online lenders are also serving a significant portion of the population with little or no credit history. It’s been reported that approximately 45 million Americans fall into this “thin file” applicant category.

Vetting loan applicants can be complex and incomplete without a credit report. A lack of information combined with lightning speed turnaround times (typically loan decisions are made within 24 hours when traditional lending can take up to a week), means online lenders are faced with big loopholes that savvy fraudsters can take advantage of, often without consequence.

Loan Stacking

One of the main types of fraud that lenders should be aware of is loan stacking. This involves taking multiple loans from different lenders at the same time without intent of paying them back. Since most online lenders typically approve loans in less than 24 hours, lenders aren’t able to pinpoint a fraudster or someone who’s applied for many loans within a short period of time, until it’s too late.

It’s become a growing concern for lenders recently and the occurrence nearly doubled between 2013 and 2015. In fact, the speed at which borrowers apply for loans seems to correlate with risk of fraud. It’s also been reported that borrowers who apply for a second loan within 15 days are four times as likely to be identified as fraudsters with no intent to repay, while a third loan makes borrowers 10 times as likely to be fraudulent.

Account Takeover

Account takeover, via identity theft is another dangerous type of fraud for online lenders. While identity theft is not a new issue, fraudsters have taken it to a new level by targeting wealthy individuals, also called “whale phishing” or “whaling.” Proofpoint estimated whale phishing rose an estimated 45 percent in the last three months of 2016. Just recently a Lithuanian man was arrested for defrauding two U.S. Internet companies for more than $100 million through whaling attacks.

That kind of massive blow can be accomplished in a shockingly straightforward way. Fraudsters simply harvest pieces of identification of a targeted individual (i.e. social security number and mother’s maiden name) to take over accounts, apply for as many loans as possible within a short amount of time and then cash out. The pace is simply too fast for lenders to see red flags and criminals are rarely caught. As a result, those fraudulent loans act like money transfers for criminals and lenders must pay the hefty price.

Synthetic Identities

Similar to account takeovers, lenders are also recognizing the need to protect against synthetic identities. In these scenarios, fraudsters use a synthesis of real (stolen) data and fake data to create a new identity. This has created a complicated challenge for lenders, since some of the information supplied might be real, but the combination is fraudulent. This fraud type is a major risk for banks and lenders; Gartner estimates synthetic identity fraud makes up about 20 percent of credit charge-offs and 80 percent of losses from credit card fraud

FINDING THE RIGHT SOLUTION

So how do lenders protect against the rapidly growing risk of fraud? Many lending institutions are joining forces as a first step. Online Lending Network, recently announced by ID Analytics, enables key online lenders like Lending Club, Prosper and Marlette Funding to report when a consumer requests an offer for a loan, submits an application or when a loan is funded.

While collaboration and communication are beneficial, experts are also pointing to the tools that institutions are using to combat fraud. “In the ongoing battle against fraud, online lending institutions would do well to use a broader set of tools that provide additional layers of protection and assurance,” said Robert Capps, VP of Business Development for NuData Security Inc. “Verifying if a particular device or IP address has been used for good transactions in the past (i.e., device authentication), that the transaction came from an actual human, demonstrating the legitimate online behavior of consumers, and utilizing positive consumer identification tools can make fraud attempts less successful and ultimately less profitable for the criminals.”

Tools like Identity Check from Whitepages Pro offer a unique solution to connect many disparate identity attributes to create dynamic and powerful linkages in one search. Identity Check immediately validates a phone number while checking to see if a mobile number has been linked to an applicant in the past. It also checks for an address, email and IP address from which the online account was created. In this way, it brings a more comprehensive vetting solution to online lenders, without sacrificing efficiency.

Fraud is a complex and expensive issue. To effectively tackle the growing threat, online lenders can take strategic steps to protect themselves without treating their good customers like criminals. By validating more identity elements and utilizing linkages, lenders can squeeze fraud out of their application queue, while preserving fast online lending options for legitimate consumers.

Author:

Written by Tom Donlea, Vice President of Whitepages Pro