You’ve heard the phrase, “If it sounds too good to be true, it probably is.”?   So when you’re listening to a sales guy trying to pitch you the latest greatest fraud tool you might want to be on the alert for anything that sounds a little too rosy.   You probably know what I’m talking about right?

I’m admittedly an old school guy that has been around the fraud prevention industry from the 90’s when there were only a handful of fraud companies doing business.  Back then, everyone knew everyone and most vendors in the space were also fraud practitioners themselves so they understood the dynamics of fraud well.

Today, there are thousands of fraud vendors pitching every product, every model, every solution you can think of.   And they’re all vying for your business.   There’s a lot of sales guys out there pounding the pavement trying to cut deals.

With so many salespeople pounding the pavement, some might be prone to embellish the truth a bit.  Here are some of the more common outlandish claims I have heard over the years.

#1 – We Got the Silver Bullet – This Here Solution Will Stop 100% Of Your Fraud

Some claims are simply not true.  This has to be at the top of the list.

We can stop 100% of your fraud!  This is the only fraud tool you will ever need! This fraud tool replaces everything you have built or bought over the last 15 years!  This is the silver bullet.! It’s impervious to any fraud attempt any shady crook can think of!  Your days of worrying about fraud are over!

The fact is, that’s an outlandish claim.  Everyone knows that fraud programs are a series of layered defenses and no fraud tool be all things to all people.

#2 – Sick of False Positives?  Guess What We Have None.

There is no such thing as a solution with no false positives.  Every fraud solution is going to have them and actually good fraud solutions make more wrong decisions than they do right ones.  They just make the wrong ones less.

Even a solution that has 2:1 false positives makes twice as many wrong predictions than they do correct ones.

So if your sales guy says something like this, raise your left eyebrow up a bit and say, “oh really..?”  And draw out the really like that so he knows you don’t believe them.

#3 – You Can Customize Absolutely Everything In This Solution!

The old customization angle is always designed to solve all the use cases in a single RFP.  I got news for you.  No single solution can be customized to solve all of your fraud problems.

Here are some of the things you might hear.

Want rules?  Add as many as you want!  Want 1000 realtime data feeds across 10,000 bank branches operating seamlessly all with a simple drag and drop interface?  We got that!  Want every user to have their own customized case management screen?  No problem.  We’ve got everything covered.

Be wary of these claims for obvious reasons.  Need I say more?

#4 – This Solution Will Eliminate Your Need for Fraud Analyst!

One of the biggest claims you will hear these days is that you can fully 100% automate fraud decisions without human intervention.  This is not realistic for many reasons.

Machines make mistakes.  Product’s aren’t perfect.  Any company that tells you that their solution will eliminate the need for fraud analyst isn’t being realistic.  You will always need fraud analyst so don’t go out and buy a solution and think you’re going to be able to fire your whole fraud team.

#5 – You Can Write and Deploy Your Own Models With Zero Experience!

The old deploy a model in seconds with a few clicks of the button seems to be a major selling point these days.  Call me old fashioned but I still think you need data scientist to help you build and deploy models the right way.

There are some of companies that might claim that you can write and deploy state of the art machine learning models with zero experience by punching buttons and letting the magical models just start to stop all of your fraud.   Good models require good data scientist and experience to avoid pitfalls.

Be leery of any sales guy telling you how easy it is!

Thanks for reading.  Have fun evaluating your fraud solutions. It’s a jungle out there!

Tommy DeVoss has spent his life hacking websites and he even spent years in jail for his crime.

But now he uses his power for good and can make up to $160,000 a day exposing bugs and holes in big companies’ websites.

What used to be a hobby for Tommy has turned into a full-time job. He works about 10 hours a week and expects to make about $1 million a year for his services.

Watch this incredible video that details this unusual job.

AI company, Riskified, out of Tel Aviv has just completed a capital raise of $165 million which means the company is now valued at over $1 billion dollars.

A “Unicorn” refers to a startup reaching or exceeding $1 Billion in value. That puts Riskified squarely in Unicorn status and make them one of the hottest fraud start-ups in history.

Led by global growth equity firm General Atlantic, Riskified will use the additional funds to scale both domestically and globally.

Riskified is big. They currently employ over 420 employees at its Tel Aviv and New York offices and they are planning to open an office in Shanghai later this year.

Riskified is growing like crazy enjoying a 250% compound annual growth rate over the past five years.

They claim to protect about 500,000 transactions each and every month protecting against billions in losses.

What’s most exciting about this funding is what it will allow us to do. We’ll use these funds to accelerate our product development and further expand our geographic footprint. We’ll be able to offer even more solutions that help merchants drive revenue and deliver a better customer experience. The new clients and partners that we onboard and the new products we deliver will, in turn, increase our accuracy and improve our performance. 

Eido Gal, Founder Riskified

Pioneers in Fraud Guarantee and Machine Learning

Founded by Eido Gal and Assaf Feldman in 2013, what started out as a simple idea is now a scalable solution trusted by hundreds of global brands.

From luxury fashion houses and retail chains to gift card and ticket marketplaces, the company has focused on providing merchants of all sizes a guarantee against fraud.

Using their machine learning and scores, merchants can elect to pay a single per transaction cost which indemnifies them against any fraud loss. If a merchant suffers a chargeback related to a transaction approved by Riskified, the company will cut the merchant a check to reimburse them for the loss.

If you have been waiting for a silver bullet against synthetic identity fraud, you might be interested to hear that the Social Security Administration is taking big steps to make that happen.

The SSA announced an initial enrollment period for the much anticipated electronic Consent Based Social Security Number verification service this week.

The SSA announced that they will roll out the service to a limited number of users in June of 2020, and then plans on expanding the number of users within six months of the initial rollout.

Will be Similar to E-Verify Type of Service

For those of you wondering how the service will work, it will be similar to E-Verify where banks, lenders and others can now verify that the name and social security number provided on an application matches what has been reported to the Social Security Administration.

Both Service Providers and Financial Institutions Can Participate

Financial institutions with any transaction volume can participate in the pilot. And service provider, and their affiliates can participate but the SSA is limiting them to provide the service to 20 or less of their customers and no more than 20 million transactions.

Limited to 6 Participants – First Come- First Serve.

Due to high demand, the SSA will be requiring “entities” to submit an application to participate in the pilot. They will choose the participants based on how early the application is submitted in the process.

The enrollment period to apply for access will open on July 17, 2019, at 6 a.m. Eastern, and will close on July 31, 2019, at 6 p.m. Eastern.

Pricing for The Pilot Period

For banks and lenders accustomed to free pilots, they will be disappointed to learn that there will be a cost to participate in the SSA’s pilot program.

The price the lender pays will be based on their size and transaction volume. The SSA is using this pilot program to fund at least 50% of the total programs startup cost so pilot members will basically be funding future users of the platform if it gets off the ground.

The pilot members will be required to pay a startup cost of $3,693 to startup and then pay a tiered transaction cost based on their volume. That cost could range from as little as $3,000 and as high as $5,000,000.

Still Requires Consumers Consent

For those organizations that want to ping away at the Social Security Administration database, that will not be the case. Access to the service will still require the borrower to consent to the check by electronically agreeing with their signature.

Completion of this additional paperwork by the borrower has often been the primary sticking point for banks and lenders that do not want to introduce additional friction into the lending process.

For more information you can contact Michael Wilkins, Office of Data Exchange, Policy Publications, and International Negotiations, Social Security Administration, 6401 Security Boulevard, Baltimore, Maryland 21235-6401, (410) 965-9360, email [email protected]

Is facial recognition the answer to the growing problem of Auto Lending Fraud?  The largest bank in Brazil – Itau Unibanco – believes that it is and they have just launched a solution designed to drastically reduce their fraud losses.

The new solution, which is being launched this month across over 10,000 locations, is aimed at ensuring a smooth process when it comes to approving and releasing credit for customers who want to buy new and used cars.

With the new technology, when customers submit their documents for a loan, the bank will send an SMS text message initiating a process for the borrower to take a selfie with their phone and then send the selfie to Unibanco.

When Unibanco receives the selfie, they will use artificial intelligence and AI to identify the legitimacy of the borrower.   The process is designed to improve the lending process and to speed up the funding of loans while reducing fraud.

“Investing in technology to develop innovative solutions aims to reduce bureaucracy in the process of buying and selling vehicles, improving the consumer experience and, consequently, the efficiency of the entire automotive chain,” says director at Itaú Unibanco, Rodnei Bernardino de Souza.

Will US auto lenders begin to use this same process? In the next 24 months, we might expect more lenders to adopt similar use cases.

New account and loan fraud is on the rise across the globe and BioCatch this week believes that is in large part due to synthetic identity fraud, which is rendering static identity proofing useless in the application process.

BioCatch has unveiled several red flags that they have uncovered that lenders and banks can use to determine if an application is more or less likely to be fraud – and it has everything to do with how the fraudster fills out the application online.

There are 4 red flags that they highlight and their approach to finding this is unique.  They track the way that an applicant interacts with the online web page – the way fields are filled out, how quickly a form is filled out and how the mouse movements are made.

#1 – Fraudsters Committing Synthetic Identity Fraud Are Too Familiar With the Process

Fraudster exhibit a high degree of application fluency – They repeatedly use compromised or synthetic identities and demonstrate a high level of familiarity with the new account opening process.

#2 – Fraudsters Exhibit More Advanced Application Filling Techniques Than Normal Applicants

Fraudsters are expert users.  Cybercriminals regularly use keyboard shortcuts and function keys that are rarely used by real users. Advanced computer skills are a sign of a fraudster at work.

#3 – Fraudsters Don’t Know The Data

Fraudsters exhibit low data familiarity.  When cybercriminals enter stolen personal information, they are far more likely to cut and paste data that would be intuitive for a legitimate user to enter manually.

#4 – Fraudsters Use Bots, Normal Applicants do not

Machine and bot activity: Behavior-based solutions can spot criminal behaviors in the application flow, even if the access is from a new device or IP. Automated attacks also demonstrate unique behavior patterns that can be used as a distinguishing mark.

UK Banks are implementing a new technique to stop some of the most basic money transfer fraud schemes.

Currently, if a consumer wants to transfer money, they are asked for the recipient’s account name, account number, and sort code. However, banks do not currently check if the account name is correct.  And this leads to lots of fraud.

Starting next year they will begin checking the name of the payee account to make sure it is accurate before funds are transferred.   Customers will be given 3 possible  outcomes before the funds are transferred

1. If they used the correct name, they will receive confirmation that it matches and the payment will be processed.
2. If they used a close match to the payee account, they will be provided with the actual name to validate. They can then update the details and try it again.
3. If the name is no match they will receive a message that the name does not match the name on the payee account.

Scammers Took Advantage

In the last few years, scammers have taken advantage of this loophole in the system and tricked consumers into sending payments to accounts that did not belong to the people that they think it did.

The Guardian had featured a few of these cases and consumers had lost up to 130,000 GBP in this schemes.

You can read some examples here – Email scam costs couple £25,000 – but no one will help

Many UK banking consumers are wondering why this drop-dead simple check could not have been done years ago.

Open Banking is a trend that is changing the fraud detection landscape. When people refer to this term it refers to the use of Open APIs that enable third-party developers to build applications and services around the financial institution.

The concept of this type of thing was really popularized by Steve Jobs and Apple Computer.  When he created the iPhone he also created an Open API infrastructure so that any developer could build on the platform.  This spawned millions of apps that were programmed by non Apple employees.

With Open Banking API’s the same type of thing is happening.  And fast growing companies like Yodlee and others, are building application interfaces that provide an array of services and options that link directly into borrowers bank accounts.

How Does These API’s Help Lenders Avoid Fraud?

Today, when lenders are underwriting and approving loans, they will often require the consumer to fax, mail or email them copies of pay-stubs, bank statements, utility bills and a variety of other documents to verify they are telling the truth.  But faxing is really dumb.  Most people don’t have faxes anymore, and besides faxed copies of anything look like garbage.

In this new and modern age however, lenders can leverage something far better  in the fight against fraud – the consumers iPhone.   Open Banking provides lenders the ability to have borrowers opt-into providing temporary and limited access to their banking account and transactions so they can pull the necessary verification information instantly.

This has set in motion a revolution in lending where all verifications will eventually be done without the need for ancient technology like faxing and snail mail.

Leveraging This Method Of Verification Requires Borrower Consent

Open API services first require the borrower to consent to allowing the lender to access their account temporarily.  If you ever signed up for Venmo, you’ve probably seen the screen where they ask you to provide your online banking credentials.  This is how they all work.

If you want to see how this concept works in action for bank statement verification check out DecisionLogic and how their application works here – DecisionLogic.

It’s pretty cool, So how are early adopter lenders using Open Banking to stop fraud?

Here are 4 ways that I have seen work remarkably in action.

#1 – Verify Identity By Matching To The Borrowers Bank Account

Bank account and identity verification is one of the primary ways this approach is helping lenders.

In the online application process, lenders can verify 2 pieces of identity information with the borrower:

• Bank Account Ownership -That they have a bank account.
• Bank Account Identity – That the bank account matches their name and information supplied on the application for the loan.
• Bank Account Aged – That the bank account has a history

Keep in mind, verifying this information can be done in seconds and not days and is far simpler for the customer.

#2 – Spot Income Fraud By Verifying against Borrowers Direct Deposits

1 out of 5 borrowers misrepresent their stated incomes on applications.  That is why stated income has earned the term “Liar Loans”. With so much income fraud lenders often want to verify a borrowers income and not take their word for it.

By verifying directly with the borrower’s bank account, lenders can verify if the borrowers stated income closely matches their direct deposits that are made bi weekly.

In the example below, Frank McKenna’s stated income of $4,000 a month, just doesn’t seem to add up to what his bank statements are showing.

#3 – Identify Employment Fraud By Verifying the Employer Name Against Bank Deposits

Employment fraud can run as high as 20% or more of a lenders issue with borrower misrepresentation.  Borrowers that lie about their income, often lie about their employer as well to avoid detection.

With automated bank statements enabled through an Open Banking pull, the lender can verify that the employer in the direct deposit matches or is similar to the stated employer provided on the application.

#4 – Verify Assets and Affordability By Looking At Borrowers Savings or Wealth Deposits

Asset misrepresentation is a one of the largest fraud issues that mortgage lenders face on a daily basis.

With Open API companies like FormFree however, that can be a thing of the past.  FormFree goes beyond what Yodlee offers to verify borrowers stated assets directly with all of their accounts.  They established a relationship with FannieMae to give lenders relief from Reps and Warrants if you use their service to automatically access directly to the borrowers bank accounts to validate assets.

Reducing asset fraud is another great way to leverage open banking to reduce fraud.

Thanks for reading. I enjoy exploring new areas of fraud verifications such as these technologies offer.

Fraud Managers must manage many risk on a day to day basis. It can be a bit mind boggling when you think about it.

Check out all of the different risk that fraud managers are faced with every day.

As part of managing that risk they are constantly evaluating new tools and technology to help them.  It can be even more mind boggling when you consider there can be as many as 20 different vendors and solutions out there to help you solve each fraud type and problem.

About-Fraud.com

Well there is a new company that was created to help fraud managers and banks make sense of new tools and technologies for just about every type of fraud.  They act as an information hub that offers a simple way to help banks short list vendors and tools that are most appropriate for the issue they face.

This week  About-Fraud.com  launched a new service that made that process even easier.   A new simple search tool makes fraud manager jobs easier.     Banks can search by industry, fraud type, functionality or technology type to locate the best solution for them.

This is a great tool if you’re researching solutions, thinking about investing in fraud technology vendors or doing an RFP.

Put this one on your bookmarks!

The Secret Service estimates that over $1 Billion Dollars is stolen from US consumers each year due to card skimmers.

The University of Florida has developed a skimming detection device that can instantly identify if a card reader has been compromised by a skimmer in the hopes of reducing losses to consumers.

The device is called the “Skim Reaper” and it works by dipping an elongated card wired to a box into a card reader.  Once the card is dipped and removed it can instantly identify if it has been read twice – once by the pump and once by a skimmer.

The little device can help identify pumps that are compromised so the skimming devices can be removed by law enforcement or by the gas stations or atm owners themselves.

It Looks For Multiple Read Heads When the Device is Swiped

At any given time only one read head should be present in a card slot. What the Skim Reaper does is that it finds when more than one read head is present in the card slot.

When more than one read head is detected, a warning is displayed on the front of the box, informing the officer that the device appears to be compromised.

5 Devices Being Tested By NYPD

The NYPD is currently testing 5 of the devices which were donated by the University of Florida.  The police department has four dedicated detectives who are trained to hunt for skimmers in credit card readers.

They decided to test the devices after a rash of skimming cases hit the city in January of this year.

The problem is that it’s transient, they come in and place the device and move on. In early January we were getting killed,” Deputy Inspector Christopher Flanagan of the NYPD Financial Crimes Task Force said, referring to a January spike in skimming-related crimes.

They caught their first skimmer with the device at an ATM in Brooklyn.   The detectives believe the technology works and will be instrumental in helping them crack down on skimmers which have been plaguing ATM machines by the hundreds across the city.

$50 a Device Is Expensive But Worth It

The devices are manufactured by professor, Patrick Traynor and he estimates that they cost about $50 to build.

He is working on developing a cheaper version which can be produced and used more commonly by police departments and law enforcement.

Digital Identity is red hot. And large companies are rushing to acquire technology companies that can bolster their defenses.

In December 2016, American Express purchased InAuth, a mobile device authentication company, to provide the automated service on the Accertify platform.

And just this week, Relx, the British publishing group turned analytics company bought ThreatMetrix for a whopping $871 million.  Relx has steadily been beefing up their risk and analytics capabilities and plans to integrate the technology with LexisNexis who provides authentication with public records to many lenders, banks and companies across the world.

ThreatMetrix boasts a pretty incredible client base – 1.4 billion unique online identities from 4.5 billion devices in 185 countries. It analyses over 100 million transactions per day across 35,000 websites from 5,000 customers.   Nice score for Relx.

ThreatMetrix strategy to move from a “Device Authentication” conpany to a “Digital Identity” seems to have paid off big time.

Digital Identities Rapidly Gaining Traction

The trend of digital identities was something Maryann Miller and I predicted earlier this year as a major trend in 2018 so the acquisition of ThreatMetrix is not a surprise.

Social Security Numbers suck. The growth of Digital Identities is one of the most significant technology trends in the world today and promises to end our reliance on it.   Whether it is digital driver’s licenses, digital credentials on mobile devices, or digital cloud passports this is the trend in fraud prevention to keep your eye on.

The UN and World Bank have launched an initiative to provide everyone on the planet a legal ID by 2030.   In the UK, the government launched a digital identity program in 2016 and Australia launched it’s own digital identity program in 2017.

In 2018, digital identities will gain more adoption.  With the recent data breaches the government and companies are looking for better ways to identify consumers.  And anything has to be better than a dumb social security number, right?

More Acquisitions on the Horizon?

Two companies that have to be loving life right now are Iovation and Payfone.  Both of these companies are rapidly growing and would be interesting acquisitions for bureaus and other fraud and risk platform providers.

Payfone authenticates 50 million transactions a day for Fortune 100 companies – they have to be attractive.

Iovation, on the other hand, ranked number 1 in device intelligence above ThreatMetrix, InAuth, and many others.   I am sure other companies would be eager to get their hands on the technology and rapidly growing client base.

Gemalto announced a new product that should take a bite out of fraud – a new contactless fingerprint card.

While fingerprint cards were launched last year, this is the first biometric-powered credit card with a contactless technology.    The card will help stop fraud by ensuring that the only person that can use the card is the actual cardholder.

Gemalto is currently piloting the card at Bank of Cyprus in Greece.

Customers can get the cards by visiting their local branch and registering their fingerprints with the bank. The fingerprint is captured and registered with the card when it is given to the customer.  When a customer places their fingerprint on the credit card sensor to buy something, the fingerprint is matched to the legitimate fingerprint that they stored.

The trend for biometrics in credit card technology appears to be the next big wave in fraud reduction for card issuers and merchants.

It was only a matter of time before someone figured out how to enlist the help of robots in the fight against fraud. And a New Zealand security company, Netsafe, has done just that.  They developed a massively creative artificial intelligence program to turn the tables on scammers that send phishing emails.  The results are hilarious and will give you a tremendous sense of satisfaction.

The app is one of a growing list of techniques called “Scam Baiting” where people will pretend to have fallen for the scammers email in the hopes of seeing how far down a rabbit hole they can take the fraudster.  The goal being to ultimately waste a bunch of the scammers time.

It’s Called Re:Scam and It’s Easy to Use

Their program called Re:scam, will help you engage a scammer in a never-ending, entertaining and hilarious conversation with them with the sole intent of wasting as much of their time as possible. This app aims to stop scammers by seriously damaging their productivity.  The more that they engage in senseless conversations with email bots, the less time they have to scam real people.

The application uses artificial intelligence and an ever expanding list of vocabulary so as to keep the conversations fresh with scammers.

To use the app just forward the email you receive to [email protected] and they’ll take it from there. They’ll even send you a transcript of the conversations

The Results are Hilarious and Satisfying

It’s nice to enlist the help of Robots in fighting fraud and this is a pretty ingenious solution.  You can read some hilarious results here and just how it works  – Check out This Conversation.

The App is Busy

The Application has been busy wasting fraudsters time.  So far they have sent 125,000 emails to scammers and wasted approximately 1 year, 2 months and 7 days.

Thats a lot of time and a lot of dough the scammers are missing out on!

At our company, we are always exploring new technologies to help lenders stop fraud.  We’re partnering with companies to bring new technology to help Auto Lenders solve a difficult problem.

Income Fraud is difficult to identify. It’s even harder to prevent as tools like 4506T prove costly and take far too much time for auto lenders to use. What do you think?  Do you think something like this could work for you to stop income fraud and verify borrowers employment?

https://vimeo.com/223688703