Tag: fraud ring

Fraud rings cause an estimated $5 trillion in financial damages every year, making them one of the most dangerous threats facing today’s businesses. They’re organized, sophisticated and only growing more powerful with the advent of Generative AI (GenAI). Armed with advanced tools and an array of tried-and-true attack strategies, fraud rings have perfected the art of flying under the radar and circumventing traditional fraud detection tools. Their ability to adapt and innovate means they can identify and exploit vulnerabilities in businesses' fraud stacks; if you don’t know how fraud rings work and the right signs to look for, you may not be able to catch a fraud ring attack until it’s too late. What is a fraud ring? A fraud ring is an organized group of cybercriminals who collaborate to execute large-scale, coordinated attacks on one or more targets. These highly sophisticated groups leverage advanced techniques and technologies to breach fraud defenses and exploit vulnerabilities. In the past, they were primarily humans working scripts at scale; but with GenAI they’re increasingly mobilizing highly sophisticated bots as part of (or the entirety of) the attack. Fraud ring attacks are rarely isolated incidents. Typically, these groups will target the same victim multiple times, leveraging insights gained from previous attack attempts to refine and enhance their strategies. This iterative approach enables them to adapt to new controls and increase their impact with each subsequent attack. The impacts of fraud ring attacks far exceed those of an individual fraudster, incurring significant financial losses, interrupting operations and compromising sensitive data. Understanding the keys to spotting fraud rings is crucial for crafting effective defenses to stop them. Uncovering fraud rings There’s no single tell-tale sign of a fraud ring. These groups are too agile and adaptive to be defined by one trait. However, all fraud rings — whether it be an identity fraud ring, coordinated scam effort, or large-scale ATO fraud scheme — share common traits that produce warning signs of imminent attacks. First and foremost, fraud rings are focused on efficiency. They work quickly, aiming to cause as much damage as possible. If the fraud ring’s goal is to open fraudulent accounts, you won’t see a fraud ring member taking their time to input stolen data on an application; instead, they’ll likely copy and paste data from a spreadsheet or rely on fraud bots to execute the task. Typically, the larger the fraud ring attack, the more complex it is. The biggest fraud rings leverage a variety of tools and strategies to keep fraud teams on their heels and bypass traditional fraud defenses. Fraud rings often test strategies before launching a full-scale attack. This can look like a small “probe” preceding a larger attack, or a mass drop-off after fraudsters have gathered the information they needed from their testing phase. Fraud ring detection with behavioral analytics Behavioral analytics in fraud detection uncovers third-party fraud, from large-scale fraud ring operations and sophisticated bot attacks to individualized scams. By analyzing user behavior, organizations can effectively detect and mitigate these threats. With behavioral analytics, businesses have a new layer of fraud ring detection that doesn’t exist elsewhere in their fraud stack. At a crowd level, behavioral analytics reveals spikes in risky behavior, including fraud ring testing probes, that may indicate a forthcoming fraud ring attack, but would typically be hidden by sheer volume or disregarded as normal traffic. Behavioral analytics also identifies the high-efficiency techniques that fraud rings use, including copy/paste or “chunking” behaviors, or the use of advanced fraud bots designed to mimic human behavior. Learn more about our behavioral analytics solutions and their fraud ring detection capabilities. Learn more

In a series of articles, we talk about different types of fraud and how to best solve for them. This article will explore first-party fraud and how it's similar to biting into a cookie you think is chocolate chip, only to find that it’s filled with raisins. The raisins in the cookie were hiding in plain sight, indistinguishable from chocolate chips without a closer look, much like first-party fraudsters. What is first-party fraud? First-party fraud refers to instances when an individual purposely misrepresents their identity in exchange for goods or services. In the financial services industry, it's often miscategorized as credit loss and written off as bad debt, which causes problems when organizations later try to determine how much they’ve lost to fraud versus credit risk. Common types of first-party fraud include: Chargeback fraud: Also known as "friendly fraud," chargeback fraud occurs when an individual knowingly makes a purchase with their credit card and then requests a chargeback from the issuer, claiming they didn't authorize the purchase. Application fraud: This takes place when an individual uses stolen or manipulated information to apply for a loan, credit card or job. In 2023, the employment sector accounted for 45% of all false document submissions — 70% of those who falsified their resumes still got hired. Fronting: Done to get cheaper rates, this form of insurance fraud happens when a young or inexperienced individual is deliberately listed as a named driver, when they're actually the main driver of the vehicle. Goods lost in transit fraud (GLIT): This occurs when an individual claims the goods they purchased online did not arrive. To put it simply, the individual is getting a refund for something they actually already received. A first-party fraudster can also recruit “money mules” — individuals who are persuaded to use their own information to obtain credit or merchandise on behalf of a larger fraud ring. This type of fraud has become especially prevalent as more consumers are active online. Money mules constitute up to 0.3% of accounts at U.S. financial institutions, or an estimated $3 billion in fraudulent transfers. How does it impact my organization? Firstly, there are often substantial losses associated with first-party fraud. An imperfect first-party fraud solution can also strain relationships with good customers and hinder growth. When lenders have to interpret actions and behavior to assess customers, there’s a lot of room for error and losses. Those same losses hinder growth when, as mentioned before, businesses anticipate credit losses that aren’t actually credit losses. This type of fraud isn’t a single-time event, and it doesn’t occur at just one point in the customer lifecycle. It occurs when good customers develop fraudulent intent, when new applicants who have positive history with other lenders have recently changed circumstances or when seemingly good applicants have manipulated their identities to mask previous defaults. Finally, first-party fraud impacts how your organization categorizes and manages risk – and that’s something that touches every department. Solving the first-party fraud problem First-party fraud detection requires a change in how we think about the fraud problem. It starts with the ability to separate first- and third-party fraud to treat them differently. Because first-party fraud doesn’t have a victim, you can’t work with the person whose information was stolen to confirm the fraud. Instead, you’ll have to implement a consistent monitoring system and make a determination internally when fraud is suspected. As we’ve already discussed, the fraud problem is complex. However with a partner like Experian, you can leverage the fraud risk management strategies required to perform a closer examination and the ability to differentiate between the types of fraud so you can determine the best course of action moving forward. Additionally, our robust fraud management solutions can be used for synthetic identity fraud and account takeover fraud prevention, which can help you minimize customer friction to improve and deepen your relationships while preventing fraud. Contact us if you’d like to learn more about how Experian is using our identity expertise, data and analytics to improve identity resolution and detect and prevent all types of fraud. Contact us

Recently, I wrote about how Experian is assisting NASWA (National Association of State Workforce Agencies) with identity verification to help mitigate the spike in fraudulent unemployment insurance claims. Because of this I was not all that surprised when I found a letter in my mailbox from the Texas Workforce Commission with a fraudulent claim using my identity, inspiring me to follow up on this topic with a focus on fraud prevention best practices. Identity theft is on the rise According to Experian data analysis and a recent study on unemployment insurance fraud, at least 25% of new claims are a result of identity theft. This is 50 times higher than what we have traditionally seen in the highest ID theft fraud use case, new credit card applications, which generally amounts to less than 0.5% of new applications. Increasing digitization of the last few years—culminating in the huge leap forward in 2020—has resulted in a massive amount of information available online. Of that information, a reported 1.03 billion records were exposed between 2016 and 2020. There are currently approximately 330 million Americans, so on average more than three records per person have been exposed, creating an environment ripe for identity theft. In fact, a complete identity consisting of name, address, date of birth, and Social Security number (SSN) can be purchased for as little as $8. This stolen data is then often leveraged by both criminal rings who are able to perpetrate fraud on a large scale and smaller scale opportunists – like the ones in Riverside, CA leveraging access to identities of prison inmates. Fraud prevention through layered identity controls In the 20 years that I have been combatting ID theft both in the private and public sectors, I’ve learned that the most effective identity proofing goes beyond traditional identity resolution, validation, and verification. To be successful, you must take advantage of all available data and incorporate it into a layered and risk-based approach that utilizes device details, user behavior, biometrics, and more. Below, I outline three key layers to design an effective process for ID proofing new unemployment insurance claims. Layer 1: Resolve and Validate Identities Traditional identity data consists of the same basic information—name, address, date of birth, telephone number, and SSN—which is now readily available to fraudsters. These have been the foundation for ID proofing in the past and are still critical to resolving the identity in question. The key is to also include additional identity elements like email address and phone number to gain a more holistic view of the applicant. Layer 2: Assess Fraud Risk Determining an identity belongs to a real-life subject is not sufficient to mitigate the risk of ID theft associated with a new unemployment insurance claim. You must go beyond identity validation to assess the risk associated with their claim. Risk assessment risk falls into two categories – identity and digital risk. Identity Risk When assessing a claim, it’s important to check the identity for: Velocity: How often have you (or other states) seen the information being presented with this application? Has the information been associated with multiple identities? Recency of change: How long has the identity been associated with the contact information (phone, email, address, etc.)? Red flags: Has the subject been a recent victim of ID theft, or are they reported as deceased? Synthetic Identity: Are there signs that the identity itself is fictitious or manipulated and does not belong to a real-life person? Digital Risk Similar to the identity risk layer above, the device itself and how the subject interacts with the device are significantly important in identifying the likelihood a new claim is fraudulent. Device risk can be assessed by utilizing geolocation and checking for inconsistent settings or high-risk browsers, while behavioral risk might check for mouse movement, typing speed, or screen pressure. Layer 3: Verify Highest Risk Subjects The final stage in this process is to require additional verification for the highest risk claims, which helps to balance the experience of your valid subjects while minimizing the impact of fraud. Additional steps might include: Document verification: Scanning a government-issued ID (driver’s license, passport, or similar), which includes assessing for document security features and biometric comparison to the applicant. One-time passcode (OTP): It is key to deploy this sparingly only to phone numbers that have been associated with the subject for a significant time frame and incorporate checks to determine if it is at high risk (e.g., recently ported or forwarded). Knowledge-based verification (KBV): Leveraging non-public information from a variety of sources. By adding additional, context-based identity elements, it becomes possible to improve the three main objectives of most agencies’ identity proofing process – get good constituents through the first time, protect the agency and citizens from fraud, and deliver a smooth and secure customer experience in online channels. While there’s no quick fix to prevent unemployment insurance fraud, a layered identity strategy can help prevent it. Finding a partner that has a single, holistic solution empowers agencies to defend against unemployment insurance fraud while minimizing friction for the end-user, and preparing for future fraud schemes. To learn more about how you can protect your constituents and your agency from unemployment insurance fraud request a call today. Contact us

The CU Times recently reported on a nationwide synthetic identity fraud ring impacting several major credit unions and banks. Investigators for the Federal and New York governments charged 13 people and three businesses in connection to the nationwide scheme. The members of the crime ring were able to fraudulently obtain more than $1 million in loans and credit cards from 10 credit unions and nine banks. Synthetic Identity Fraud Can’t Be Ignored Fraud was on an upward trend before the pandemic and does not show signs of slowing. Opportunistic criminals have taken advantage of the shift to digital interactions, loosening of some controls in online transactions, and the desire of financial institutions to maintain their portfolios – seeking new ways to perpetrate fraud. At the onset of the COVID-19 pandemic, many financial institutions shifted their attention from existing plans for the year. In some cases they deprioritized plans to review and revise their fraud prevention strategy. Over the last several months, the focus swung to moving processes online, maintaining portfolios, easing customer friction, and dealing with IT resource constraints. While these shifts made sense due to rapidly changing conditions, they may have created a more enticing environment for fraudsters. This recent synthetic identity fraud ring was in place long before COVID-19. That said, it still highlights the need to have a prevention and detection plan in place. Financial institutions want to maintain their portfolios and their customer or member experience. However, they can’t afford to table fraud plans in the meantime. “72% of FI executives surveyed believe synthetic identity fraud to be more challenging than identity theft. This is due to the fact that it is harder to detect—either crime rings nurture accounts for months or years before busting out with six-figure losses, or they are misconstrued as credit losses, and valuable agent time is spent trying to collect from someone who doesn’t exist,” says Julie Conroy, Research Director at Aite Group. Prevention and Detection Putting the fraud strategy discussion on hold—even in the short term—could open up a financial institution to potential risk at time when cost control and portfolio maintenance are watch words. Canny fraudsters are on the lookout for financial institutions with fewer protections. Waiting to implement or update a fraud strategy could open a business up to increased fraud losses. Now is the time to review your synthetic identity fraud prevention and detection strategies, and Experian can help. Our innovative new tool in the fight against synthetic identity fraud helps financial institutions stop fraudsters at the door. Learn more  

Every few months we hear in the news about a fraud ring that has been busted here in the U.S. or in another part of the world. In May, I read about a fraud ring based in Georgia and Louisiana that bought 13,000 stolen identities of children who were on the Louisiana Medicaid program and billed the government for services not rendered. This group defrauded the Medicaid program of more than $500,000.   This is just one of many stories that we hear about fraud rings, and given the rapidly changing economic environment, now is the time for businesses to think about how to protect against fraud rings. There are a number of challenges that organizations may have when it comes to sharing trends and collaborations, understanding the ways to tie fraud rings together, creating treatments for identifying fraud rings and ways to store and catalogue fraud ring experiences so they can be easily recognized.   The trouble with identifying fraud rings   It’s important to understand the challenges that organizations have because they see the fraud rings through their own internal lens. Here are a few of the top things businesses should work on:   Think like a fraudster. This will help businesses become more creative in their approach to fraud prevention. Facilitate internal collaboration. Share with in-organization partners. Sometimes this can be difficult due to organizational structure. Promote external collaboration. Intel-sharing groups are a great way for businesses to network within their industries and learn about the fraud that others are seeing. An organization that I’ve worked with in the past is the National Cyber Forensic and Training Alliance (NCFTA).   Putting the pieces together   How do businesses identify a fraud ring? There are three steps to get started. The first is reviewing and understanding the data. Fraudsters are lazy and want to replicate the process over and over again, and because of this there is always some piece of information that is repeated. It could be a name, an email address, device fingerprint, or similar.   The second step is tying the fraud ring together. This is done by creating rules to help identify the trends. Having rules in place to identify fraud rings allows businesses to easily pull stats together for their leadership.   Lastly, applying an acronym or name to the particular fraud ring and adding comments to the cases associated with a particular ring will help with post-investigation analysis.   Learning from the past   Before I became a consultant, I remember identifying a fraud ring that was submitting events with the same language pack and where the device fingerprint was staying consistent. Those events were being referred out for review and marked with the same note. At a post-mortem review, I was able to talk to the fraud ring we had seen, and it was easy to pull all events associated with this fraud ring because my team had marked the events with the same comments.   Another fraud ring example happened a few years ago. A client called me and said that they were under a fraud attack and this fraud ring was rotating the email handle. I reviewed the data and came up with a rule to catch this activity. Fraud rings will use email handle rotation to help them keep track of accounts that are opened or what emails they used in the past. By coupling the email handle rotation with an email verification service like Emailage, this insight could be very telling. I would assume that when fraud rings use email handle rotation these emails are new and have just been created.   These are just a few of the many fraud rings that I’ve encountered over the course of my career and I’m sure there will be a lot more in the years to come. The best advice I can give to anyone that reads this post is to understand the data that you are reviewing, look for anomalies within the data, ask questions and test your theories by running queries on the data that you’re reviewing. I would love to hear about the different fraud rings that you’ve encountered over your career.   Stay safe.   Contact us