TransUnion Fraudcast Episode 3: Synthetic Fraud — The Ticking Timebomb in Credit Portfolios

Jason Lord:

Welcome to the TransUnion Fraudcast, your essential go-to for all the absolute linkages between the day’s emerging fraud and authentication topics, trends, tropes, and travails delivered with all the straight talk and none of the false positives.

I’m your host, Jason Lord, VP of Global Fraud Solutions. When I was asked by TransUnion to host this podcast I thought, well, I don’t really listen to podcasts and I have a lifelong stutter that I’ve barely managed to keep under control.

So sure, why not? It should be interesting.

Each episode of the Fraudcast we narrow in on a specific subtopic within the fraud and authentication universe, bringing on a special guest to help us dive in while keeping it high level enough that you don’t need a PhD in data analysis to understand the topic.

This week we’ll be talking about synthetic fraud, a form of fraud that has been around for a long time but is only growing in scope and potential impact.

For those who don’t know, synthetic fraud is at record levels. It’s now at $3 billion in total exposure in the US.

Auto lenders in particular have experienced a 38% rise year-over-year in synthetic fraud exposure, according to the recent TransUnion 2023 State of Omnichannel Fraud report.

That’s the second consecutive year of increased exposure in the industry, though by no means is Auto the only sector to see increased exposure rates.

We’re also seeing financial card and banking year-over-year increases –– and once synthetic identities get through the front door, they’re almost impossible to root out.

The fraudster will patiently grow the credit line for eight or nine or 10 years until they bust out, maxing out all of their credit and disappearing.

But because there’s no actual person on the other end of the identity there’s nobody to go after, making this a particularly difficult form of fraud to address. Are things are bound to get worse before they get better?

Here to discuss a topic with me is an expert in financial fraud, Emily Sherman. In addition to developing financial fraud products, she has worked directly with consumer lending organizations to advise them on their fraud and identity strategies.

Emily, welcome to the Fraudcast.

Emily Sherman:
Thank you, Jason.

Jason Lord:
So Emily, can you give our listeners a quick overview of how synthetic fraud happens in the first place?

How does a fraudster create a synthetic identity?

Emily Sherman:
Yeah, absolutely. So at the highest level of synthetic identity is a type of fraud where criminals are usually combining fake and real information to put together an identity that looks very legitimate to a financial institution.

They might assemble that credit identity from different parts, maybe a Social Security number from a child or deceased grandparent, which they’ll fuse then with the name and date of birth from somebody that they find on the dark web or in a prison population.

That’s a really traditional term, or definition, of a synthetic fraudster, but it’s really evolved today with the extreme increase in the amount of identity information available, through the likes of major identity breaches across healthcare and education…to sometimes be simpler than that.

Really looking at somebody’s identity with just a couple of elements changed to a nearby relative.

So a lot of times, synthetics are becoming harder and harder to detect.

Jason Lord:
It’s it sounds almost like a Frankenstein of a person, right?

You’re taking different pieces of the person, combining them into somebody new, and then when the fraudster has this synthetic identity…how? What is the life cycle of that synthetic identity?

Emily Sherman:
I like to think of, you know, traditionally when you think of identity theft, somebody who’s finding this account and opening an account or getting access to an account is kind of where the goldmine sits with the synthetic.

The identity itself is the goldmine.

Because what they do is they find an identity that works –– and by works, I mean they can go in, apply for a credit card maybe at a retail store, or apply for a bank account where there is a lower barrier to entry than a credit account, and they start to build out a series of financial relationships that look very legitimate.

And in doing so, every subsequent financial institution has a little bit more confidence that this person is both real and going to be a great customer for them.

And so a fraudster will end up building up potentially five, 10 different types of credit trade lines, whether that’s credit cards, retail cards, consumer loans and even, in many cases as you mentioned, auto loans.

And so they can amass access to 100 or more, thousands, of dollars of access to credit, and in a relatively short period of time.

And that was what I think of as in business terms, right, ‘cause fraudsters today, sophisticated fraudsters are businesses, it’s a land-and-expand strategy at the end of the day.

Jason Lord:
I like that, “land-and-expand.”

So we’ve been hearing about synthetic fraud for a very long time now…but why? Why is it seeing such attention right now?

What’s driving the increase of that exposure?

Emily Sherman:
Yeah, it’s a great question.

You know, I think there’s a lot of different components that are either driving or failing to limit the growth of synthetic.

So on the financial services side, first of all, we are in one of the most competitive financial services landscapes that we have ever seen before.

I think I saw a metric that in 2020, $44 billion of venture funding had been injected into the financial services space which ended up, I should say driving, you know, an entire new sector of lending, right?

The buy now-pay later point-of-sale type of loans have made it incredibly competitive for traditional banks to keep good consumers and find good consumers.

And so we’ve seen things like rapid and automatic increases in credit limits for financial services companies trying to stay top-of-wallet, quick and easy application processes that try to really accelerate the onboarding in acquisition process of getting a consumer into their customer base.

So that increase in the competitive landscape oftentimes encourages financial services companies to lower their barriers for fraud. And that of course becomes a channel for these synthetic fraudsters to flourish.

But in addition to that, there have also been new lanes that have opened that push frauds, away from things like identity theft and towards synthetics.

First of all, identity theft tools have become much stronger over the last five years.

So when you educate consumers, and consumers are aware of ways to keep fraud out of their own accounts, like adding multistep verification to the process, fraudsters have a harder time getting access to those consumers.

And so they’re pushed in the direction of something else that they can go steal.

And so synthetic becomes really attractive.

Jason Lord:
You use the term land-and-expand before –– fraudsters are sort of like salespeople.

They will find the quickest dollar, the easiest way they can, and it sounds like synthetic fraud might be that place now.

Emily Sherman:
Yeah, exactly.

You know, they follow the easy money, and this is another aspect that I think is driving the increase in synthetics in today’s world, fraudsters who used to have to be extremely sophisticated in order to set up a synthetic identity.

It’s now much closer at their fingertips with the onset of AI that can help with, you know, identities that are going to work really well, as well as AI that can help build bots and scripts that can allow fraudsters to accelerate their attacks and make them much broader.

So all of these things becoming much more available to the average fraudster, again, encourage this direction. That’s really impacting the synthetic fraud landscape.

Jason Lord:
And when I think about Auto in particular, it used to be that if you wanted to buy a car, you had to go to a dealership. Now, in the last five years you can get auto financing online.

You can buy a car online.

I imagine a fraudster doesn’t have to leave their basement in order to do everything they need to do in the auto world.

Emily Sherman:
Yeah, you know, that’s absolutely the case.

Although I will say…so you know digital transformation as a whole, 100% is making it easier for synthetic fraudsters to flourish and again, combined with not only everybody being able to transact completely online, but also all of the identity and fraud checks existing online, I think enable this synthetic fraud process to be a little bit easier to execute.

However, we have seen many examples of synthetic fraudsters just as happy to walk into a dealership in person with a fake ID because you have the same human error that you might have had, or that that you eliminate in the online space, like checking someone’s driver’s license, a human doing that is less effective at picking out fraudulent identity documents than some of the document verification tools that exist out there.

Jason Lord:
That’s a great point.

Emily Sherman:
So it exists on both fronts, and I think my biggest warning is not to assume that’s one of the reasons we’ve seen.

We believe that there’s been such a rise in the auto space, it’s kind of the next weak link that hadn’t been previously attacked as aggressively.

They’re seeing this lane opening up.

There’s ways to move those cars after they’ve been taken, and now the auto industry is just becoming a target of this type of fraud.

Jason Lord:
So you talked to a lot of banks and presumably auto lenders as well…do the institutions understand this problem? Are they openminded to changing their ways –– or what are those discussions like?

Emily Sherman:

You know, it’s really, admittedly, a difficult problem, and I empathize with the organizations that are trying to solve for this…identifying the losses related to fraud.

When you specifically are thinking about credit abuse, right?

This idea that fraudsters are coming in and have no intention to repay intention is a really difficult thing to tease out for banks.

And so at the end of the day, it’s really difficult to categorize.

So what we often hear from customers is that they are saying that they’re not losing a lot from synthetic fraud and therefore they cannot apply a lot of budget to solving the problem.

And you know, I think the problem is simply much more complex than that.

It’s really difficult to identify if you don’t have the systems in place to look for synthetic fraud, you’re probably not going to find it, and you are experiencing the losses. You’re simply not categorizing them as fraud losses.

Jason Lord:
They might be categorized under account opening losses, or credit losses, when the intention was never to pay in the first place. Is that right?

Emily Sherman:
Exactly. And these fraudsters have also become quite sophisticated in the way that they are going to manage those.

You know, I think of it almost as a Ponzi scheme, right?

If you have access to 15 or 20 credit cards, which isn’t abnormal for even an average consumer, it’s very easy to make it look like you were a very good paying customer. You’re paying your minimum balance every month.

Jason Lord:
They’re making money. They’re making money in the short term, yeah.

Emily Sherman:
Meanwhile, your overall credit is utilization of your credit it’s expanding and increasing and any individual bank says this looks like a great consumer –– but at the end of the day, it could be years and years later.

They’re making money in the short term and years and years later, you know, they’ll walk away with a charge off…it’s easy to chalk that up as simply a credit loss.

Somebody fell on hard times –– but in reality it was very intentional fraud.

Jason Lord:
And those bust-outs that occur, those are pretty substantial in nature, presumably because if the fraudster is that patient to grow the credit over time, they’re not going to do it for a $500 credit limit. More than likely this is probably going to be a big amount that they finally bust out with.

Emily Sherman:
Yeah, we have actually seen that the average bust-out is $23,000.

Jason Lord:
Wow.

Emily Sherman:
The average typical charge off for a prime consumer is 5700, and I think close to 8000 for Super Prime.

So that just gives you an idea.

This is, you know, when we’re talking averages, it takes out the outliers.

So you can imagine that some of the outliers that we have found in case studies where the bust-outs in aggregate across a number of different banks easily exceed $300,000, right?

These are significant losses, and typically if you step away from the idea of synthetic, which as we’ve established is really difficult to track and categorize, and you just look at bust-outs, bust-out fraud is less than half a percent of the population, but contributes to over 10% of overall losses.

So the multiple on the loss factor by not addressing the drivers of these different types of credit abuse like bust-out, it can be incredibly costly.

Jason Lord:
Those are striking numbers.

So presumably if categorizing synthetic fraud is hard, I’m going to guess detecting it is also equally hard, or it would have happened already.

So what makes detecting synthetic fraud so difficult?

Emily Sherman:
Yeah, I would definitely say detecting synthetic fraud is difficult, but it’s not impossible.

And what I mean by that is there’s no silver bullet.

There’s no single solution that’s going to let you take a look at an identity and say yep, we know 100% that that’s synthetic fraud.

But there are tools that allow banks and TransUnion alike to be able to identify who we believe are synthetics with relatively high confidence, and it’s using a combination of technology and data in order to understand and categorize these potential fraudsters appropriately without introducing unnecessary operational costs that can also look, you know, make the idea of fighting synthetic fraud one that’s difficult, you know, a difficult pill to swallow.

Jason Lord:
Let’s talk about at the front end, because what I’ve understood is that the best place to detect synthetic fraud is before the fraudster gets through the front door.

And so if we’re looking at identity verification and we’re looking at a potential synthetic, what are some characteristics that you might want to look for to indicate that somebody is not only not a person, but has no intention to pay in the first place?

Emily Sherman:

So we take two different approaches, and those two approaches are based out of two different sets of data that we, at TransUnion have to look at in order to predict these types of synthetics –– the first of which is credit data.

So the primary target of synthetic fraud, by the way, not the only target, but the primary target of synthetic fraud, is in the financial services, credit space.

And so what you see is how we’re looking for, I should say, how did that identity get created in the first place? Was it created on a soft inquiry? Did we see it created as an authorized user on a credit card?

Again, we kind of mentioned earlier, but this idea that they’re looking for the weak links to places where it’s easier, where there’s less verification of the user in order to get access to credit for the first time.

So we look for indicators like that in addition to the ways that that actual credit is built up over time and how that credit is used. Pretty easy for us in an analytic and modeling environment to pick out what is normal and abnormal behavior with respect to credit.

Jason Lord:
I would assume that an abnormal example would be if you have 50 different accounts on the same trade line in the same address, that might be a red flag, for instance.

Emily Sherman:
Yes, we can oftentimes look at the sort of number of trade lines, the acceleration of those trade lines over time.

If you see somebody’s credit profile created, it’s essentially the velocity, right?
They’ve only had access to credit for six months and they have ramped up the number of trade lines or the utilization of those trade lines very quickly.

Those can also be clear indicators that there’s something abnormal.

Jason Lord:
I also have sympathy to your point of any organization that’s looking to bring on new customers and perhaps they’re checking if the name is correct –– and the answer is yes.

They’re checking if the address is correct and the phone number is correct, and so all these things say yes, right?

But maybe they don’t look…maybe they don’t add up to an identity in combination.

Is that also part of the secret sauce to protecting against synthetic fraud –– is checking these identifiers in combination?

Emily Sherman:

So what you’re talking about is the other side I mentioned.

There were two different sort of approaches that we have to finding synthetic fraud, the first of which I talked about was the credit-based approach, the second of which is the identity approach.

So I will first note that when you…what you’re talking about is identity verification.

Jason Lord:
That’s right, yeah.

Emily Sherman:
Just looking at does Jason Lord have an identity that looks to us to be legitimate, “us” being the Credit Bureau, or “you” being the financial services institution.

And oftentimes synthetics will pass that because of the evolution that I talked about, right, once they have established an identity in another realm, their identity will be verified.

But what we can do when we look at identities is again look at that what is normal and what is abnormal.

And so from an identity perspective, the main thing that we are trying to seek out is the connection between identities.

So what a normal person looks like is they have existed within identity bases, like the Postal Service, for their entire life.

You have addresses that they’ve lived at over the course of their life, you can see people who share the same name as them, who have also lived at that address, and so you have a history of that person for you know 20, 30, 40…however old they are.

What we see in abnormal identity is when we look at these networking attributes, is somebody who’s just appeared for the first time.

And yet it says that they are 35 years old, somebody’s 35 years old, who doesn’t have any known relatives within the identity database and also lives at an address where 50 other people have lived within the last three months.

So there are indicators like that that really help provide red flags for finding these synthetic fraudsters.

Jason Lord:
I think that that that term red flag is important because we’re not saying that person couldn’t exist. We’re just saying maybe apply some friction before you let them through the process.

Emily Sherman:
Absolutely. And that really becomes part of this strategy to not only protecting yourself against synthetic fraud, but starting to understand who the synthetic fraudsters are and what solutions are effective against them.

So I’ll kind of note that you want to make sure that you’re categorizing synthetic fraud out of manual reviews, but that you’re also categorizing synthetic fraud out of credit losses and other areas and not to assume that those losses are just, you know, again, a bad credit risk investment, but rather some sort of intentional fraud.

Jason Lord:
I said at the beginning of this broadcast, I posited is it going to get worse before it gets better?

What are your thoughts on that?

You’re looking very thoughtful right now.

Emily Sherman:
My simple prediction, if you’re just asking my opinion, is it’s going to get worse before it gets better.

Yes, I think looking at those simple exposure numbers that you shared at the beginning where we are just seeing this rapid increase in overall synthetic presence is concerning.

So one of the things that I looked at as we tracked this problem through the pandemic…the pandemic actually showed the fraud and identity space…the lowest levels of fraud for financial services that we’ve ever seen.

I should say that we’ve never seen –– it dropped dramatically.

All of the trends that we had going up dropped off a cliff. The only single trend that did not drop off a cliff were balances associated to suspected synthetics.

And so what that tells me is just synthetics are here to stay, and when they have opportunities to find other types of fraud, they’re going to go take that.

But they don’t go away.

In the meantime, they still have access to all those cards. They still have those balances that they’re moving around in their little Ponzi scheme, and they still are going to gain access to more credit –– as we’ve seen with these exposure numbers.

And so it’s going to get worse, because if fraudsters are smart, and they are, they’re going to continue to evolve to evolve because they want to remain under the radar. They’re not going to make themselves apparent, you know, without being forced to.

So it becomes a really important thing for the industry to respond and evolve along with them. And that’s a really tough thing to push right now.

Everyone’s budgets are really under scrutiny today, and so that’s why I think it’s going to get

worse before it gets better, but we do have these tools being developed that can help us tackle this problem.

Jason Lord:
Well, final thoughts, Emily. You’ve painted a somewhat dire picture, but I think it’s called for.

It’s a wake-up call to all financial institutions.

If you were to give one piece of advice to any institution, thinking about the synthetic fraud problem, what piece of advice would you give them?

Emily Sherman:
The biggest piece of advice I would give is to make sure that your data is not siloed and your strategies are not siloed within your fraud team.

Now, oftentimes synthetic fraud is thought of as a credit problem anyway, so I hope this is already something most of your teams have started to address. But those companies that say are credit process happens 1st and then we do fraud checks before we issue credit our typically the ones that we see with the largest synthetic fraud problems that are actually impacting their bottom line. Like I said before, the solution for this is technology and data.

So it’s some combination of a fraud device check before you do your credit check.

Then you do the credit check along with the credit check… Make sure you’re looking for those indicators of synthetic fraud, and then as you come into your identity stage or if you –– better yet –– put the identity before your credit check, you know everyone’s going to have their own strategies and what works best for them and their cost structure.

But make sure that those teams are talking to each other, because if the teams and the data are not, that’s where the fraudsters are looking to flourish.

Jason Lord:
De-siloing data and better communication, I think, are evergreen pieces of advice that apply for just about any situation, including synthetic fraud.

Emily, thank you so much for joining. It’s always a pleasure talking with you.

Thank you all for tuning in and we hope you join us for upcoming episodes of the Fraudcast.

In the meantime, stay smart and stay safe.