Beware of hard-to-detect synthetic ID fraud

Especially in the past few years, compliance has been on the minds of dealers and lenders. But at least one fraud type has been largely overlooked, and it's costing hundreds of millions of dollars in losses annually across the credit industry, Experian says.

Synthetic identity fraud is "flooding" the identity-fraud space and it's directly affecting the auto industry, said Keir Breitenfeld, a senior business consultant at Experian in the areas of fraud and identity. Experian partnered with financial services analyst CEB TowerGroup on an an insight brief that explains synthetic identity fraud and the best ways to fight it.

Synthetic identity fraud occurs when a criminal combines real and fake information to create a new identity to open fraudulent loan accounts and make fraudulent purchases.

Most dealers tend to think of car sales more than fraud, Breitenfeld said. They're "much more concerned about getting the loan through and getting the customer into a vehicle."

Many dealers perform the basic identity verifications that are required, but those precautions are likely not enough to prevent synthetic ID fraud.

Synthetic identity fraud is first started by a data breach. The fraudsters use the information obtained from the data breach to create the synthetic identity.

"We are hearing a lot [of concern] from our clients in the auto lending space, a much higher level of concern in the last 12 to 24 months," Breitenfeld said. He didn't cite specific data on how widespread the problem is, because it often goes undetected.

Multiple types of identity fraud have risen since the rollout of credit cards that use chips to store data, Breitenfeld said. Before chips, criminals targeted traditional credit and debit cards. Now, though, with chips making those cards more secure, "fraud schemes have shifted toward identity," he said. There is still not enough awareness of synthetic ID fraud among lenders, which gives criminals a clear path to commit the fraud.

Synthetic identities can have a real Social Security number from one person and an address, date of birth and phone number from three others, in some cases. "Victims may have some pieces of identity information being used, but the collective grouping of this info is not necessarily going to apply to [one person]," Breitenfeld said.

Lenders often verify the applicant's individual data entries, but they aren't thoroughly cross-checked to see whether they match. That makes the origination look more like a traditional loan that a borrower didn't pay back or a credit risk with poor decisioning, Breitenfeld said. If the loan goes unpaid, the lender takes a loss; a loss from a synthetic ID may be categorized in the same way as typical losses, so "no one knows how big of a problem it is," he said.

Criminals often steal the Social Security numbers of children because they are not yet in use in the credit market. When the children become adults, their identities have already been compromised, so they may run into issues when establishing their real identity, especially digitally, Breitenfeld said.

Dealers and auto lenders can aim to get ahead of the problem by spreading awareness and understanding.

Basic identity checks that many in the industry use are failing to recognize synthetic identities, Breitenfeld said. Lenders should consider using identity risk analytics and risk models that are created to identify synthetic identity fraud. Scores designed to mitigate synthetic ID fraud will look at the entirety of the borrower's identity, Breitenfeld said. If the lender can immediately look at the entire borrower profile, there may be potential to prevent the fraud. "Much of the fraud occurring from these identities happens rather quickly, so there will never be a payment on the account. There is honestly not a lot than can be done once an account is opened," he said.

After the fraud is exposed, Breitenfeld suggests lenders assess their portfolios to figure out where synthetic fraud could be.

At the dealership, a face-to-face interaction gives the dealership employee more opportunity to verify the identity of the person, but "those checks still seem to be a little too obtuse" because criminals can create a fake document to support the false identity, he said.

Compared with other markets such as the credit card industry, Breitenfeld said, the automotive space is has been less proactive. Traditionally, auto lending has looked at an identity baseline but focused more on creditworthiness, he said.

"The main impact and the main point to keep in mind is that this type of fraud exists," Breitenfeld said, "which is not necessarily understood, particularly in auto."