We are seeing a dynamic wave of synthetic identity creation at unseen scale and depth of sophistication, fueled by advancement in the power and availability of AI tools. While using automation techniques to commit and combat identity fraud is nothing new, what changes the state of play today and how can banks respond effectively?
Banks have invested in tools and resources to tackle fraud, but these efforts have only partially stemmed the tide. Fraud losses continue to rise and with them synthetic identity fraud has emerged as a leading contributor, surpassing credit card and identity theft. According to a recent TransUnion report, synthetic identity fraud was the fastest growing form of fraud perpetrated in 2023.
Synthetic identity fraud includes combining real personal information with fictitious data, sufficient to slip past systematic controls and alerts. Here, we are seeing growing momentum away from schemes like card fraud, account takeover, and application fraud using fake identities and documentation. More sophisticated forms of fraud like authorized push payments are ballooning – with payment initiated by legitimate customers, simplifying the job of circumventing controls and making fraud harder to detect and prevent.
Four changes are at play here that open new doors to threat actors:
Synthetic identity quality meets quantity. Generative AI tools ramp up the quantity and quality of synthetic identities – for example, using generative AI to fill in gaps by creating plausible supporting identity content, employment documentation, social media content, and voices at mass scale.
Building and deploying synthetic IDs now takes minutes. AI tools deliver extreme speed. Viable synthetic identities may have taken several days or weeks to build in the past but can now be built in minutes and deployed almost immediately.
‘Off the shelf’ easy-to-use tools are widening the bad actor pool. Advanced tools, once hidden on the Dark Web, are now accessible through social channels – whether generative AI tools focused on creating synthetic identities, or code for malicious attacks. This is ‘de-skilling’ synthetic identity fraud, making it a transactional process that many more bad actors can leverage.
Orchestration and coordination are on the rise globally. Large, organized gangs of bad actors are harnessing these tools, increasingly at an international scale across borders, to create and manage hundreds if not thousands of identities.
So, how do industry leaders manage dynamic hidden threats? The good news is that you likely have all the pieces needed for systems to answer questions like “is the person’s application I’m dealing with really the person I think they are?” or “is this a legitimate transaction request from this long-standing customer?”
Boxes of data held around customers, devices, behaviors, and transactions can be combined to build a picture that draws on customer, account, counterparty and transaction data as well as data around things like alert histories, watch lists and negative news screening. These are the raw ingredients for more effective fraud risk management, feeding analytical models that can prevent, detect, or investigate potential issues.
Most banks operate across an accumulated web of platforms, tools and models to tackle fraud that basically live in silos. Banks may also have different operational teams tasked to different fraud types, mitigating information sharing around fraud investigation.
This approach isn’t going to scale to meet new challenges emerging as technology advances.
Banks need to respond to emerging threats with learning processes and tools that take a more sophisticated, joined-up view of data. To root out fraud driven by synthetic IDs, we need to connect data sets, internally and externally, to enrich knowledge and insights of all parties and relationships to build a context-based understanding of customers and transactions.
The challenge isn’t just making those pieces fit – it’s delivering these critical insights at speed to accurately detect risks and minimize false positive flags. We don’t have the luxury of days, or even hours, to make decisions when the growth of new payment rails and demand for faster payments mean the window of opportunity to detect fraudulent transactions is shrinking.
When it comes to identifying fraudulent activity, adding context to the data means everything. To do this, a strong data foundation is required, connecting internal and external datasets, and combining them with insights on relationships between entities such as people, organizations, and places for a more holistic view of risk. This will be essential to driving more confident, informed decision making around fraud risk detection and investigation for banks.
This approach represents next level fraud risk management – a unified lens across fraud types, channels and products, leaning on advanced data and analytics. As fraud volumes grow and synthetic identities rise, it’s becoming more and more difficult for banks to deliver accurate decision making through existing systems and approaches alone – serious technological firepower is required to respond to and prevent these risks.
The author, Steve Lenderman is Head of Fraud Solutions, North America at Quantexa.