Loraine Lawson
Good day and welcome to Bank Automation’s podcast series, The Buzz. I’m Loraine Lawson, and recently I spoke with Mike Cook, VP of Fraud Solutions Commercialization at identity verification firm Socure. We discussed the growing threat of synthetic fraud in buy now pay later. I asked Mr. Cook how synthetic fraud attacks work.

Mike Cook
Sure. Synthetic fraud is has been around for a long time, you know, you’ve got a lot of folks who say it’s a new new fraud vector, but it’s been around since the early 2000s. And synthetic synthetic fraud is basically, when someone creates an identity to do some, some kind of financial harm to somebody else, right. Synthetic fraud can be there’s different versions of it, it can be manipulated, where it’s consumer, who has had bad credit in the past, and they know they can’t get credit the way they would like to in the future, just because they’ve got a terrible score. And so they will go in and make certain changes generally to their social security number. And they will establish a new credit report, they can do things like it’s called piggybacking, or they can buy an authorized trade line off the internet, which would give them a new credit card with a really high credit limit. And so would artificially inflate the score. They can credit wash, they can pull old trade lines that are legitimately theirs, that or bad off of their credit report so so you can manipulate your own your own identity to make a synthetic identity. And that’s probably about half of the synthetic identities that are out there. The other type of synthetic identity is called fabricated, and that’s when it’s completely fake. person doesn’t exist. And it’s generally somebody who tries to build a new identity so that they can cause some kind of, you know, financial harm, they’ll either open up new accounts, credit card or any other kinds of account the BNPL, right, and then they’ll never pay back, or oftentimes, synthetics will also open up a DDA account, and a fabricated identity will be used as almost the money mule. Right. And so that, you know, if I’m going to do P2P fraud, or any other kind of romance scams, government scams, you know, I certainly don’t want to do it under my own identity. I’d rather money launder under a fabricated synthetic identity. So synthetic identities take a different bunch of different forms, but basically, they’re just identities that don’t really exist.

Loraine Lawson
Okay, and you say that there are things being looked at, can you talk a little bit about how BNPL and synthetic fraud intersects? Is that just a new opportunity for synthetic fraud? What do you see in the space?

Mike Cook
It’s, it’s a new opportunity for everybody. Right? So BNPL is, is it’s really had explosive growth, this, but especially what we saw, you know, over the holidays, this last year, they’ve grown you know, exponentially, right? So fraudsters will always attack a new vertical, right? Because it’s, it’s basically, you’re generally trying to get a bunch of new customers on as quickly as you can. So and buy now, pay later, that’s no different than the same thing we’re seeing in, in crypto platforms in, in online gaming, those kinds of places where they’re really, really trying to grow their customer base. So in BNPL, those companies are doing some things to make the process of getting into BNPL loan, really quick and easy for consumers. So they generally don’t ask for as much information as they need. So it’s easier for a synthetic identity, or a third party, or even first party fraud, which is the consumer who’s using their own identity to get credit to to get a BNPL loan fraudulently and not pay them back. So we do see, we’ve seen, you know, an increase in fraud for BNPL. It can be upwards of 400 basis points of fraud that they see.

Loraine Lawson
So what are BNPL providers getting wrong about synthetic fraud?

Mike Cook
Well, if you don’t have good protection in place, it’s hard to detect synthetic fraudsters, those who are really smart, they’ll just they tend to build a new identity. And it oftentimes is a young person, right? Or it might look like they’re using an immigrant name that has a brand new social. So a social security number this a randomly generated So in 2011, the SSA started creating random socials. Because they knew that there was some abilities for fraudsters to predict what somebody’s real social was because of the way that the socials were created prior to 2011, based on basically the state and when you were born. So they got away from that in 2011. And so what what smart rosters do is they’ll create synthetic identities using a random social, a young person, something that looks to be an immigrant name. And so those will tend to go through the process, it looks, it looks like a real identity to somebody who if you don’t have a good synthetic fraud tool in place, it can get past your KYC or CIP requirements, which I don’t think even BNPL has, though, so. So there’s there’s that issue there, they may not be having the right protections in place. The other thing that BNPL lenders do is they tend to do a soft pool on a credit report. And a soft pull just means Hey, consumers, we’re not going to apply inquiries to your credit reports, right. So again, help speed and reduce the friction for the consumer to decide if they want to do a BNP alone. The problem with that is the inquiry doesn’t get established at the Bureau. and a high velocity of inquiries is a very good indicator of credit risk, as well as fraud. Right. So the BNPL and others who are doing soft credit pools allow synthetic fraud, people who are doing first party fraud, people who are doing third party fraud, to basically test the process, and see if they can get that identity through without having to establish a bunch of inquiries on the credit report, which would therefore, you know, hurt that identity that they’ve created.

Loraine Lawson
So how BNPL, or organizations that are already in existence, better recognize synthetic fraud patterns to minimize these attacks?

Mike Cook
Well, you can always try and build your own solution. But, you know, I’ve been building synthetic fraud solutions for quite a while, I think the right thing to do is use a company like secure, who’s got not only a synthetic fraud scoring solution, driven off of a lot of data that’s not, you know, not that most companies don’t have, but also a third party fraud scoring model, right. So you want to, you want to have all the protections that you can have in place, and generally a company like secure that builds the sigma synthetic model, and uses, you know, a broad amount of data uses a graph defined platform and machine learning to, you know, give you a score, that will capture a lot of those synthetic fraudsters at a low false positive rate. So you don’t add a lot of friction to the process. But you’re able to efficiently weed out those synthetic fraudsters by using, you know, some kind of passive form of identity verification, like a sigma score.

Loraine Lawson
What is the sigma score?

Mike Cook
So sigma is so curious brand is the sum basically just means this of all and it’s it means that we are using all the information that we can at our disposal. So cure is very, very focused on helping be more inclusive. And so what we do a very good job of scoring, which again, synthetic, this is where kind of synthetic in young people overlap, for BNPL, so a lot of people that use BNPL loans are the younger generation. And so this, the sigma score uses all of the data that we acquire very focused on getting information from those younger populations that have a thin information footprint. And we apply that score. Again, it’s just a machine learned score against the data that is given to a BNPL provider and provide back a score and reason codes,

Loraine Lawson
also mentioned at Graph defining platform. What is that?

Mike Cook
Really, really difficult. If you don’t have a graph defined platform, if you don’t have the ability of taking identities and linking them across other identities over time, and then seeing the velocity of those identities. It’s very difficult, especially to catch synthetic fraud, right? Again, if you’re BNPL, and you’re pulling south poles, you’re not going to see those inquiries at the credit bureau. Right? And so you’re gonna miss that velocity of the identity. So using a company like secure that has a graph defined platform, meaning we link a lot of our data across not We’re not looking just for Lorraine, right? We’re looking for Lorraine. We’re looking how she’s used her email. How else has somebody else use that email? does it connect to how many names? How often has it been used in a BNPL? Or other application over the last day? Three days? Six weeks? How was already using her cell phone number? Has it cell phone number been used by other people? You know, what’s going on the address? If it’s a single family dwelling? Why is there 100 applications coming out of that single family dwelling from 100 Different people in the last three days, right? So a graph defined platform allows a company to apply some pretty cool technology to link all that data across, and then use all of that data in the signals that it generates, to create the scores.

Loraine Lawson
Great. And, you know, banks are sort of looking to get into BNPL a little bit. What advice would you have for them moving forward? Because they do have to be concerned with KYC. And some of these regulations?

Mike Cook
Yeah, the good news is, we work with five of the six biggest banks in the country. So we’re generally already working with those as they get into BNPL. They definitely want to pay attention to synthetic fraud, first party fraud and third party fraud, which you know, we have solutions for. And, gosh, they do have KYC, and CIP requirements, you know, the interesting thing, a lot of a lot of folks who asked me, you know, before I get through this KYC application, how to Frog it through and you know, the response as well. KYC is the IP applications really are just determined. Does that identity is that it? Does that identity seem to be real, it does get through some KYC solutions. If you’re using a KY or a CIP solution, that is only using Bureau header data, for instance, synthetic fraud, we’ll get through that. Because secure uses Bureau header data, we use information from other kinds of sources, then we tend to capture more synthetic fraud in the CIP solution, but it’s not always perfect. So you need to have a CIP solution sitting alongside a third party fraud solution and sitting alongside a synthetic fraud solution to really protect yourself.

Loraine Lawson
Okay, those are all my questions. Do you have anything you’d like to add?

Mike Cook
Well, I think you know, BNPL is seen. It’s, it’s interesting with BNPL, right? There anyone who’s in crypto and gave you, anyone who’s really focused on trying to bring in as many customers and grow their customer base as quickly as possible, they are going to see fraud, right? Having a copy, like secure with you, helps to grow your base quickly, to reduce the friction, especially to younger consumers who are fans of BNPL, the biggest fans of the BNPL and therefore their target. And it’s just you have to have those protections in place to grow and keep your fraud a little bit lower than where it’s at today. I think I think BPL lenders are probably going to tighten up their, their, their lending requirements a little bit, they’ll probably do better on identity verification in the future. And I think, you know, especially our customers, you know, we’ve seen that they’re able to reduce their fraud rates substantially by using Socure.

Loraine Lawson:
You’ve been listening to the Buzz, a Bank Automation News podcast. Thank you for your time, and be sure to visit us at Bank automation news.com for more automation news. You can also follow us on Twitter and LinkedIn. Please don’t hesitate to rate this podcast on your podcast platform of choice.