Today’s fraud fighters are left mopping up a flood while the faucet is still running. The proverbial flood, in this case, is caused by the steady flow of synthetic or completely fake identities entering enterprise systems and lingering there until the fraudsters behind them decide to act.
It’s so problematic because every downstream decision an organization makes depends on the identity it first accepted. Subsequent, carefully planned fraud prevention workflows can’t do their job when the organization doesn’t know who it’s really dealing with.
It’s easier than ever for bad actors to pretend to be someone they’re not. Or to invent an identity altogether. Rampant data breaches have turned troves of stolen personally identifiable information (PII) into an open digital book for criminals. Slippery organized crime rings perpetrate impersonation crimes, disappear overnight and stand up a new operation within days. And rapidly democratizing tech has effectively turned crafting near-perfect lookalikes of legitimate identity documents into child’s play.
All of this demands a fresh look at how fraud and security teams use fraud kill chain frameworks to strengthen identity verification and document authentication. These frameworks map the stages of criminal activity, helping teams identify where to intervene. As impersonation tactics evolve, the controls mapped against those stages need to evolve. Now is the time to revisit which identity checks give teams the best chance of spotting and stopping today’s most pernicious identity-based crimes.
More layers create more opportunities to disrupt fraud
Luckily, organizations have more connected technology and intelligence resources than ever before to strengthen those checks. A convincing document doesn’t have to stand on its own. It can be weighed alongside information and signals about the device, email and biometrics used to submit it and the history and behavior of the person behind it. Putting those pieces together gives organizations more opportunities to spot inconsistencies and ask for stronger proof before opening the next door.
Such a layered approach of interconnected data and technologies is outlined in a new Datos Insights report. The Identity Trust Gap: Improving Identity Verification in Banking demonstrates how a layered defense model brings digital and in-person capabilities together with fraud scoring, case review, watchlists, document verification and step-up authentication.
The universal application of the layered defense model
No single control can do it all, and no single organization can pull off every control. The idea is to combine the capabilities that best address an organization’s unique risks. When it’s done right, a fraud kill chain framework helps teams decide where to place those capabilities based on their own distinctive risk profiles and resources.
While the report looks at identity security in the banking industry specifically, the same principles apply across other high-consequence industries, such as gaming and hospitality, secure facilities, automotive and high-value retail.
Consider how a layered defense model works when someone registers for a service. Behavioral analytics flags odd system navigation or copy-and-paste patterns. On their own, those flags may not mean much. But, if shared fraud intelligence is in play, the organization may learn that the device used at registration has been linked to other fraudulent accounts. Taken together, those findings give the organization a reason to send the case for human review or apply stronger checks, such as facial biometrics with liveness detection.
Each layer builds on the others, turning otherwise isolated suspicions into auditable justification for stopping or limiting someone’s access. And those layers don’t have to stop at the screen.
Identity security beyond the screen
Examining an original identity document is still one of the best techniques the good guys have in our toolbox. A photo of a driver’s license may look convincing on a screen, but specialized equipment that uses UV and infrared light can reveal otherwise hidden secrets in the original.
It should be said that the push for digital convenience can make it easy to overlook in-person identity checks as a viable checkpoint.
But here’s the deal. ID scanning doesn’t have to require a separate trip.
It can come when a customer asks to do more and the stakes rise. A bank, for instance, might allow a customer to open an account online with limited functionality, then require an ID scan at a branch before lifting those restrictions. A rental car company might replace a quick visual ID inspection at pickup with document authentication that catches counterfeit licenses. A national car rental agency in Las Vegas reduced rental-car theft dramatically after document authentication was introduced.
Identity verification and authentication don’t end when a customer establishes an account. Organizations should continue validation as users request greater access, change payment details or take other actions with higher consequences. Each offers another opportunity to disrupt two particularly nefarious forms of identity crime, bust out and first-party (or friendly) fraud.
The goal is to match the depth of verification to the risk, keeping the experience competitive while requiring stronger evidence only when it’s called for.
An antacid for competitive heartburn
And that competitive pressure is real. Digitally native companies arrived like the cool new kid at school, sending legacy organizations scrambling to keep up. After spending millions to transform for the digital era, adding in-person identity checks can feel like going back on a really expensive glow up. This can seem especially counterintuitive when the business across the street seems willing to ask fewer questions to win more customers.
But here’s an antacid for that competitive heartburn — the ”cool kids” are adding checks, too.
Take Uber Eats, for example. One of the shiniest digital darlings of our era has added a decidedly analog layer to its identity checks. The company has started conducting in-person ID checks in certain places, with trained experts checking couriers’ identification when they arrive at restaurants to collect orders. The four-minute process is quick and efficient, yet it achieves the really important outcome, building credibility to the previously accepted identity.
Unmasking identity criminals at scale
What makes beefing up identity checks so urgent? Bad actors aren’t letting up on the gas.
LexisNexis reported an eightfold year-over-year increase in fraud involving synthetic identities this year. Organized and well-resourced, identity criminals are disguising themselves as legitimate people, passing checks and doing business openly while their deception goes undetected. And with fraudsters’ little helper — AI — on board, they are iterating their schemes rapidly.
A convincing first impression can become a highly consequential mistake. Building layers that coordinate defenses across both in-person and online checkpoints will make it much harder for imposters to hide in plain sight.
_______
About Joe Lynam
Joe Lynam is CEO at Veridocs, which helps organizations establish trusted identity before access is granted or a transaction occurs. Proven across 95% of the Las Vegas Strip, Veridocs authenticates more than 65 million IDs annually using a global library of more than 4,500 government-issued ID templates. The company serves financial institutions and other high-consequence industries. Veridocs technology is developed and supported by U.S.-based teams. Connect with Joe at linkedin.com/in/joelynam and learn more at veridocs.com.
Join our LinkedIn group Information Security Community!
