4063 Precise ID
Total Page:16
File Type:pdf, Size:1020Kb
SM Precise ID An integrated approach to the world of identity risk management White paper White paper Abstract in card-not-present fraud. They can also exploit under-the-floor limit transactions Identity risk management has emerged as a or areas where authorization networks are discipline designed to tackle losses in a grey traditionally weak. area of overlap between credit and fraud management. This grey area is independent of 3. Payment fraud: As the choice of electronic how credit and fraud losses may be classified payment methods increases and controls by individual institutions. This paper explores to prevent check fraud improve, fraudsters, the emergence of identity risk and its first-party sensing vulnerabilities, are looking to and third-party identity fraud components. The Automated Clearing House (ACH) and paper considers the necessary elements of an balance transfers as alternative methods to identity risk management strategy and details stealing funds. the requirements that any solution needs to provide to be marketable. Finally, it introduces 4. “Phishing:” The theft of personal Precise ID,SM a new solution offered by Experian information, e.g., PIN numbers or account which seeks to provide the most comprehensive numbers, by using phony institution identity risk management solution on the Websites or through sending e-mails market today. requesting such information. Losses from PIN debit cards are rising as a result, albeit Background at negligible levels. Patterns of fraud are constantly evolving Card issuers have progressively improved The pattern of financial fraud is constantly in spite of challenges evolving. Criminals exploit weaknesses in fraud Despite these trends, fraud losses, as reported defenses and, in turn, institutions block these by card issuers and expressed as a ratio of fraud gaps through the introduction of new policies losses to sales, have decreased by more than 50 and/or technologies to prevent further losses. percent in the past 0 years. Most U.S.-based Additionally, changes in the marketplace lead card companies report net fraud losses in a to new products and services, which inherently sustainable four to 0 basis point range. Overall, bring with them new risks to be exploited and U.S. credit card fraud losses amounted to an the cycle repeats itself. estimated total of $.32B in 2004. Fraud trends that have emerged most The downward movement on these loss recently include: rates has been achieved through substantial investments in fraud detection and prevention 1. Increase in the velocity of fraud: technologies, e.g., neural networks, card Knowing transactions are monitored activation, real-time authorization decisioning. for suspicious patterns, the fraudster These have served to cut losses from understands that a compromised card has traditional fraud scams such as mail theft a limited time utility. Fifty to 75 percent of and counterfeiting. fraud losses can occur within 24 hours of a card being compromised and the loss Despite these investments and noted success can frequently be a result of the first few in stemming losses, public concerns over transactions. Trying to contact the customer financial fraud appear to be higher than ever. after the transaction(s) has occurred does The Internet channel suffers significantly little to prevent the loss. higher loss rates than other conventional channels (CyberSource estimated .8 2. Internationalization of fraud: Specialized percent of sales are lost to fraud).2 There criminal gangs increasingly work outside of are also sustained concerns around the the United States to gain access to account information. They then perpetrate crimes Financial Insights, 2004. online which is driving a rapid increase 2 CyberSource, 5th Online Fraud Report, 2005, p. 4. Precise IDSM | Page Recent examples of highly publicized cases include: . In March 2005, Designer Shoe Warehouse disclosed that personal credit card and banking information for .4 million customers had been stolen from its database. 2. In June 2005, CardSystems Solutions, Inc., disclosed that a breach of its system to process transactions between merchants and credit card issuers exposed 40 million accounts to possible fraud. 3. In March 2004, BJ’s Wholesale Club reported that the cards of approximately three million customers may have been compromised as a result of the theft of data from its credit card database. potential for identity theft losses as a result 2. Customer fraud: The customer claims of stolen personal information. A number of fraud even though they legitimately made highly publicized and ongoing cases of data the transactions. Despite best efforts to compromises serve to heighten consumer investigate these types of cases, ultimately sensitivity around identity theft. some cases are charged off as fraud. In addition to these cases, there is ongoing 3. Agent/Institution discretion: Individual regulatory pressure from the government to institution policies and training with regard ensure adequate authentication of customers, to fraud vary considerably. This provides wide in order to prevent money laundering and discretion on when and how losses are defined. financing of terrorist activities. This requires The lines between first- and third-party financial institutions to continue to upgrade fraud are often blurred and invest in new fraud defenses. Financial institutions that fall behind the innovation curve Nowhere is this classification problem more run the risk of significant exposure to highly apparent than in recent attempts to quantify unpredictable losses. This risk not only occurs the losses generated by third-party identity in the form of immediate increases in financial fraud and in the growing awareness of first- losses, but also in lost business revenues due to party fraud. In theory, the difference between declining consumer confidence. the two is clearly definable: 1. Third-party, or identity theft, is the Defining fraud: Emergence criminal use of another person’s identifying of identity risk information, e.g., name, address, Social Definitions of fraud are not always clear-cut Security number, date of birth, etc. Using While card associations have attempted to some or all of these as his own, the identity categorize fraud into traditional fraud types, thief may apply for a credit account or gain e.g., lost/stolen, counterfeit, nonreceived, etc., access to the victim’s savings, checking or such classification is increasingly fraught with other accounts. Third-party theft also includes difficulties and may actually be detrimental in account takeovers, when someone changes the development of loss reduction strategies. an account name or address to gain control Some of the factors which drive the issues of the account. These losses are typically surrounding classification include: recorded as fraud losses. 1. Multiple fraud types within one case: 2. First-party fraud occurs when an individual Many fraud cases involve several fraud applies for credit using his or her actual types, e.g., counterfeit fraud can involve identity, but with no intention of paying. card-not-present transactions. This includes early payment defaults, when little or no payments are made after White paper getting a loan or other type of credit, and economy from identity fraud to be ₤.3B bust-outs, the sudden and complete use of affecting some 20,000 individuals.4 credit limits on an account or accounts with no intent to pay. These losses are typically It is likely, however, that even in a well-run recorded as credit losses. operation some identity fraud is recorded as a credit loss. Financial Insights has estimated that In reality, there can be overlap between more than 70 percent of identity fraud goes credit and fraud losses (Figure ). It is in this undetected as fraud and is eventually reported area of overlap where the role of a unified as credit loss.5 management approach to identity risk is beginning to evolve. First-party fraud losses are even higher than third-party fraud losses For example, in a case of synthetic identity Perhaps more significantly, many fraud fraud in which identities are fabricated and no managers indicate that first-party fraud losses victim steps forward to claim fraud, accounts can account for 80 to 00 basis points of loss, are charged-off as a credit loss before the dwarfing the losses of third-party identity fraud. institution is aware of the problem. In faceless They are also concerned about the rate of application processing environments, Figure 1: Overlapping worlds of credit and fraud losses the difference between third-party stolen growth. In the United Kingdom, for example, information with intent to defraud or first-party reports of first-party fraud cases are up more manipulation of their own personal information than 90 percent in the four years since 2000.6 with intent not to pay can be very difficult to discern without detailed analytics. 3 From a low of $6B (Financial Insights, 2005,), to a high of $56.6B True estimates of the extent of identity fraud Javelin Strategy & Research, January 2006, “2006 Identity Fraud Survey Report.” losses are hard to determine and actually vary 4 The Guardian “ID Theft is a growing Concern for UK Consumers,” by degrees of magnitude depending on the Jan. 9, 2006. 5 Financial Insights: “Fraud Management Technology: Evolving with the 3 methodology and/or definitions used. In 2005, Times,” 2004, p.3. the UK government estimated the loss to the 6 CIFAS Press Release, April 28, 2005. Precise IDSM | Page 3 This is due in part to a proliferation of programs e.g., due to keying errors, and allowed fraud that target sub-prime markets that, in general, to occur undetected. Over time, these alerts have thinner or nonexistent credit records. were combined and more complex rules were written which marginally improved detection. Managers increasingly realize that similar More sophisticated solutions were created solutions can be used to tackle both third- using logistic regression models. However, they party and first-party fraud losses.